Function at 0x416036
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x443308
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov ebp, ecx
mov eax, dword [ebp + 0x4a4]
mov dword [esp + 0x14], 0
mov esi, dword [eax]
cmp esi, eax
je 0x415fde
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
test eax, eax
jne 0x415fbd
mov eax, 0x445318
push ecx
push 0
push eax
lea ecx, [esp + 0x2c]
call fcn.00403b50
cmp eax, dword [0x445314]
jne 0x416015
mov esi, dword [esi]
mov eax, dword [ebp + 0x4a4]
cmp esi, eax
jne 0x415fae
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x416266
mov al, byte [ecx - 1]
test al, al
je 0x41625c
cmp al, 0xff
je 0x41625c
dec al
pop esi
mov byte [ecx - 1], al
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x416021
mov ecx, 0x445318
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41602e
mov eax, 0x445318
push edi
push ecx
push eax
push str.Process_found_to_shut_down._Process:__s__SearchString:__s
push 1
push 0x45a150
call fcn.004018d0
lea eax, [esp + 0x20]
lea ecx, [esp + 0x34]
push eax
push ecx
mov dword [esp + 0x28], 0
call fcn.00422240
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
add esp, 0x1c
test eax, eax
je 0x416144
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x416077
mov eax, 0x445318
push eax
push str.Sending_WM_CLOSE_to_process:__s
push 1
push 0x45a150
call fcn.004018d0
mov edx, dword [esp + 0x1c]
add esp, 0x10
push 0
push 0
push 0x10
push edx
call dword [0x459ea4]
test eax, eax
mov eax, dword [esp + 0x28]
je 0x416133
test eax, eax
jne 0x4160b2
mov eax, 0x445318
push eax
mov eax, dword [esp + 0x10]
push eax
push str.Successfully_posted_WM_CLOSE_to_window__d_process__s.
push 1
push 0x45a150
call fcn.004018d0
mov ecx, dword [esp + 0x34]
add esp, 0x14
push ecx
push 0
push 0x1f0fff
call edi
mov esi, eax
test esi, esi
je 0x41615d
mov eax, dword [ebp + 0x49c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41612a
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x41610e
mov eax, 0x445318
mov ecx, dword [ebp + 0x49c]
push ecx
push eax
push str.Process__s_failed_to_respond_to_WM_CLOSE_in__d_seconds.
push 1
push 0x45a150
call fcn.004018d0
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41615d
test eax, eax
jne 0x41613c
mov eax, 0x445318
push eax
push str.Failed_to_post_WM_CLOSE_to_process__s.
jmp 0x41614e
mov edx, dword [esp + 0x20]
push edx
push str.Unable_to_find_Window_with_Process_ID___d_.
push 1
push 0x45a150
call fcn.004018d0
add esp, 0x10
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x41616a
mov eax, 0x445318
mov ecx, dword [ebp + 0x49c]
push ecx
push eax
push str.Process__s_did_not_close_within__d_seconds.__Forcing_it_to_close.
push 1
push 0x45a150
call fcn.004018d0
mov edx, dword [esp + 0x34]
add esp, 0x14
push edx
push 0
push 0x1f0fff
call edi
mov esi, eax
pop edi
test esi, esi
je 0x41620e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
mov eax, dword [esp + 0x24]
je 0x4161d3
test eax, eax
jne 0x4161b5
mov eax, 0x445318
push eax
push str.Successfully_terminated_process__s.
push 1
push 0x45a150
call fcn.004018d0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x416244
test eax, eax
jne 0x4161dc
mov eax, 0x445318
push eax
push str.Failed_to_terminate_process__s.
push 1
push 0x45a150
call fcn.004018d0
add esp, 0x10
push str.Continuing_anyway__but_anticipating_MSI_failure.
push 1
push 0x45a150
call fcn.004018d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x416244
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41621b
mov eax, 0x445318
push eax
push str.Failed_to_open_process__s.
push 1
push 0x45a150
call fcn.004018d0
add esp, 0x10
push str.Continuing_anyway__but_anticipating_MSI_failure.
push 1
push 0x45a150
call fcn.004018d0
add esp, 0xc
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x416266
mov al, byte [ecx - 1]
test al, al
je 0x41625c
cmp al, 0xff
je 0x41625c
jmp 0x415ffd
dec ecx
push ecx
call fcn.0043ad4c
add esp, 4
mov ecx, dword [esp + 0xc]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14