Function at 0x422501
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
cmp byte [ebx + 0x14], 1
jne 0x422590
and dword [ebp - 0x408], edi
push dword [ebx + 0xc]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x422571
mov ecx, esi
call fcn.0040a7b4
test eax, eax
jne 0x422566
push 0x4b375043
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
test edi, edi
je 0x422566
push 0x7530
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x422590
mov esi, dword [ebp - 0x408]
inc esi
push 1
mov dword [ebp - 0x408], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 3
jb 0x422527
jmp 0x42278a
push 0x20000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x410], eax
test eax, eax
je 0x42278a
and dword [ebp - 0x414], 0
lea edi, [eax + 0x104]
mov esi, edi
lea eax, [ebp - 0x414]
add edi, 0x104
mov dword [ebp - 0x408], edi
add edi, 0x8b8
push eax
push dword [ebx + 0xc]
mov dword [ebp - 0x40c], edi
add edi, 0x40
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x4225fb
lea ecx, [ebp - 0x414]
call fcn.0048dd30
call fcn.0040a6a4
push 0x400
lea eax, [ebx + 0x1a8]
mov byte [ebp - 0x404], 0
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.004cb853
lea eax, [ebp - 0x404]
mov byte [esi], 0
push esi
push eax
call fcn.00499950
add esp, 0x14
cmp byte [esi], 0
jne 0x42265d
lea eax, [ebp - 0x404]
push 0x5c
push eax
call fcn.0049f6d0
pop ecx
pop ecx
test eax, eax
je 0x42264e
inc eax
jmp 0x422654
lea eax, [ebp - 0x404]
push eax
push esi
call fcn.004c99d0
pop ecx
pop ecx
mov eax, dword [ebp - 0x410]
mov edx, eax
push ecx
lea ecx, [ebx + 0x128]
mov byte [eax], 0
call fcn.00422465
mov edx, dword [ebp - 0x40c]
lea ecx, [ebx + 0x11bc]
call fcn.0041cfe1
push ecx
push ecx
mov ecx, dword [ebp - 0x410]
lea edx, [ebp - 0x404]
push esi
call fcn.00426450
push dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
lea edx, [ebp - 0x404]
push dword [ebp - 0x40c]
push dword [ebx + 0x11a8]
push esi
call fcn.00426249
mov ecx, dword [ebp - 0x408]
add esp, 0x20
and dword [ebp - 0x40c], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ecx], 0x8b8
mov dword [ecx + 4], 0x1001
mov eax, dword [ebx + 0xc]
mov dword [ecx + 8], eax
lea eax, [ebx + 0x128]
push eax
lea eax, [ecx + 0xc]
push eax
call esi
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0x408]
add eax, 0x8c
push eax
call esi
push 0x2c
lea eax, [ebx + 0x11ac]
push eax
mov eax, dword [ebp - 0x408]
add eax, 0x88c
push eax
call fcn.0049f810
mov esi, dword [ebp - 0x410]
lea eax, [ebp - 0x40c]
mov ecx, dword [ebp - 0x408]
xor edx, edx
push eax
mov eax, esi
sub eax, edi
add eax, 0x20000
push eax
push edi
push dword [ebx + 0x11a8]
call fcn.0041cd2a
add esp, 0x1c
cmp dword [ebp - 0x40c], 2
jne 0x42277a
mov eax, str.WndClassK7TSMngr1
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x42277a
push 0
push 0
push 0x7eb
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, ebx
call fcn.0041e227
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0049d307
leave
ret