Function at 0x412abf
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0x394], eax
push ebx
push esi
lea eax, [ebp - 0x78]
push eax
push dword [edi + 0xc]
xor ebx, ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x412aff
lea eax, [ebp - 0x78]
push eax
call fcn.004012a0
pop ecx
cmp byte [edi + 0x14], 1
jne 0x412b4b
mov dword [ebp - 0x70], ebx
push dword [edi + 0xc]
push ebx
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x412b33
push 0x4b375043
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x74], ebx
jne 0x412b5b
inc dword [ebp - 0x70]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x70], 3
jb 0x412b08
jmp 0x412b52
mov dword [ebp - 0x74], 1
cmp dword [ebp - 0x74], ebx
je 0x412cf2
push 0x20000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x412cf2
lea eax, [esi + 0x104]
mov dword [ebp - 0x70], eax
add eax, 0x104
mov ebx, eax
add eax, 0x8b8
mov dword [ebp - 0x7c], eax
add eax, 0x40
mov dword [ebp - 0x80], eax
call fcn.00406ca2
push 0x400
lea eax, [edi + 0x1a8]
push eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], 0
call fcn.0046fe9f
mov eax, dword [ebp - 0x70]
push eax
mov byte [eax], 0
lea eax, [ebp - 0x6c]
push eax
call fcn.0046bfd0
mov eax, dword [ebp - 0x70]
add esp, 0x14
cmp byte [eax], 0
jne 0x412bf2
lea eax, [ebp - 0x6c]
push 0x5c
push eax
call fcn.0046c1f0
pop ecx
pop ecx
test eax, eax
je 0x412be4
inc eax
jmp 0x412be7
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
call fcn.0046eb90
pop ecx
pop ecx
lea eax, [edi + 0x128]
push 0x104
push eax
mov byte [esi], 0
call fcn.00412a39
push dword [ebp - 0x7c]
lea eax, [edi + 0x11bc]
push eax
call fcn.00469a77
push dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
push dword [ebp - 0x7c]
push dword [edi + 0x11a8]
push dword [ebp - 0x70]
push eax
push esi
call fcn.0041547d
push dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
push dword [ebp - 0x7c]
push dword [edi + 0x11a8]
push dword [ebp - 0x70]
push eax
push esi
call fcn.004163a4
and dword [ebp - 0x74], 0
mov dword [ebx], 0x8b8
mov dword [ebx + 4], 0x1001
mov eax, dword [edi + 0xc]
mov dword [ebx + 8], eax
add esp, 0x40
lea eax, [edi + 0x128]
push eax
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebx + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x2c
lea eax, [edi + 0x11ac]
push eax
lea eax, [ebx + 0x88c]
push eax
call fcn.0046c470
lea eax, [ebp - 0x74]
push eax
mov eax, esi
sub eax, dword [ebp - 0x80]
add eax, 0x20000
push eax
push dword [ebp - 0x80]
push dword [edi + 0x11a8]
push 0
push ebx
call fcn.00469807
add esp, 0x24
cmp dword [ebp - 0x74], 2
jne 0x412ce2
mov eax, dword [str.WndClassK7TSMngr1]
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x412ce2
push 0
push 0
push 0x7eb
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
call fcn.00411f08
pop ecx
mov ecx, dword [ebp + 0x394]
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0046c1d2
add ebp, 0x398
leave
ret