Function at 0x402e00
Capabilities:
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x46e040]
xor eax, esp
mov dword [esp + 0x214], eax
mov edx, dword [ebp + 8]
push esi
push edi
call fcn.0040e6c0
test eax, eax
js 0x4031ab
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x4031ab
mov eax, dword fs:[0x18]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 1
mov edx, 2
mov dword [esp + 0x20], 0x1c
mov dword [esp + 0x24], str.SiSetupMutant_
mov eax, dword [eax + 0x20]
push 0x10
mov dword [esp + 0x2c], 8
mov dword [esp + 0x3c], eax
call fcn.00407ce0
mov esi, eax
movzx ecx, word [esi]
mov word [esp + 0xd8], cx
movzx ecx, word [esi]
add cx, 2
mov word [esp + 0xda], cx
mov ecx, dword [esi + 4]
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xe8], 0x18
call fcn.00413160
mov dword [esp + 0xec], eax
lea eax, [esp + 0xd8]
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xe8]
push 1
push eax
push 1
lea eax, [esp + 0x18]
mov dword [esp + 0x100], 0x40
push eax
mov dword [esp + 0x108], 0
mov dword [esp + 0x10c], 0
call dword [sym.imp.ntdll.dll_NtCreateMutant]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x402f12
call fcn.00406180
push 0x78
push 4
push dword [0x46fcc0]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x78
mov esi, eax
push 0
push esi
call fcn.004235b0
mov eax, dword [esi + 0x18]
add esp, 0xc
test eax, eax
je 0x402f42
cmp dword ds:[eax], 0
jne 0x402f4a
call fcn.00404040
mov dword [esi + 0x18], eax
mov eax, dword fs:[0x18]
push esi
sub esp, 0xc
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0x10]
movzx eax, word [ecx + 0x40]
mov dword [esp + 0xe8], eax
mov eax, dword [ecx + 0x44]
lea ecx, [esp + 0xe8]
mov dword [esp + 0xec], eax
call fcn.00412e80
test byte ds:[esi + 0x10], 4
je 0x403053
lea eax, [esp + 0xd8]
push eax
call fcn.0040ef60
test byte [eax + 4], 1
je 0x402ffd
mov eax, dword ds:[esi + 0x14]
sub eax, 0
je 0x402fc2
sub eax, 1
je 0x402fb7
sub eax, 1
jne 0x402fc2
push esi
call fcn.00405ea0
jmp 0x402fc8
push esi
call fcn.00405880
mov edi, eax
jmp 0x402fde
push esi
call fcn.004031e0
mov edi, eax
test edi, edi
js 0x402fe8
cmp dword [esi + 0x28], 0
jne 0x402fde
mov ecx, esi
lfence
call fcn.00404dc0
nop
test edi, edi
jns 0x403151
cmp dword [esi + 0x28], 0
jne 0x403151
movzx eax, di
mov dword [esi + 0x28], eax
jmp 0x403151
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov edi, dword [eax + 0x44]
call fcn.00411e80
mov edx, eax
test edx, edx
jne 0x403025
mov dword ds:[esi + 0x28], 8
jmp 0x403151
mov edx, dword [edx + 4]
lea eax, [esi + 0x70]
push eax
push 0xffffffffffffffff
push 1
sub esp, 8
xor ecx, ecx
push edi
call fcn.00412580
nop dword [eax + eax]
test eax, eax
jns 0x403151
movzx eax, ax
mov dword [esi + 0x28], eax
jmp 0x403151
call fcn.00413ea0
lea ecx, [esp + 0x100]
mov dword [esp + 0xc], 0
call fcn.00406220
test byte [esi + 0x10], 2
je 0x4030db
push 0x5c
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x60
push 0
push eax
call fcn.004235b0
mov eax, dword [0x46fcbc]
add esp, 0xc
mov dword [esp + 0x24], eax
lea eax, [esp + 0xd4]
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 1
push 0
push 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], 0xfffd
push eax
mov dword [esp + 0x3c], str.Hey_there__before_we_continue...
mov dword [esp + 0x40], str.__Process_Hacker_was_renamed_System_Informer._n__Process_Hacker_does_not_support_Windows_10_or_11._n__Process_Hacker_will_not_be_updated._n__Process_Hacker_will_not_be_uninstalled._n_nThis_update_will_now_install_System_Informer._n_nPlease_remember_to_uninstall_Process_Hacker._Thanks__3
mov dword [esp + 0x7c], 0xc8
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
push 0x60
lea eax, [esp + 0x74]
push 0
push eax
call fcn.004235b0
mov eax, dword [0x46fcb8]
add esp, 0xc
mov dword [esp + 0x78], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x70], 0x60
mov dword [esp + 0x7c], 0x8008
push eax
push 0
push 0
lea eax, [esp + 0x7c]
mov dword [esp + 0x9c], str.Initializing...
push eax
mov dword [esp + 0xd4], 0x402620
mov dword [esp + 0xd8], esi
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
cmp dword [esp + 0xc], 0
je 0x403145
mov ecx, esi
call fcn.00404dc0
lea ecx, [esp + 0x100]
call fcn.00406300
mov eax, dword [esi + 0x70]
test eax, eax
je 0x403191
push 0
push 0
push eax
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push 0
push 0x18
lea eax, [esp + 0xf0]
push eax
push 0
push dword [esi + 0x70]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
movzx eax, word [esp + 0xe8]
push dword [esi + 0x70]
mov dword [esi + 0x28], eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword ds:[esi + 0x28]
pop edi
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004218f3
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword ds:[esp + 0x21c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.004218f3
mov esp, ebp
pop ebp
ret 0x10