Function at 0x428000
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0xf8], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x94], 0
push edi
mov ebx, ecx
mov dword [esp + 0x74], edi
xor eax, eax
mov dword [esp + 0x20], edi
push edi
push 0xf0
mov dword [esp + 0x80], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x78], eax
mov eax, dword [ebx + 0x10]
push 0x587
push dword [ebx]
mov dword [esp + 0x34], edi
mov esi, dword [eax + 0x10]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x845c
push dword [ebx + 4]
mov edi, eax
mov dword [esp + 0x34], edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4280b5
push eax
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebx + 0x18], 0
mov ecx, dword [0x62dbb0]
lea eax, ds:[ecx - 0x3e]
cmp eax, 1
ja 0x4280d2
mov eax, dword [ebx + 0x10]
push dword [eax + 0x10]
push 0x1fffff
jmp 0x4280e2
cmp ecx, 0x64
jb 0x4280ef
mov eax, dword [ebx + 0x10]
push dword [eax + 0x10]
push 0x3000
lea eax, [esp + 0x9c]
push eax
call sym.SystemInformer.exe_PhOpenProcess
mov ecx, dword [esp + 0x94]
test ecx, ecx
je 0x42810d
lea edx, ds:[esp + 0x10]
call fcn.0051d440
mov eax, dword [esp + 0x10]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x28
push eax
mov dword [esp + 0x1c], str.EnableHeapReflection
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4281a2
xor eax, eax
mov dword [esp + 0x10], 0
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 0x4a
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x4281a2
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 2
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_RtlCreateProcessReflection]
mov ecx, dword [esp + 0x10]
mov edi, eax
test ecx, ecx
je 0x42817e
push ecx
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
mov edi, dword [esp + 0x24]
js 0x4281a2
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
lea edx, [esp + 0x68]
mov ecx, esi
call fcn.0051cc40
mov esi, eax
test esi, esi
jns 0x42827f
mov edi, dword ds:[ebx]
cmp esi, 0xc0000022
je 0x4281f4
cmp esi, 0xc0000005
je 0x4281f4
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x4281e2
movzx eax, si
jmp 0x4281fe
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x428204
mov eax, esi
jmp 0x4281fe
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
mov edi, edi
test eax, eax
jne 0x42820f
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x428218
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x428265
lfence
lfence
push dword [esi + 4]
push 0x5cc434
push str.Unable_to_query_heap_information.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x428648
lfence
call fcn.004fbd80
jmp 0x428260
jmp 0x428648
push str.Unable_to_query_heap_information.
push 0x5cc434
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
jmp 0x428648
mov ecx, dword [esp + 0x68]
xor edx, edx
mov dword [ebx + 0x18], ecx
mov eax, dword [ecx + 4]
mov dword [ebx + 0x14], eax
cmp dword [ecx], edx
jbe 0x428648
lea eax, [edi - 1]
neg eax
lea edi, [ecx + 0x1c]
mov dword [esp + 0x10], edi
sbb al, al
mov dword [esp + 0x64], eax
jmp 0x4282b0
push 0xa
lea ecx, [esp + 0x9c]
lea eax, [edx + 1]
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.00582a2a
add esp, 0xc
mov dword [esp + 0x28], 5
lea eax, [esp + 0x98]
mov dword [esp + 0x2c], 0x7fffffff
mov dword [esp + 0x3c], eax
add edi, 0xffffffec
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 0
push eax
push 0
push 0x104d
push dword [ebx + 4]
mov dword [esp + 0x58], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea ecx, [esp + 0x9c]
mov eax, dword [esp + 0x10]
push 0x10
push ecx
mov eax, dword [eax - 4]
push eax
mov dword [esp + 0xa4], 0x780030
call fcn.00582a2a
add esp, 0xc
mov dword [esp + 0x28], 1
lea eax, [esp + 0x98]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 1
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x64]
movzx ecx, byte [0x631998]
cmp dword [esp + 0x24], 1
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10c
mov eax, dword [esp + 0x10]
push 0
push 1
mov byte [esp + 0x8a], cl
mov eax, dword [eax]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 2
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x64]
cmp dword [esp + 0x24], 1
movzx ecx, byte [0x631998]
movzx eax, al
cmove ecx, eax
mov dword [esp + 0x78], 0x10c
mov eax, dword [esp + 0x10]
mov byte [esp + 0x82], cl
mov eax, dword [eax + 4]
mov dword [esp + 0x88], eax
push 0
push 1
lea eax, [esp + 0x80]
mov dword [esp + 0x94], 0
push eax
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 3
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword ds:[esp + 0x10]
push 0
push 1
mov dword [esp + 0x80], 0x10009
mov eax, dword [eax - 8]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x98], 0
call sym.SystemInformer.exe_PhFormat
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 4
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xffff0fff
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 5
call fcn.00427a00
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword ds:[eax + 4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi]
and ecx, 0xf000
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 6
call fcn.00427f60
mov dword ds:[esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [esp + 0x10]
mov eax, dword [edi - 0x10]
cmp eax, 0xddeeddee
je 0x4285cf
cmp eax, 0xffeeffee
jne 0x428631
movzx eax, byte [edi - 0xc]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 7
sub eax, 1
je 0x4285c5
sub eax, 1
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
je 0x4285bb
mov dword [esp + 0x4c], str.NT_Heap
jmp 0x42862b
mov dword [esp + 0x4c], str.NT_Heap__LFH_
jmp 0x42862b
mov dword [esp + 0x3c], str.NT_Heap__Lookaside_
jmp 0x42861e
movzx eax, byte [edi - 0xc]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 7
sub eax, 1
je 0x428616
sub eax, 1
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
je 0x42860c
mov dword [esp + 0x4c], str.Segment_Heap
jmp 0x42862b
mov dword [esp + 0x4c], str.Segment_Heap__LFH_
jmp 0x42862b
mov dword [esp + 0x3c], str.Segment_Heap__Lookaside_
lea eax, [esp + 0x28]
push eax
push 0
push 0x104c
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x68]
add edi, 0x1c
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], edi
cmp edx, dword [eax]
jb 0x4282b0
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x428657
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x70]
test esi, esi
je 0x42866f
push 0
push esi
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x74]
test esi, esi
je 0x4286ad
xor eax, eax
mov dword [esp + 0x14], esi
push eax
push eax
mov dword [esp + 0x24], eax
mov byte [esp + 0x24], al
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push 0x10
push eax
push 0x2c
mov dword [esp + 0x2c], 3
call dword [sym.imp.ntdll.dll_NtPowerInformation]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
push 0
push 0
push 0x844d
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x845c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword ds:[esp + 0x104]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret