Function at 0x427bc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x118
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
push 0
mov edi, ecx
mov dword [esp + 0xb0], 0
xor eax, eax
mov dword [esp + 0x1c], edi
push 0
push 0xf0
mov dword [esp + 0x68], eax
xorps xmm0, xmm0
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x10]
push 0x587
push dword [edi]
movaps xmmword [esp + 0xa4], xmm0
mov esi, dword [eax + 0x10]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x845c
push dword [edi + 4]
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x427c6d
push eax
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [edi + 0x18], 0
mov eax, dword [0x62db64]
mov ecx, 1
add eax, 0xffffffc2
cmp ecx, eax
push esi
sbb eax, eax
and eax, 0xffe0304b
add eax, 0x1fffff
push eax
lea eax, [esp + 0xb4]
push eax
call sym.SystemInformer.exe_Ordinal_1560
mov ecx, dword ds:[esp + 0xac]
test ecx, ecx
je 0x427d0f
lea edx, [esp + 0x14]
call fcn.0051de60
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0x28
push eax
mov dword [esp + 0x68], str.EnableHeapReflection
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x427d07
lea eax, [esp + 0x60]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 2
push dword [esp + 0xc0]
movaps xmmword [esp + 0x78], xmm0
call dword [sym.imp.ntdll.dll_RtlCreateProcessReflection]
test eax, eax
js 0x427d07
movaps xmm0, xmmword [esp + 0x60]
movaps xmmword [esp + 0x90], xmm0
psrldq xmm0, 8
movd esi, xmm0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x5c], eax
lea edx, [esp + 0x74]
mov ecx, esi
call fcn.0051d620
mov esi, eax
test esi, esi
jns 0x427df1
mov eax, dword [edi]
mov dword [esp + 0x1c], eax
cmp esi, 0xc0000022
je 0x427d63
cmp esi, 0xc0000005
je 0x427d63
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x427d51
movzx eax, si
jmp 0x427d6d
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x427d71
mov eax, esi
jmp 0x427d6d
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x427d7c
push esi
lfence
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x427d85
push eax
lfence
call sym.SystemInformer.exe_Ordinal_1670
mov esi, eax
test esi, esi
je 0x427dd4
lfence
lfence
push dword [esi + 4]
push 0x5d369c
push str.Unable_to_query_heap_information.
push 0xfffe
push 0x20
push dword [esp + 0x30]
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4281d8
lfence
call fcn.004fe0c0
jmp 0x4281d8
push str.Unable_to_query_heap_information.
push 0x5d369c
push 0x10
push dword [esp + 0x28]
call sym.SystemInformer.exe_Ordinal_1698
add esp, 0x10
jmp 0x4281d8
mov ecx, dword [esp + 0x74]
xor edx, edx
mov dword [edi + 0x18], ecx
mov eax, dword [ecx + 4]
mov dword [edi + 0x14], eax
cmp dword [ecx], edx
jbe 0x4281d8
mov eax, dword [esp + 0x1c]
lea esi, [ecx + 0x1c]
dec eax
mov dword [esp + 0x14], esi
neg eax
sbb al, al
mov dword [esp + 0x70], eax
nop dword [eax]
push 0xa
lea ecx, [esp + 0xb4]
lea eax, [edx + 1]
push ecx
push eax
mov dword [esp + 0x6c], eax
call fcn.005880a8
add esp, 0xc
mov dword [esp + 0x20], 5
lea eax, [esp + 0xb0]
mov dword [esp + 0x24], 0x7fffffff
mov dword [esp + 0x34], eax
lea edi, [esi - 0x14]
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104d
mov dword [esp + 0x4c], edi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea ecx, [esp + 0xb4]
mov eax, dword [esp + 0x14]
push 0x10
push ecx
mov eax, dword [eax - 4]
push eax
mov dword [esp + 0xbc], 0x780030
call fcn.005880a8
add esp, 0xc
mov dword [esp + 0x20], 1
lea eax, [esp + 0xb0]
mov dword [esp + 0x24], esi
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 1
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x70]
movzx ecx, byte [0x6314c0]
cmp dword [esp + 0x1c], 1
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10d
mov eax, dword [esp + 0x14]
push 0
push 1
mov byte [esp + 0x8a], cl
mov eax, dword [eax]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_Ordinal_1375
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 2
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x1c], 1
movzx ecx, byte [0x6314c0]
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10d
mov byte [esp + 0x82], cl
mov eax, dword [esp + 0x14]
push 0
push 1
mov dword [esp + 0x94], 0
mov eax, dword [eax + 4]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
call sym.SystemInformer.exe_Ordinal_1375
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 3
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x14]
push 0
push 1
mov dword [esp + 0x80], 0x10009
mov eax, dword [eax - 8]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_Ordinal_1375
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 4
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xffff0fff
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 5
call fcn.00427520
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xf000
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 6
call fcn.00427b20
mov edi, dword [esp + 0x18]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x104c
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0x10]
cmp ecx, 0xddeeddee
je 0x42815c
nop word [eax + eax]
cmp ecx, 0xffeeffee
jne 0x4281bd
movzx eax, byte [eax - 0xc]
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 7
sub eax, 1
je 0x428152
sub eax, 1
lea eax, [esp + 0x20]
push eax
push 0
push 0x104c
push ecx
je 0x428148
mov dword [esp + 0x44], str.NT_Heap
jmp 0x4281b7
mov dword [esp + 0x44], str.NT_Heap__LFH_
jmp 0x4281b7
mov dword [esp + 0x34], str.NT_Heap__Lookaside_
jmp 0x4281aa
movzx eax, byte [eax - 0xc]
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 7
sub eax, 1
je 0x4281a2
sub eax, 1
lea eax, [esp + 0x20]
push eax
push 0
push 0x104c
push ecx
je 0x428198
mov dword [esp + 0x44], str.Segment_Heap
jmp 0x4281b7
mov dword [esp + 0x44], str.Segment_Heap__LFH_
jmp 0x4281b7
mov dword [esp + 0x34], str.Segment_Heap__Lookaside_
lea eax, [esp + 0x20]
push eax
push 0
push 0x104c
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x60]
add esi, 0x1c
mov dword [esp + 0x14], esi
cmp edx, dword [eax]
jb 0x427e20
mov eax, dword ds:[esp + 0x94]
test eax, eax
je 0x4281eb
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x90]
test esi, esi
je 0x428206
push 0
push esi
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0xac]
test eax, eax
je 0x428218
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword ds:[esp + 0x5c]
test esi, esi
je 0x428266
push 0
push 0
push 0x10
lea eax, [esp + 0x6c]
xorps xmm0, xmm0
movaps xmmword [esp + 0x6c], xmm0
push eax
push 0x2c
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 3
mov byte [esp + 0x7c], 0
mov dword [esp + 0x80], 0
call dword [sym.imp.ntdll.dll_NtPowerInformation]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
push 0
push 0
push 0x844d
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x845c
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret