Function at 0x427f40
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0xf8], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x94], 0
push edi
mov ebx, ecx
mov dword [esp + 0x74], edi
xor eax, eax
mov dword [esp + 0x20], edi
push edi
push 0xf0
mov dword [esp + 0x80], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x78], eax
mov eax, dword [ebx + 0x10]
push 0x587
push dword [ebx]
mov dword [esp + 0x34], edi
mov esi, dword [eax + 0x10]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x845c
push dword [ebx + 4]
mov edi, eax
mov dword [esp + 0x34], edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x427ff5
push eax
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebx + 0x18], 0
mov ecx, dword [0x62dbb0]
lea eax, ds:[ecx - 0x3e]
cmp eax, 1
ja 0x428012
mov eax, dword [ebx + 0x10]
push dword [eax + 0x10]
push 0x1fffff
jmp 0x428022
cmp ecx, 0x64
jb 0x42802f
mov eax, dword [ebx + 0x10]
push dword [eax + 0x10]
push 0x3000
lea eax, [esp + 0x9c]
push eax
call sym.SystemInformer.exe_PhOpenProcess
mov ecx, dword [esp + 0x94]
test ecx, ecx
je 0x42804d
lea edx, ds:[esp + 0x10]
call fcn.0051d8e0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x28
push eax
mov dword [esp + 0x1c], str.EnableHeapReflection
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4280e2
xor eax, eax
mov dword [esp + 0x10], 0
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 0x4a
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x4280e2
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 2
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_RtlCreateProcessReflection]
mov ecx, dword [esp + 0x10]
mov edi, eax
test ecx, ecx
je 0x4280be
push ecx
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
mov edi, dword [esp + 0x24]
js 0x4280e2
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
lea edx, [esp + 0x68]
mov ecx, esi
call fcn.0051d0e0
mov esi, eax
test esi, esi
jns 0x4281bf
mov edi, dword ds:[ebx]
cmp esi, 0xc0000022
je 0x428134
cmp esi, 0xc0000005
je 0x428134
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x428122
movzx eax, si
jmp 0x42813e
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x428144
mov eax, esi
jmp 0x42813e
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
mov edi, edi
test eax, eax
jne 0x42814f
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x428158
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x4281a5
lfence
lfence
push dword [esi + 4]
push 0x5cc39c
push str.Unable_to_query_heap_information.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x428588
lfence
call fcn.004fbe40
jmp 0x4281a0
jmp 0x428588
push str.Unable_to_query_heap_information.
push 0x5cc39c
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
jmp 0x428588
mov ecx, dword [esp + 0x68]
xor edx, edx
mov dword [ebx + 0x18], ecx
mov eax, dword [ecx + 4]
mov dword [ebx + 0x14], eax
cmp dword [ecx], edx
jbe 0x428588
lea eax, [edi - 1]
neg eax
lea edi, [ecx + 0x1c]
mov dword [esp + 0x10], edi
sbb al, al
mov dword [esp + 0x64], eax
jmp 0x4281f0
push 0xa
lea ecx, [esp + 0x9c]
lea eax, [edx + 1]
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.00582eea
add esp, 0xc
mov dword [esp + 0x28], 5
lea eax, [esp + 0x98]
mov dword [esp + 0x2c], 0x7fffffff
mov dword [esp + 0x3c], eax
add edi, 0xffffffec
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 0
push eax
push 0
push 0x104d
push dword [ebx + 4]
mov dword [esp + 0x58], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea ecx, [esp + 0x9c]
mov eax, dword [esp + 0x10]
push 0x10
push ecx
mov eax, dword [eax - 4]
push eax
mov dword [esp + 0xa4], 0x780030
call fcn.00582eea
add esp, 0xc
mov dword [esp + 0x28], 1
lea eax, [esp + 0x98]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 1
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x64]
movzx ecx, byte [0x6319a8]
cmp dword [esp + 0x24], 1
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10c
mov eax, dword [esp + 0x10]
push 0
push 1
mov byte [esp + 0x8a], cl
mov eax, dword [eax]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 2
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x64]
cmp dword [esp + 0x24], 1
movzx ecx, byte [0x6319a8]
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10c
mov eax, dword [esp + 0x10]
mov byte [esp + 0x82], cl
mov eax, dword [eax + 4]
mov dword [esp + 0x88], eax
push 0
push 1
lea eax, [esp + 0x80]
mov dword [esp + 0x94], 0
push eax
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 3
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword ds:[esp + 0x10]
push 0
push 1
mov dword [esp + 0x80], 0x10009
mov eax, dword [eax - 8]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 4
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xffff0fff
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 5
call fcn.00427940
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword ds:[eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xf000
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 6
call fcn.00427ea0
mov dword ds:[esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [esp + 0x10]
mov eax, dword [edi - 0x10]
cmp eax, 0xddeeddee
je 0x42850f
cmp eax, 0xffeeffee
jne 0x428571
movzx eax, byte [edi - 0xc]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 7
sub eax, 1
je 0x428505
sub eax, 1
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
je 0x4284fb
mov dword [esp + 0x4c], str.NT_Heap
jmp 0x42856b
mov dword [esp + 0x4c], str.NT_Heap__LFH_
jmp 0x42856b
mov dword [esp + 0x3c], str.NT_Heap__Lookaside_
jmp 0x42855e
movzx eax, byte [edi - 0xc]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 7
sub eax, 1
je 0x428556
sub eax, 1
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
je 0x42854c
mov dword [esp + 0x4c], str.Segment_Heap
jmp 0x42856b
mov dword [esp + 0x4c], str.Segment_Heap__LFH_
jmp 0x42856b
mov dword [esp + 0x3c], str.Segment_Heap__Lookaside_
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x68]
add edi, 0x1c
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], edi
cmp edx, dword [eax]
jb 0x4281f0
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x428597
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x70]
test esi, esi
je 0x4285af
push 0
push esi
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x74]
test esi, esi
je 0x4285ed
xor eax, eax
mov dword [esp + 0x14], esi
push eax
push eax
mov dword [esp + 0x24], eax
mov byte [esp + 0x24], al
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push 0x10
push eax
push 0x2c
mov dword [esp + 0x2c], 3
call dword [sym.imp.ntdll.dll_NtPowerInformation]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
push 0
push 0
push 0x844d
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x845c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword ds:[esp + 0x104]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret