Function at 0x426320
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0xf8], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x94], 0
push edi
mov ebx, ecx
mov dword [esp + 0x74], edi
xor eax, eax
mov dword [esp + 0x28], edi
push edi
push 0xf0
mov dword [esp + 0x80], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x78], eax
mov eax, dword [ebx + 0x10]
push 0x587
push dword [ebx]
mov dword [esp + 0x34], edi
mov esi, dword [eax + 0x10]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x845c
push dword [ebx + 4]
mov edi, eax
mov dword [esp + 0x74], edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4263d5
push eax
push 0
push dword [0x6337d4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebx + 0x18], 0
mov ecx, dword [0x62dbb0]
lea eax, ds:[ecx - 0x3e]
cmp eax, 1
ja 0x4263f2
mov eax, dword [ebx + 0x10]
push dword [eax + 0x10]
push 0x1fffff
jmp 0x426402
cmp ecx, 0x64
jb 0x42640f
mov eax, dword [ebx + 0x10]
push dword [eax + 0x10]
push 0x3000
lea eax, [esp + 0x9c]
push eax
call sym.SystemInformer.exe_PhOpenProcess
mov ecx, dword [esp + 0x94]
test ecx, ecx
je 0x42642d
lea edx, ds:[esp + 0x10]
call fcn.0051dc40
mov eax, dword [esp + 0x10]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x28
push eax
mov dword [esp + 0x1c], str.EnableHeapReflection
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4264d3
xor eax, eax
mov dword [esp + 0x10], 0
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 0x4a
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x4264d3
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 2
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_RtlCreateProcessReflection]
mov ecx, dword [esp + 0x10]
mov edi, eax
test ecx, ecx
je 0x4264a6
push ecx
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x4264ca
mov eax, dword [esp + 0x14]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
cmovns esi, dword [esp + 0x24]
mov edi, dword [esp + 0x64]
lea edx, [esp + 0x68]
mov ecx, esi
call fcn.0051d440
mov esi, eax
test esi, esi
jns 0x4265ae
mov edi, dword [ebx]
cmp esi, 0xc0000022
je 0x42651e
cmp esi, 0xc0000005
je 0x42651e
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x42650c
movzx eax, si
jmp 0x426528
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x42652c
mov eax, esi
jmp 0x426528
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x426537
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x426545
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x426594
lfence
lfence
push dword [esi + 4]
push 0x5cd020
push str.Unable_to_query_heap_information.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x426974
lfence
call fcn.004fbfa0
jmp 0x426974
push str.Unable_to_query_heap_information.
push 0x5cd020
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
jmp 0x426974
mov ecx, dword ds:[esp + 0x68]
xor edx, edx
mov dword [ebx + 0x18], ecx
mov eax, dword [ecx + 4]
mov dword [ebx + 0x14], eax
cmp dword [ecx], edx
jbe 0x426974
lea eax, [edi - 1]
neg eax
lea edi, [ecx + 0x1c]
mov dword [esp + 0x10], edi
sbb al, al
mov dword [esp + 0x24], eax
lea ebx, [ebx]
push 0xa
lea ecx, [esp + 0x9c]
lea eax, [edx + 1]
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.00583bea
add esp, 0xc
mov dword [esp + 0x28], 5
lea eax, [esp + 0x98]
mov dword [esp + 0x2c], 0x7fffffff
mov dword [esp + 0x3c], eax
add edi, 0xffffffec
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 0
push eax
push 0
push 0x104d
push dword [ebx + 4]
mov dword [esp + 0x58], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea ecx, [esp + 0x9c]
mov eax, dword [esp + 0x10]
push 0x10
push ecx
mov eax, dword [eax - 4]
push eax
mov dword [esp + 0xa4], 0x780030
call fcn.00583bea
add esp, 0xc
mov dword [esp + 0x28], 1
lea eax, [esp + 0x98]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 1
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword ds:[esp + 0x24]
movzx ecx, byte [0x631938]
cmp dword [esp + 0x64], 1
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10c
mov eax, dword [esp + 0x10]
push 0
push 1
mov byte [esp + 0x8a], cl
mov eax, dword [eax]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 2
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x64], 1
movzx ecx, byte [0x631938]
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10c
mov eax, dword [esp + 0x10]
mov byte [esp + 0x82], cl
mov eax, dword [eax + 4]
mov dword [esp + 0x88], eax
push 0
push 1
lea eax, [esp + 0x80]
mov dword [esp + 0x94], 0
push eax
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 3
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword ds:[eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x10]
push 0
push 1
mov dword [esp + 0x80], 0x10009
mov eax, dword [eax - 8]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 4
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xffff0fff
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 5
call fcn.00425d20
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xf000
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 6
call fcn.00426280
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [esp + 0x10]
mov eax, dword [edi - 0x10]
cmp eax, 0xddeeddee
je 0x4268fb
lea esp, [esp]
cmp eax, 0xffeeffee
jne 0x42695d
movzx eax, byte [edi - 0xc]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 7
sub eax, 1
je 0x4268f1
sub eax, 1
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
je 0x4268e7
mov dword [esp + 0x4c], str.NT_Heap
jmp 0x426957
mov dword [esp + 0x4c], str.NT_Heap__LFH_
jmp 0x426957
mov dword [esp + 0x3c], str.NT_Heap__Lookaside_
jmp 0x42694a
movzx eax, byte [edi - 0xc]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 7
sub eax, 1
je 0x426942
sub eax, 1
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
je 0x426937
mov dword [esp + 0x4c], str.Segment_Heap
jmp 0x426957
mov dword [esp + 0x4c], str.Segment_Heap__LFH_
nop
jmp 0x426957
mov dword [esp + 0x3c], str.Segment_Heap__Lookaside_
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x68]
add edi, 0x1c
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], edi
cmp edx, dword [eax]
jb 0x4265e0
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x426986
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x70]
test esi, esi
je 0x42699e
push 0
push esi
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x74]
test esi, esi
je 0x4269d8
xor eax, eax
mov dword [esp + 0x14], esi
push eax
push eax
mov dword [esp + 0x24], eax
mov byte [esp + 0x24], al
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push 0x10
push eax
push 0x2c
mov dword [esp + 0x2c], 3
call dword [sym.imp.ntdll.dll_NtPowerInformation]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
push 0
push 0
push 0x844d
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x845c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x104]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret