Function at 0x401560
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbp
push rbx
sub rsp, 0x188
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, [rbp + 0xd0]
mov rcx, rax
call fcn.004a16d0
lea rdx, str.Close_explorer.exe_
mov rcx, qword [0x004bd2b0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp + 0xd0]
mov rdx, rax
mov rcx, qword [0x004bd280]
call method.std::basic_istream_char__std::char_traits_char____std::operator___char__std::char_traits_char___std.allocator_char____std::basic_istream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_
lea rax, [rbp + 0xd0]
lea rdx, [0x004b8016]
mov rcx, rax
call dbg.bool std::operator==<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, char const*)
test al, al
je 0x401703
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0xffffffffffffffff
jne 0x401609
lea rdx, str.error_CreateToolHelp
mov rcx, qword [0x004bd290]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ebx, 1
jmp 0x40171b
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xf8]
mov rcx, rax
call sym.Process32First
test eax, eax
sete al
test al, al
je 0x40165c
lea rdx, str.Error_Process32first
mov rcx, qword [0x004bd290]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 1
jmp 0x40171b
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.explorer.exe
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
sete al
test al, al
je 0x4016cd
mov eax, dword [rbp - 0x58]
mov r8d, eax
mov edx, 0
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xf0], rax
mov rax, qword [rbp + 0xf0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov rax, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x4016ee
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xf8]
mov rcx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
je 0x4016ee
jmp 0x40165c
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x401716
lea rdx, str.explorer.exe_quit_disabled___good_bye
mov rcx, qword [0x004bd2b0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ebx, 0
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, ebx
jmp 0x40174b
add rsp, 0x188
pop rbx
pop rbp
ret