Function at 0x402e00
Capabilities:
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x46d040]
xor eax, esp
mov dword [esp + 0x214], eax
mov edx, dword [ebp + 8]
push esi
push edi
call fcn.0040e640
test eax, eax
js 0x40319f
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x40319f
mov eax, dword fs:[0x18]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 1
mov edx, 2
mov dword [esp + 0x20], 0x1c
mov dword [esp + 0x24], str.SiSetupMutant_
mov eax, dword [eax + 0x20]
push 0x10
mov dword [esp + 0x2c], 8
mov dword [esp + 0x3c], eax
call fcn.00407c80
mov esi, eax
movzx ecx, word [esi]
mov word [esp + 0xd8], cx
movzx ecx, word [esi]
add cx, 2
mov word [esp + 0xda], cx
mov ecx, dword [esi + 4]
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xe8], 0x18
call fcn.00413000
mov dword [esp + 0xec], eax
lea eax, [esp + 0xd8]
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xe8]
push 1
push eax
push 1
lea eax, [esp + 0x18]
mov dword [esp + 0x100], 0x40
push eax
mov dword [esp + 0x108], 0
mov dword [esp + 0x10c], 0
call dword [sym.imp.ntdll.dll_NtCreateMutant]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x402f12
call fcn.004060e0
push 0x78
push 4
push dword [0x46ecc0]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x78
mov esi, eax
push 0
push esi
call fcn.004233f0
mov eax, dword [esi + 0x18]
add esp, 0xc
test eax, eax
je 0x402f42
cmp dword ds:[eax], 0
jne 0x402f4a
call fcn.00404020
mov dword [esi + 0x18], eax
mov eax, dword fs:[0x18]
push esi
sub esp, 0xc
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0x10]
movzx eax, word [ecx + 0x40]
mov dword [esp + 0xe8], eax
mov eax, dword [ecx + 0x44]
lea ecx, [esp + 0xe8]
mov dword [esp + 0xec], eax
call fcn.00412d20
test byte ds:[esi + 0x10], 4
je 0x403038
lea eax, [esp + 0xd8]
push eax
call fcn.0040eee0
test byte [eax + 4], 1
je 0x402fe5
mov eax, dword ds:[esi + 0x14]
sub eax, 0
je 0x402fbf
sub eax, 1
je 0x402fb7
sub eax, 1
jne 0x402fbf
push esi
call fcn.00405e00
jmp 0x402fc5
push esi
call fcn.004057e0
jmp 0x402fc5
push esi
call fcn.004031c0
test eax, eax
jns 0x403145
cmp dword [esi + 0x28], 0
jne 0x403145
movzx eax, ax
mov dword [esi + 0x28], eax
jmp 0x403145
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov edi, dword [eax + 0x44]
call fcn.00411da0
mov edx, eax
test edx, edx
jne 0x40300b
mov dword [esi + 0x28], 8
jmp 0x403145
mov edx, dword ds:[edx + 4]
lea eax, [esi + 0x70]
push eax
push 0xffffffffffffffff
push 1
sub esp, 8
xor ecx, ecx
push edi
call fcn.004124a0
test eax, eax
jns 0x403145
movzx eax, ax
mov dword [esi + 0x28], eax
jmp 0x403145
call fcn.00413d60
lea ecx, [esp + 0x100]
mov dword [esp + 0xc], 0
call fcn.00406180
test byte [esi + 0x10], 2
je 0x4030c6
push 0x5c
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x60
push 0
push eax
call fcn.004233f0
mov eax, dword [0x46ecbc]
add esp, 0xc
mov dword [esp + 0x24], eax
lea eax, [esp + 0xd4]
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 1
push 0
push 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], 0xfffd
push eax
mov dword [esp + 0x3c], str.Hey_there__before_we_continue...
mov dword [esp + 0x40], str.__Process_Hacker_was_renamed_System_Informer._n__Process_Hacker_does_not_support_Windows_10_or_11._n__Process_Hacker_will_not_be_updated._n__Process_Hacker_will_not_be_uninstalled._n_nThis_update_will_now_install_System_Informer._n_nPlease_remember_to_uninstall_Process_Hacker._Thanks__3
mov dword [esp + 0x7c], 0xc8
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
push 0x60
lea eax, [esp + 0x74]
push 0
push eax
call fcn.004233f0
mov eax, dword [0x46ecb8]
add esp, 0xc
mov dword [esp + 0x78], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x70], 0x60
mov dword [esp + 0x7c], 0x8008
push eax
push 0
push 0
lea eax, [esp + 0x7c]
mov dword [esp + 0x9c], str.Initializing...
push eax
mov dword [esp + 0xd4], 0x402620
mov dword [esp + 0xd8], esi
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
cmp dword [esp + 0xc], 0
je 0x403134
mov ecx, esi
call fcn.00404da0
lea ecx, ds:[esp + 0x100]
call fcn.00406260
mov eax, dword [esi + 0x70]
test eax, eax
je 0x403186
push 0
push 0
push eax
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push 0
push 0x18
lea eax, [esp + 0xf0]
push eax
push 0
push dword [esi + 0x70]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
movzx eax, word ds:[esp + 0xe8]
push dword [esi + 0x70]
mov dword [esi + 0x28], eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esi + 0x28]
pop edi
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00421733
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x21c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.00421733
mov esp, ebp
pop ebp
ret 0x10