Function at 0x4013e0
Capabilities:
Enumerate gui resources
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
cmp eax, 1
jle 0x401bb3
cmp eax, 2
je 0x401970
mov dword [ebp - 0x5c], 0
mov edi, 1
mov dword [ebp - 0x58], 0
jmp 0x401440
mov dword [0x406010], 1
inc edi
cmp dword [ebp - 0x50], edi
jle 0x4014a2
mov eax, dword [ebp - 0x4c]
lea esi, [edi*4]
add eax, esi
mov ebx, dword [eax]
mov dword [ebp - 0x54], eax
movzx eax, word [ebx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x4018e0
add ebx, 2
mov dword [esp], 0x40400a
mov dword [esp + 4], ebx
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x401430
mov dword [esp + 4], ebx
mov dword [esp], 0x40400e
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x401590
mov dword [0x406014], 1
inc edi
cmp dword [ebp - 0x50], edi
jg 0x401440
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov esi, eax
cmp eax, 0xffffffff
je 0x4019b9
mov dword [esp], 0x11a00
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x406004], eax
test eax, eax
je 0x4019b9
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._Process32FirstW_8
sub esp, 8
test eax, eax
je 0x4019b9
mov ebx, pe_nt_image_headers32
jmp 0x40152c
lea eax, [ecx + edx + 0x234]
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._Process32NextW_8
sub esp, 8
test eax, eax
je 0x401634
mov eax, dword [section..bss]
mov ecx, dword [0x406004]
imul edx, eax, 0x234
inc eax
mov dword [section..bss], eax
lea edi, [ecx + edx]
mov dword [edi + 0x230], 0
mov dword [edi + 0x22c], 0
cmp eax, ebx
jne 0x401508
lea edi, [ebx + ebx]
mov dword [esp], ecx
imul ebx, ebx, 0x468
mov dword [ebp - 0x4c], edx
mov dword [esp + 4], ebx
call dword [sym.imp.ucrtbase.dll_realloc]
mov ecx, eax
test eax, eax
je 0x4019b9
mov dword [0x406004], eax
mov edx, dword [ebp - 0x4c]
mov ebx, edi
jmp 0x401508
mov dword [esp + 4], ebx
mov dword [esp], 0x404012
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x401600
mov eax, dword [ebp - 0x4c]
mov esi, dword [eax + esi + 4]
test esi, esi
je 0x401d99
mov dword [ebp - 0x58], 1
mov eax, dword [ebp - 0x5c]
test eax, eax
jne 0x401dc4
mov eax, dword [0x40600c]
mov ecx, dword [section..data]
test eax, eax
je 0x401910
mov ebx, dword [0x406008]
cmp ecx, ebx
je 0x401938
lea ecx, [ebx + 1]
mov dword [eax + ebx*4], esi
inc edi
mov dword [0x406008], ecx
jmp 0x40143a
mov dword [esp + 4], ebx
mov dword [esp], 0x404018
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x4018e0
mov eax, dword [ebp - 0x4c]
mov esi, dword [eax + esi + 4]
test esi, esi
je 0x401d99
mov dword [ebp - 0x5c], 1
mov eax, dword [ebp - 0x58]
jmp 0x4015be
mov dword [ebp - 0x54], eax
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], esi
mov dword [ebp - 0x5c], eax
call eax
mov eax, dword [0x406008]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x4c], 0
sub esp, 4
test eax, eax
je 0x401732
lea esi, [esi]
mov eax, dword [0x40600c]
mov ecx, dword [ebp - 0x4c]
mov ebx, dword [eax + ecx*4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov edi, ebx
mov dword [ebp - 0x50], eax
jmp 0x40169c
add edi, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_iswdigit]
test eax, eax
je 0x401840
movzx eax, word [edi]
test ax, ax
jne 0x401688
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstol]
mov edi, dword [section..bss]
xor edx, edx
mov ecx, eax
mov eax, dword [0x406004]
test edi, edi
jne 0x4016e6
jmp 0x40188b
inc edx
add eax, 0x234
cmp edx, edi
je 0x40188b
cmp ecx, dword [eax + 8]
jne 0x4016d8
mov esi, dword [eax + 0x22c]
test esi, esi
jne 0x40188b
mov dword [eax + 0x22c], 1
mov dword [eax + 0x230], 1
cmp dword [ebp - 0x50], ecx
je 0x4018c6
lea esi, [esi]
lea esi, [esi]
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp dword [0x406008], eax
ja 0x401668
mov eax, dword [0x406010]
mov ebx, dword [section..bss]
test eax, eax
jne 0x401c29
mov eax, dword [0x406014]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x4019d9
xor edi, edi
xor esi, esi
test ebx, ebx
jne 0x401799
jmp 0x401af1
mov dword [esp + 4], eax
mov dword [esp], 0x6d
call sym._taskkill_message_printfW
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
sub esp, 4
inc esi
add edi, 0x234
cmp esi, dword [section..bss]
jae 0x401af1
mov ebx, dword [0x406004]
add ebx, edi
mov eax, dword [ebx + 0x22c]
test eax, eax
je 0x401786
mov eax, dword [ebx + 8]
mov dword [esp + 4], 0
mov dword [esp], 1
mov dword [ebp - 0x50], eax
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [ebp - 0x4c], eax
sub esp, 0xc
test eax, eax
je 0x401bdd
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
sub esp, 8
test eax, eax
mov eax, edi
je 0x401cc2
mov edx, dword [0x406010]
add eax, dword [0x406004]
test edx, edx
jne 0x401b94
mov eax, dword [eax + 0x230]
test eax, eax
mov eax, dword [ebp - 0x50]
jne 0x401768
lea edx, [ebx + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x6e
call sym._taskkill_message_printfW
jmp 0x401778
mov eax, dword [section..bss]
xor edi, edi
xor esi, esi
test eax, eax
je 0x40188b
lea esi, [esi]
mov eax, dword [0x406004]
mov dword [esp + 4], ebx
add eax, edi
add eax, 0x24
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x40187c
mov eax, dword [0x406004]
add eax, edi
mov edx, dword [eax + 0x22c]
test edx, edx
je 0x4018b0
inc esi
add edi, 0x234
cmp esi, dword [section..bss]
jb 0x401850
mov dword [esp + 4], ebx
mov dword [esp], 0x6f
call sym._taskkill_message_printfW
mov dword [ebp - 0x58], pe_nt_image_headers32
jmp 0x401720
mov dword [eax + 0x22c], 1
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [eax + 8]
jne 0x401720
mov eax, 0x72
call sym._taskkill_message
mov dword [ebp - 0x58], 1
jmp 0x401720
mov eax, 0x66
call sym._taskkill_message
mov eax, 0x65
call sym._taskkill_message
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x54]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
shl ecx, 2
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x40600c], eax
test eax, eax
je 0x401bc7
mov ebx, dword [0x406008]
jmp 0x4015e7
lea ecx, [ebx + ebx]
mov dword [esp], eax
mov dword [section..data], ecx
lea ecx, [ebx*8]
mov dword [esp + 4], ecx
call dword [sym.imp.ucrtbase.dll_realloc]
test eax, eax
je 0x401bc7
mov dword [0x40600c], eax
jmp 0x4015e7
mov edx, dword [ecx + 4]
movzx eax, word [edx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x401411
add edx, 2
mov dword [esp], 0x404006
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x401411
mov eax, 0x65
call sym._taskkill_message
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_exit]
mov eax, 0x70
call sym._taskkill_message
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x54]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
xor esi, esi
xor edi, edi
test ebx, ebx
jne 0x401a43
jmp 0x401aeb
mov ecx, dword [0x406004]
mov edx, dword [0x406010]
mov eax, dword [ebp - 0x40]
add ecx, esi
test edx, edx
jne 0x401b78
mov edx, dword [ecx + 0x230]
test edx, edx
je 0x401b5c
mov dword [esp + 4], eax
mov dword [esp], 0x6b
call sym._taskkill_message_printfW
lea esi, [esi]
nop
inc edi
add esi, 0x234
cmp edi, dword [section..bss]
jae 0x401aeb
mov ebx, dword [0x406004]
add ebx, esi
mov eax, dword [ebx + 0x22c]
test eax, eax
je 0x401a30
mov eax, dword [ebx + 8]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], eax
test byte [0x403004], 8
jne 0x401b10
lea eax, [ebp - 0x40]
mov dword [esp], sym._pid_enum_proc_8
mov dword [esp + 4], eax
call dword [sym.imp.user32.dll_EnumWindows]
mov ecx, dword [ebp - 0x3c]
sub esp, 8
test ecx, ecx
jne 0x4019f0
mov eax, dword [0x406004]
add eax, esi
mov ecx, dword [eax + 0x230]
test ecx, ecx
je 0x401b3d
mov eax, dword [eax + 8]
lea ebx, [ebp - 0x38]
mov dword [esp + 4], 0x404036
inc edi
mov dword [esp], ebx
add esi, 0x234
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov dword [esp + 4], ebx
mov dword [esp], 0x6f
call sym._taskkill_message_printfW
mov dword [ebp - 0x4c], pe_nt_image_headers32
cmp edi, dword [section..bss]
jb 0x401a43
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x58]
test eax, eax
cmove eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Terminating_pid__04lx._n
mov dword [esp + 8], str.send_close_messages
mov dword [esp + 4], 0x403004
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x401a6f
add eax, 0x24
mov dword [esp], 0x6f
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
mov dword [ebp - 0x4c], pe_nt_image_headers32
jmp 0x401a30
lea edx, [ebx + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x6c
call sym._taskkill_message_printfW
jmp 0x401a30
mov edx, dword [ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x74
mov dword [esp + 8], edx
call sym._taskkill_message_printfW
jmp 0x401a30
mov eax, dword [eax + 0x18]
mov dword [esp], 0x73
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x50]
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
jmp 0x401778
mov eax, 0x68
call sym._taskkill_message
mov eax, 0x65
call sym._taskkill_message
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x54]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [0x406004]
add eax, edi
mov ebx, dword [eax + 0x230]
test ebx, ebx
je 0x401d62
mov eax, dword [eax + 8]
lea ebx, [ebp - 0x38]
mov dword [esp + 4], 0x404036
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov dword [esp + 4], ebx
mov dword [esp], 0x6f
call sym._taskkill_message_printfW
mov dword [ebp - 0x54], pe_nt_image_headers32
jmp 0x401786
test ebx, ebx
je 0x401de0
mov dword [ebp - 0x4c], 0
mov esi, dword [0x406004]
xor edi, edi
jmp 0x401c58
inc edi
add dword [ebp - 0x4c], 0x234
cmp edi, ebx
jae 0x401745
mov eax, dword [ebp - 0x4c]
add eax, esi
mov dword [ebp - 0x50], eax
mov eax, dword [eax + 0x22c]
test eax, eax
jne 0x401c48
mov eax, edi
lea esi, [esi]
imul eax, eax, 0x234
mov ecx, dword [esi + eax + 0x18]
test ecx, ecx
je 0x401c48
test ebx, ebx
je 0x401c48
mov edx, esi
xor eax, eax
jmp 0x401c9b
inc eax
add edx, 0x234
cmp eax, ebx
je 0x401c48
cmp ecx, dword [edx + 8]
jne 0x401c90
mov edx, dword [edx + 0x22c]
test edx, edx
je 0x401c70
test byte [0x403004], 8
jne 0x401d1b
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x22c], 1
jmp 0x401c48
add eax, dword [0x406004]
mov ecx, dword [eax + 0x230]
test ecx, ecx
je 0x401d81
mov eax, dword [eax + 8]
lea ebx, [ebp - 0x38]
mov dword [esp + 4], 0x404036
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov dword [esp + 4], ebx
mov dword [esp], 0x71
call sym._taskkill_message_printfW
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov eax, dword [ebp - 0x5c]
call eax
mov dword [ebp - 0x54], 1
sub esp, 4
jmp 0x401786
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov dword [esp + 0xc], str.Adding_child__04lx._n
mov dword [esp + 8], str.mark_child_processes
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x403004
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov esi, dword [0x406004]
mov eax, dword [ebp - 0x4c]
mov ebx, dword [section..bss]
add eax, esi
mov dword [ebp - 0x50], eax
jmp 0x401cb3
add eax, 0x24
mov dword [esp], 0x6f
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
mov dword [ebp - 0x54], pe_nt_image_headers32
jmp 0x401786
add eax, 0x24
mov dword [esp], 0x71
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
jmp 0x401d01
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [esp], 0x69
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
mov eax, 0x65
call sym._taskkill_message
mov dword [ebp - 0x54], 1
jmp 0x4018fb
mov dword [ebp - 0x54], eax
mov eax, 0x6a
call sym._taskkill_message
mov eax, 0x65
call sym._taskkill_message
jmp 0x4018fb
mov eax, dword [0x406014]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x401aeb
jmp 0x401af1