Function at 0x425fa0
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword [0x62a040]
xor eax, esp
mov dword [esp + 0xf8], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x94], 0
push edi
mov ebx, ecx
mov dword [esp + 0x74], edi
xor eax, eax
mov dword [esp + 0x20], edi
push edi
push 0xf0
mov dword [esp + 0x80], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x78], eax
mov eax, dword [ebx + 0x10]
push 0x587
push dword [ebx]
mov dword [esp + 0x34], edi
mov esi, dword [eax + 0x10]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x845c
push dword [ebx + 4]
mov edi, eax
mov dword [esp + 0x34], edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x426055
push eax
push 0
push dword [0x631034]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebx + 0x18], 0
mov ecx, dword [0x62abb0]
lea eax, ds:[ecx - 0x3e]
cmp eax, 1
ja 0x426072
mov eax, dword [ebx + 0x10]
push dword [eax + 0x10]
push 0x1fffff
jmp 0x426082
cmp ecx, 0x64
jb 0x42608f
mov eax, dword [ebx + 0x10]
push dword [eax + 0x10]
push 0x3000
lea eax, [esp + 0x9c]
push eax
call sym.SystemInformer.exe_PhOpenProcess
mov ecx, dword [esp + 0x94]
test ecx, ecx
je 0x4260ad
lea edx, ds:[esp + 0x10]
call fcn.0051b600
mov eax, dword [esp + 0x10]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x28
push eax
mov dword [esp + 0x1c], str.EnableHeapReflection
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x426142
xor eax, eax
mov dword [esp + 0x10], 0
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 0x4a
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x426142
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 2
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_RtlCreateProcessReflection]
mov ecx, dword [esp + 0x10]
mov edi, eax
test ecx, ecx
je 0x42611e
push ecx
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
mov edi, dword [esp + 0x24]
js 0x426142
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
lea edx, [esp + 0x68]
mov ecx, esi
call fcn.0051ae00
mov esi, eax
test esi, esi
jns 0x42621f
mov edi, dword ds:[ebx]
cmp esi, 0xc0000022
je 0x426194
cmp esi, 0xc0000005
je 0x426194
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x426182
movzx eax, si
jmp 0x42619e
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x4261a4
mov eax, esi
jmp 0x42619e
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
mov edi, edi
test eax, eax
jne 0x4261af
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x4261b8
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x426205
lfence
lfence
push dword [esi + 4]
push 0x5ca058
push str.Unable_to_query_heap_information.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4265e8
lfence
call fcn.004f9e40
jmp 0x426200
jmp 0x4265e8
push str.Unable_to_query_heap_information.
push 0x5ca058
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
jmp 0x4265e8
mov ecx, dword [esp + 0x68]
xor edx, edx
mov dword [ebx + 0x18], ecx
mov eax, dword [ecx + 4]
mov dword [ebx + 0x14], eax
cmp dword [ecx], edx
jbe 0x4265e8
lea eax, [edi - 1]
neg eax
lea edi, [ecx + 0x1c]
mov dword [esp + 0x10], edi
sbb al, al
mov dword [esp + 0x64], eax
jmp 0x426250
push 0xa
lea ecx, [esp + 0x9c]
lea eax, [edx + 1]
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.0058034a
add esp, 0xc
mov dword [esp + 0x28], 5
lea eax, [esp + 0x98]
mov dword [esp + 0x2c], 0x7fffffff
mov dword [esp + 0x3c], eax
add edi, 0xffffffec
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 0
push eax
push 0
push 0x104d
push dword [ebx + 4]
mov dword [esp + 0x58], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea ecx, [esp + 0x9c]
mov eax, dword [esp + 0x10]
push 0x10
push ecx
mov eax, dword [eax - 4]
push eax
mov dword [esp + 0xa4], 0x780030
call fcn.0058034a
add esp, 0xc
mov dword [esp + 0x28], 1
lea eax, [esp + 0x98]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 1
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x64]
movzx ecx, byte [0x62e928]
cmp dword [esp + 0x24], 1
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10c
mov eax, dword [esp + 0x10]
push 0
push 1
mov byte [esp + 0x8a], cl
mov eax, dword [eax]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 2
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x64]
cmp dword [esp + 0x24], 1
movzx ecx, byte [0x62e928]
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10c
mov eax, dword [esp + 0x10]
mov byte [esp + 0x82], cl
mov eax, dword [eax + 4]
mov dword [esp + 0x88], eax
push 0
push 1
lea eax, [esp + 0x80]
mov dword [esp + 0x94], 0
push eax
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 3
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword ds:[esp + 0x10]
push 0
push 1
mov dword [esp + 0x80], 0x10009
mov eax, dword [eax - 8]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 4
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xffff0fff
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 5
call fcn.004259a0
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword ds:[eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xf000
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 6
call fcn.00425f00
mov dword ds:[esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [esp + 0x10]
mov eax, dword [edi - 0x10]
cmp eax, 0xddeeddee
je 0x42656f
cmp eax, 0xffeeffee
jne 0x4265d1
movzx eax, byte [edi - 0xc]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 7
sub eax, 1
je 0x426565
sub eax, 1
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
je 0x42655b
mov dword [esp + 0x4c], str.NT_Heap
jmp 0x4265cb
mov dword [esp + 0x4c], str.NT_Heap__LFH_
jmp 0x4265cb
mov dword [esp + 0x3c], str.NT_Heap__Lookaside_
jmp 0x4265be
movzx eax, byte [edi - 0xc]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 7
sub eax, 1
je 0x4265b6
sub eax, 1
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
je 0x4265ac
mov dword [esp + 0x4c], str.Segment_Heap
jmp 0x4265cb
mov dword [esp + 0x4c], str.Segment_Heap__LFH_
jmp 0x4265cb
mov dword [esp + 0x3c], str.Segment_Heap__Lookaside_
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x68]
add edi, 0x1c
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], edi
cmp edx, dword [eax]
jb 0x426250
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x4265f7
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x70]
test esi, esi
je 0x42660f
push 0
push esi
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x74]
test esi, esi
je 0x42664d
xor eax, eax
mov dword [esp + 0x14], esi
push eax
push eax
mov dword [esp + 0x24], eax
mov byte [esp + 0x24], al
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push 0x10
push eax
push 0x2c
mov dword [esp + 0x2c], 3
call dword [sym.imp.ntdll.dll_NtPowerInformation]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
push 0
push 0
push 0x844d
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x845c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword ds:[esp + 0x104]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret