Function at 0x427c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x118
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
push 0
mov edi, ecx
mov dword [esp + 0xb0], 0
xor eax, eax
mov dword [esp + 0x1c], edi
push 0
push 0xf0
mov dword [esp + 0x68], eax
xorps xmm0, xmm0
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x10]
push 0x587
push dword [edi]
movaps xmmword [esp + 0xa4], xmm0
mov esi, dword [eax + 0x10]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x845c
push dword [edi + 4]
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x427ccd
push eax
push 0
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [edi + 0x18], 0
mov eax, dword [0x62db64]
mov ecx, 1
add eax, 0xffffffc2
cmp ecx, eax
push esi
sbb eax, eax
and eax, 0xffe0304b
add eax, 0x1fffff
push eax
lea eax, [esp + 0xb4]
push eax
call sym.SystemInformer.exe_Ordinal_1560
mov ecx, dword ds:[esp + 0xac]
test ecx, ecx
je 0x427d6f
lea edx, [esp + 0x14]
call fcn.0051df40
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0x28
push eax
mov dword [esp + 0x68], str.EnableHeapReflection
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x427d67
lea eax, [esp + 0x60]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 2
push dword [esp + 0xc0]
movaps xmmword [esp + 0x78], xmm0
call dword [sym.imp.ntdll.dll_RtlCreateProcessReflection]
test eax, eax
js 0x427d67
movaps xmm0, xmmword [esp + 0x60]
movaps xmmword [esp + 0x90], xmm0
psrldq xmm0, 8
movd esi, xmm0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x5c], eax
lea edx, [esp + 0x74]
mov ecx, esi
call fcn.0051d700
mov esi, eax
test esi, esi
jns 0x427e51
mov eax, dword [edi]
mov dword [esp + 0x1c], eax
cmp esi, 0xc0000022
je 0x427dc3
cmp esi, 0xc0000005
je 0x427dc3
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x427db1
movzx eax, si
jmp 0x427dcd
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x427dd1
mov eax, esi
jmp 0x427dcd
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x427ddc
push esi
lfence
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x427de5
push eax
lfence
call sym.SystemInformer.exe_Ordinal_1670
mov esi, eax
test esi, esi
je 0x427e34
lfence
lfence
push dword [esi + 4]
push 0x5d369c
push str.Unable_to_query_heap_information.
push 0xfffe
push 0x20
push dword [esp + 0x30]
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x428238
lfence
call fcn.004fe1e0
jmp 0x428238
push str.Unable_to_query_heap_information.
push 0x5d369c
push 0x10
push dword [esp + 0x28]
call sym.SystemInformer.exe_Ordinal_1698
add esp, 0x10
jmp 0x428238
mov ecx, dword [esp + 0x74]
xor edx, edx
mov dword [edi + 0x18], ecx
mov eax, dword [ecx + 4]
mov dword [edi + 0x14], eax
cmp dword [ecx], edx
jbe 0x428238
mov eax, dword [esp + 0x1c]
lea esi, [ecx + 0x1c]
dec eax
mov dword [esp + 0x14], esi
neg eax
sbb al, al
mov dword [esp + 0x70], eax
nop dword [eax]
push 0xa
lea ecx, [esp + 0xb4]
lea eax, [edx + 1]
push ecx
push eax
mov dword [esp + 0x6c], eax
call fcn.005880c8
add esp, 0xc
mov dword [esp + 0x20], 5
lea eax, [esp + 0xb0]
mov dword [esp + 0x24], 0x7fffffff
mov dword [esp + 0x34], eax
lea edi, [esi - 0x14]
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104d
mov dword [esp + 0x4c], edi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea ecx, [esp + 0xb4]
mov eax, dword [esp + 0x14]
push 0x10
push ecx
mov eax, dword [eax - 4]
push eax
mov dword [esp + 0xbc], 0x780030
call fcn.005880c8
add esp, 0xc
mov dword [esp + 0x20], 1
lea eax, [esp + 0xb0]
mov dword [esp + 0x24], esi
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 1
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x70]
movzx ecx, byte [0x6314bc]
cmp dword [esp + 0x1c], 1
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10d
mov eax, dword [esp + 0x14]
push 0
push 1
mov byte [esp + 0x8a], cl
mov eax, dword [eax]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_Ordinal_1375
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 2
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x1c], 1
movzx ecx, byte [0x6314bc]
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10d
mov byte [esp + 0x82], cl
mov eax, dword [esp + 0x14]
push 0
push 1
mov dword [esp + 0x94], 0
mov eax, dword [eax + 4]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
call sym.SystemInformer.exe_Ordinal_1375
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 3
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x14]
push 0
push 1
mov dword [esp + 0x80], 0x10009
mov eax, dword [eax - 8]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_Ordinal_1375
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 4
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xffff0fff
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 5
call fcn.00427580
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0x104c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xf000
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 6
call fcn.00427b80
mov edi, dword [esp + 0x18]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x104c
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0x10]
cmp ecx, 0xddeeddee
je 0x4281bc
nop word [eax + eax]
cmp ecx, 0xffeeffee
jne 0x42821d
movzx eax, byte [eax - 0xc]
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 7
sub eax, 1
je 0x4281b2
sub eax, 1
lea eax, [esp + 0x20]
push eax
push 0
push 0x104c
push ecx
je 0x4281a8
mov dword [esp + 0x44], str.NT_Heap
jmp 0x428217
mov dword [esp + 0x44], str.NT_Heap__LFH_
jmp 0x428217
mov dword [esp + 0x34], str.NT_Heap__Lookaside_
jmp 0x42820a
movzx eax, byte [eax - 0xc]
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 7
sub eax, 1
je 0x428202
sub eax, 1
lea eax, [esp + 0x20]
push eax
push 0
push 0x104c
push ecx
je 0x4281f8
mov dword [esp + 0x44], str.Segment_Heap
jmp 0x428217
mov dword [esp + 0x44], str.Segment_Heap__LFH_
jmp 0x428217
mov dword [esp + 0x34], str.Segment_Heap__Lookaside_
lea eax, [esp + 0x20]
push eax
push 0
push 0x104c
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x60]
add esi, 0x1c
mov dword [esp + 0x14], esi
cmp edx, dword [eax]
jb 0x427e80
mov eax, dword ds:[esp + 0x94]
test eax, eax
je 0x42824b
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x90]
test esi, esi
je 0x428266
push 0
push esi
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0xac]
test eax, eax
je 0x428278
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword ds:[esp + 0x5c]
test esi, esi
je 0x4282c6
push 0
push 0
push 0x10
lea eax, [esp + 0x6c]
xorps xmm0, xmm0
movaps xmmword [esp + 0x6c], xmm0
push eax
push 0x2c
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 3
mov byte [esp + 0x7c], 0
mov dword [esp + 0x80], 0
call dword [sym.imp.ntdll.dll_NtPowerInformation]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
push 0
push 0
push 0x844d
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x845c
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret