Function at 0x402260
Capabilities:
Enumerate gui resources
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
cmp eax, 1
jle 0x402a33
cmp eax, 2
je 0x4027f0
mov dword [ebp - 0x5c], 0
mov edi, 1
mov dword [ebp - 0x58], 0
jmp 0x4022c0
mov dword [0x403058], 1
inc edi
cmp dword [ebp - 0x50], edi
jle 0x402322
mov eax, dword [ebp - 0x4c]
lea esi, [edi*4]
add eax, esi
mov ebx, dword [eax]
mov dword [ebp - 0x54], eax
movzx eax, word [ebx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x402760
add ebx, 2
mov dword [esp], 0x40400a
mov dword [esp + 4], ebx
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x4022b0
mov dword [esp + 4], ebx
mov dword [esp], 0x40400e
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x402410
mov dword [0x403048], 1
inc edi
cmp dword [ebp - 0x50], edi
jg 0x4022c0
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov esi, eax
cmp eax, 0xffffffff
je 0x402839
mov dword [esp], 0x11a00
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x403108], eax
test eax, eax
je 0x402839
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._Process32FirstW_8
sub esp, 8
test eax, eax
je 0x402839
mov ebx, pe_nt_image_headers32
jmp 0x4023ac
lea eax, [ecx + edx + 0x234]
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._Process32NextW_8
sub esp, 8
test eax, eax
je 0x4024b4
mov eax, dword [0x403104]
mov ecx, dword [0x403108]
imul edx, eax, 0x234
inc eax
mov dword [0x403104], eax
lea edi, [ecx + edx]
mov dword [edi + 0x230], 0
mov dword [edi + 0x22c], 0
cmp eax, ebx
jne 0x402388
lea edi, [ebx + ebx]
mov dword [esp], ecx
imul ebx, ebx, 0x468
mov dword [ebp - 0x4c], edx
mov dword [esp + 4], ebx
call dword [sym.imp.ucrtbase.dll_realloc]
mov ecx, eax
test eax, eax
je 0x402839
mov dword [0x403108], eax
mov edx, dword [ebp - 0x4c]
mov ebx, edi
jmp 0x402388
mov dword [esp + 4], ebx
mov dword [esp], 0x404012
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x402480
mov eax, dword [ebp - 0x4c]
mov esi, dword [eax + esi + 4]
test esi, esi
je 0x402c19
mov dword [ebp - 0x58], 1
mov eax, dword [ebp - 0x5c]
test eax, eax
jne 0x402c44
mov eax, dword [0x403110]
mov ecx, dword [0x4030e0]
test eax, eax
je 0x402790
mov ebx, dword [0x40310c]
cmp ecx, ebx
je 0x4027b8
lea ecx, [ebx + 1]
mov dword [eax + ebx*4], esi
inc edi
mov dword [0x40310c], ecx
jmp 0x4022ba
mov dword [esp + 4], ebx
mov dword [esp], 0x404018
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x402760
mov eax, dword [ebp - 0x4c]
mov esi, dword [eax + esi + 4]
test esi, esi
je 0x402c19
mov dword [ebp - 0x5c], 1
mov eax, dword [ebp - 0x58]
jmp 0x40243e
mov dword [ebp - 0x54], eax
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], esi
mov dword [ebp - 0x5c], eax
call eax
mov eax, dword [0x40310c]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x4c], 0
sub esp, 4
test eax, eax
je 0x4025b2
lea esi, [esi]
mov eax, dword [0x403110]
mov ecx, dword [ebp - 0x4c]
mov ebx, dword [eax + ecx*4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov edi, ebx
mov dword [ebp - 0x50], eax
jmp 0x40251c
add edi, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_iswdigit]
test eax, eax
je 0x4026c0
movzx eax, word [edi]
test ax, ax
jne 0x402508
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstol]
mov edi, dword [0x403104]
xor edx, edx
mov ecx, eax
mov eax, dword [0x403108]
test edi, edi
jne 0x402566
jmp 0x40270b
inc edx
add eax, 0x234
cmp edx, edi
je 0x40270b
cmp ecx, dword [eax + 8]
jne 0x402558
mov esi, dword [eax + 0x22c]
test esi, esi
jne 0x40270b
mov dword [eax + 0x22c], 1
mov dword [eax + 0x230], 1
cmp dword [ebp - 0x50], ecx
je 0x402746
lea esi, [esi]
lea esi, [esi]
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp dword [0x40310c], eax
ja 0x4024e8
mov eax, dword [0x403058]
mov ebx, dword [0x403104]
test eax, eax
jne 0x402aa9
mov eax, dword [0x403048]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x402859
xor edi, edi
xor esi, esi
test ebx, ebx
jne 0x402619
jmp 0x402971
mov dword [esp + 4], eax
mov dword [esp], 0x6d
call sym._taskkill_message_printfW
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 4
inc esi
add edi, 0x234
cmp esi, dword [0x403104]
jae 0x402971
mov ebx, dword [0x403108]
add ebx, edi
mov eax, dword [ebx + 0x22c]
test eax, eax
je 0x402606
mov eax, dword [ebx + 8]
mov dword [esp + 4], 0
mov dword [esp], 1
mov dword [ebp - 0x50], eax
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [ebp - 0x4c], eax
sub esp, 0xc
test eax, eax
je 0x402a5d
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
sub esp, 8
test eax, eax
mov eax, edi
je 0x402b42
mov edx, dword [0x403058]
add eax, dword [0x403108]
test edx, edx
jne 0x402a14
mov eax, dword [eax + 0x230]
test eax, eax
mov eax, dword [ebp - 0x50]
jne 0x4025e8
lea edx, [ebx + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x6e
call sym._taskkill_message_printfW
jmp 0x4025f8
mov eax, dword [0x403104]
xor edi, edi
xor esi, esi
test eax, eax
je 0x40270b
lea esi, [esi]
mov eax, dword [0x403108]
mov dword [esp + 4], ebx
add eax, edi
add eax, 0x24
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x4026fc
mov eax, dword [0x403108]
add eax, edi
mov edx, dword [eax + 0x22c]
test edx, edx
je 0x402730
inc esi
add edi, 0x234
cmp esi, dword [0x403104]
jb 0x4026d0
mov dword [esp + 4], ebx
mov dword [esp], 0x6f
call sym._taskkill_message_printfW
mov dword [ebp - 0x58], pe_nt_image_headers32
jmp 0x4025a0
mov dword [eax + 0x22c], 1
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [eax + 8]
jne 0x4025a0
mov eax, 0x72
call sym._taskkill_message
mov dword [ebp - 0x58], 1
jmp 0x4025a0
mov eax, 0x66
call sym._taskkill_message
mov eax, 0x65
call sym._taskkill_message
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x54]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
shl ecx, 2
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x403110], eax
test eax, eax
je 0x402a47
mov ebx, dword [0x40310c]
jmp 0x402467
lea ecx, [ebx + ebx]
mov dword [esp], eax
mov dword [0x4030e0], ecx
lea ecx, [ebx*8]
mov dword [esp + 4], ecx
call dword [sym.imp.ucrtbase.dll_realloc]
test eax, eax
je 0x402a47
mov dword [0x403110], eax
jmp 0x402467
mov edx, dword [ecx + 4]
movzx eax, word [edx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x402291
add edx, 2
mov dword [esp], 0x404006
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x402291
mov eax, 0x65
call sym._taskkill_message
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_exit]
mov eax, 0x70
call sym._taskkill_message
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x54]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
xor esi, esi
xor edi, edi
test ebx, ebx
jne 0x4028c3
jmp 0x40296b
mov ecx, dword [0x403108]
mov edx, dword [0x403058]
mov eax, dword [ebp - 0x40]
add ecx, esi
test edx, edx
jne 0x4029f8
mov edx, dword [ecx + 0x230]
test edx, edx
je 0x4029dc
mov dword [esp + 4], eax
mov dword [esp], 0x6b
call sym._taskkill_message_printfW
lea esi, [esi]
nop
inc edi
add esi, 0x234
cmp edi, dword [0x403104]
jae 0x40296b
mov ebx, dword [0x403108]
add ebx, esi
mov eax, dword [ebx + 0x22c]
test eax, eax
je 0x4028b0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], eax
test byte [0x403020], 8
jne 0x402990
lea eax, [ebp - 0x40]
mov dword [esp], sym._pid_enum_proc_8
mov dword [esp + 4], eax
call dword [sym.imp.user32.dll_EnumWindows]
mov ecx, dword [ebp - 0x3c]
sub esp, 8
test ecx, ecx
jne 0x402870
mov eax, dword [0x403108]
add eax, esi
mov ecx, dword [eax + 0x230]
test ecx, ecx
je 0x4029bd
mov eax, dword [eax + 8]
lea ebx, [ebp - 0x38]
mov dword [esp + 4], 0x404036
inc edi
mov dword [esp], ebx
add esi, 0x234
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov dword [esp + 4], ebx
mov dword [esp], 0x6f
call sym._taskkill_message_printfW
mov dword [ebp - 0x4c], pe_nt_image_headers32
cmp edi, dword [0x403104]
jb 0x4028c3
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x58]
test eax, eax
cmove eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Terminating_pid__04lx._n
mov dword [esp + 8], str.send_close_messages
mov dword [esp + 4], 0x403020
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x4028ef
add eax, 0x24
mov dword [esp], 0x6f
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
mov dword [ebp - 0x4c], pe_nt_image_headers32
jmp 0x4028b0
lea edx, [ebx + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x6c
call sym._taskkill_message_printfW
jmp 0x4028b0
mov edx, dword [ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x74
mov dword [esp + 8], edx
call sym._taskkill_message_printfW
jmp 0x4028b0
mov eax, dword [eax + 0x18]
mov dword [esp], 0x73
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x50]
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
jmp 0x4025f8
mov eax, 0x68
call sym._taskkill_message
mov eax, 0x65
call sym._taskkill_message
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x54]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [0x403108]
add eax, edi
mov ebx, dword [eax + 0x230]
test ebx, ebx
je 0x402be2
mov eax, dword [eax + 8]
lea ebx, [ebp - 0x38]
mov dword [esp + 4], 0x404036
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov dword [esp + 4], ebx
mov dword [esp], 0x6f
call sym._taskkill_message_printfW
mov dword [ebp - 0x54], pe_nt_image_headers32
jmp 0x402606
test ebx, ebx
je 0x402c60
mov dword [ebp - 0x4c], 0
mov esi, dword [0x403108]
xor edi, edi
jmp 0x402ad8
inc edi
add dword [ebp - 0x4c], 0x234
cmp edi, ebx
jae 0x4025c5
mov eax, dword [ebp - 0x4c]
add eax, esi
mov dword [ebp - 0x50], eax
mov eax, dword [eax + 0x22c]
test eax, eax
jne 0x402ac8
mov eax, edi
lea esi, [esi]
imul eax, eax, 0x234
mov ecx, dword [esi + eax + 0x18]
test ecx, ecx
je 0x402ac8
test ebx, ebx
je 0x402ac8
mov edx, esi
xor eax, eax
jmp 0x402b1b
inc eax
add edx, 0x234
cmp eax, ebx
je 0x402ac8
cmp ecx, dword [edx + 8]
jne 0x402b10
mov edx, dword [edx + 0x22c]
test edx, edx
je 0x402af0
test byte [0x403020], 8
jne 0x402b9b
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x22c], 1
jmp 0x402ac8
add eax, dword [0x403108]
mov ecx, dword [eax + 0x230]
test ecx, ecx
je 0x402c01
mov eax, dword [eax + 8]
lea ebx, [ebp - 0x38]
mov dword [esp + 4], 0x404036
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov dword [esp + 4], ebx
mov dword [esp], 0x71
call sym._taskkill_message_printfW
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov dword [ebp - 0x54], 1
sub esp, 4
jmp 0x402606
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov dword [esp + 0xc], str.Adding_child__04lx._n
mov dword [esp + 8], str.mark_child_processes
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x403020
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov esi, dword [0x403108]
mov eax, dword [ebp - 0x4c]
mov ebx, dword [0x403104]
add eax, esi
mov dword [ebp - 0x50], eax
jmp 0x402b33
add eax, 0x24
mov dword [esp], 0x6f
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
mov dword [ebp - 0x54], pe_nt_image_headers32
jmp 0x402606
add eax, 0x24
mov dword [esp], 0x71
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
jmp 0x402b81
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [esp], 0x69
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
mov eax, 0x65
call sym._taskkill_message
mov dword [ebp - 0x54], 1
jmp 0x40277b
mov dword [ebp - 0x54], eax
mov eax, 0x6a
call sym._taskkill_message
mov eax, 0x65
call sym._taskkill_message
jmp 0x40277b
mov eax, dword [0x403048]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x40296b
jmp 0x402971