Function at 0x42bcc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0x50], eax
test byte [0x5d03a0], 1
push ebx
push esi
push edi
jne 0x42bec8
mov eax, dword [0x5d03a4]
test eax, eax
je 0x42bd02
push 0
push dword [eax + 4]
call sym.ProcessHacker.exe_PhGetFullPath
mov dword [0x5ccf70], eax
mov edi, edi
jmp 0x42bd07
mov eax, dword [0x5ccf70]
or esi, 0xffffffff
test eax, eax
jne 0x42bd7f
call sym.ProcessHacker.exe_PhGetApplicationFileName
mov edi, eax
test edi, edi
je 0x42bd5f
push 0x5c96dc
push edi
call sym.ProcessHacker.exe_PhConcatStringRef2
mov ebx, eax
push dword [ebx + 4]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
test al, al
je 0x42bd3b
mov dword [0x5ccf70], ebx
jmp 0x42bd4d
lea ecx, [ebx - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x42bd4d
call fcn.004c1f60
lea ecx, [edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x42bd5f
call fcn.004c1f60
mov eax, dword [0x5ccf70]
test eax, eax
jne 0x42bd7f
push 0x5c96bc
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
mov dword [0x5ccf70], eax
test eax, eax
je 0x42bec8
push dword [eax + 4]
call sym.ProcessHacker.exe_PhLoadSettings
cmp eax, 0xc0000102
jne 0x42bec8
push str.If_you_select_No__the_settings_system_will_not_function_properly.
push str.Process_Hackers_settings_file_is_corrupt._Do_you_want_to_reset_it_
push 0xffff
push 6
push 0
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x14
cmp eax, 6
jne 0x42bea8
mov eax, dword [str._settings___settings_]
lea ecx, ds:[esp + 0x14]
mov dword [esp + 0x44], eax
mov eax, dword [0x588d6c]
mov dword [esp + 0x48], eax
mov eax, dword [0x588d70]
mov dword [esp + 0x4c], eax
mov eax, dword [0x588d74]
mov dword [esp + 0x50], eax
mov eax, dword [0x588d78]
mov dword [esp + 0x54], eax
mov ax, word [0x588d7c]
push 0
mov word [esp + 0x5c], ax
mov eax, dword [0x5ccf70]
push 0
push ecx
push dword [eax + 4]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
test eax, eax
js 0x42bec8
push 0
push 0
push 0x60
push 4
push 5
push 0x80
lea eax, [esp + 0x2c]
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x4c]
push 0
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], 0
push eax
push 0x120116
lea eax, [esp + 0x38]
mov dword [esp + 0x50], 0x40
push eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov esi, eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
js 0x42bec8
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x44]
push 0
push 0
push 0x15
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.ntdll.dll_NtWriteFile]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x42bec8
mov ecx, dword [0x5ccf70]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], esi
dec esi
jne 0x42bebe
call fcn.004c1f60
mov dword [0x5ccf70], 0
push str.EnablePlugins
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
push str.MaxSizeUnit
setne byte [0x5ccf74]
call sym.ProcessHacker.exe_PhGetIntegerSetting
push str.SampleCountAutomatic
mov dword [0x5cc1a4], eax
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x42bf25
push 0x4e
call dword [sym.imp.USER32.dll_GetSystemMetrics]
inc eax
mov ecx, 0x800
cdq
sub eax, edx
sar eax, 1
cmp eax, ecx
cmova eax, ecx
push eax
push str.SampleCount
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret