Function at 0x427fa0
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword [0x62e040]
xor eax, esp
mov dword [esp + 0xf8], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x94], 0
push edi
mov ebx, ecx
mov dword [esp + 0x74], edi
xor eax, eax
mov dword [esp + 0x20], edi
push edi
push 0xf0
mov dword [esp + 0x80], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x78], eax
mov eax, dword [ebx + 0x10]
push 0x587
push dword [ebx]
mov dword [esp + 0x34], edi
mov esi, dword [eax + 0x10]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x845c
push dword [ebx + 4]
mov edi, eax
mov dword [esp + 0x34], edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x428055
push eax
push 0
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebx + 0x18], 0
mov ecx, dword [0x62ebb0]
lea eax, ds:[ecx - 0x3e]
cmp eax, 1
ja 0x428072
mov eax, dword [ebx + 0x10]
push dword [eax + 0x10]
push 0x1fffff
jmp 0x428082
cmp ecx, 0x64
jb 0x42808f
mov eax, dword [ebx + 0x10]
push dword [eax + 0x10]
push 0x3000
lea eax, [esp + 0x9c]
push eax
call sym.SystemInformer.exe_PhOpenProcess
mov ecx, dword [esp + 0x94]
test ecx, ecx
je 0x4280ad
lea edx, ds:[esp + 0x10]
call fcn.0051e460
mov eax, dword [esp + 0x10]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x28
push eax
mov dword [esp + 0x1c], str.EnableHeapReflection
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x428142
xor eax, eax
mov dword [esp + 0x10], 0
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 0x4a
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x428142
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 2
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_RtlCreateProcessReflection]
mov ecx, dword [esp + 0x10]
mov edi, eax
test ecx, ecx
je 0x42811e
push ecx
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
mov edi, dword [esp + 0x24]
js 0x428142
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
lea edx, [esp + 0x68]
mov ecx, esi
call fcn.0051dc60
mov esi, eax
test esi, esi
jns 0x42821f
mov edi, dword ds:[ebx]
cmp esi, 0xc0000022
je 0x428194
cmp esi, 0xc0000005
je 0x428194
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x428182
movzx eax, si
jmp 0x42819e
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x4281a4
mov eax, esi
jmp 0x42819e
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
mov edi, edi
test eax, eax
jne 0x4281af
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x4281b8
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x428205
lfence
lfence
push dword [esi + 4]
push 0x5cd56c
push str.Unable_to_query_heap_information.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4285e8
lfence
call fcn.004fc020
jmp 0x428200
jmp 0x4285e8
push str.Unable_to_query_heap_information.
push 0x5cd56c
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
jmp 0x4285e8
mov ecx, dword [esp + 0x68]
xor edx, edx
mov dword [ebx + 0x18], ecx
mov eax, dword [ecx + 4]
mov dword [ebx + 0x14], eax
cmp dword [ecx], edx
jbe 0x4285e8
lea eax, [edi - 1]
neg eax
lea edi, [ecx + 0x1c]
mov dword [esp + 0x10], edi
sbb al, al
mov dword [esp + 0x64], eax
jmp 0x428250
push 0xa
lea ecx, [esp + 0x9c]
lea eax, [edx + 1]
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.0058414a
add esp, 0xc
mov dword [esp + 0x28], 5
lea eax, [esp + 0x98]
mov dword [esp + 0x2c], 0x7fffffff
mov dword [esp + 0x3c], eax
add edi, 0xffffffec
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 0
push eax
push 0
push 0x104d
push dword [ebx + 4]
mov dword [esp + 0x58], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea ecx, [esp + 0x9c]
mov eax, dword [esp + 0x10]
push 0x10
push ecx
mov eax, dword [eax - 4]
push eax
mov dword [esp + 0xa4], 0x780030
call fcn.0058414a
add esp, 0xc
mov dword [esp + 0x28], 1
lea eax, [esp + 0x98]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 1
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x64]
movzx ecx, byte [0x632948]
cmp dword [esp + 0x24], 1
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10d
mov eax, dword [esp + 0x10]
push 0
push 1
mov byte [esp + 0x8a], cl
mov eax, dword [eax]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 2
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x64]
cmp dword [esp + 0x24], 1
movzx ecx, byte [0x632948]
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10d
mov eax, dword [esp + 0x10]
mov byte [esp + 0x82], cl
mov eax, dword [eax + 4]
mov dword [esp + 0x88], eax
push 0
push 1
lea eax, [esp + 0x80]
mov dword [esp + 0x94], 0
push eax
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 3
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword ds:[esp + 0x10]
push 0
push 1
mov dword [esp + 0x80], 0x10009
mov eax, dword [eax - 8]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 4
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xffff0fff
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 5
call fcn.004279a0
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword ds:[eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xf000
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 6
call fcn.00427f00
mov dword ds:[esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [esp + 0x10]
mov eax, dword [edi - 0x10]
cmp eax, 0xddeeddee
je 0x42856f
cmp eax, 0xffeeffee
jne 0x4285d1
movzx eax, byte [edi - 0xc]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 7
sub eax, 1
je 0x428565
sub eax, 1
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
je 0x42855b
mov dword [esp + 0x4c], str.NT_Heap
jmp 0x4285cb
mov dword [esp + 0x4c], str.NT_Heap__LFH_
jmp 0x4285cb
mov dword [esp + 0x3c], str.NT_Heap__Lookaside_
jmp 0x4285be
movzx eax, byte [edi - 0xc]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 7
sub eax, 1
je 0x4285b6
sub eax, 1
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
je 0x4285ac
mov dword [esp + 0x4c], str.Segment_Heap
jmp 0x4285cb
mov dword [esp + 0x4c], str.Segment_Heap__LFH_
jmp 0x4285cb
mov dword [esp + 0x3c], str.Segment_Heap__Lookaside_
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x68]
add edi, 0x1c
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], edi
cmp edx, dword [eax]
jb 0x428250
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x4285f7
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x70]
test esi, esi
je 0x42860f
push 0
push esi
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x74]
test esi, esi
je 0x42864d
xor eax, eax
mov dword [esp + 0x14], esi
push eax
push eax
mov dword [esp + 0x24], eax
mov byte [esp + 0x24], al
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push 0x10
push eax
push 0x2c
mov dword [esp + 0x2c], 3
call dword [sym.imp.ntdll.dll_NtPowerInformation]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
push 0
push 0
push 0x844d
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x845c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword ds:[esp + 0x104]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret