Function at 0x40bb10
Capabilities:
Accept command line arguments
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb05d
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x4f4164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x334], 0
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x40bbcd
mov dword [ebp - 0x3e8], 0
call fcn.0040ba10
mov dword [ebp - 0x3ec], eax
lock inc dword [ebp - 0x3e8]
cmp dword [ebp - 0x3ec], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x334], 1
jne 0x40bb9c
call fcn.0040ba10
mov dword [ebp - 0x3ec], eax
lock inc dword [ebp - 0x3e8]
mov eax, dword [ebp - 0x3ec]
lea ecx, [ebp - 0x40c]
push str.Entering_KillOrphanedBrowserSubprocesses.
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push ecx
push 0
push eax
mov dword [ebp - 0x40c], 0x20
call fcn.0040df80
add esp, 0x18
mov eax, dword [ebp - 0x334]
or esi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
test al, 1
je 0x40bc18
and eax, 0xfffffffe
mov dword [ebp - 0x334], eax
mov eax, esi
mov dword [ebp - 0x3ec], 0
lock xadd dword [ebp - 0x3e8], eax
js 0x40bc11
call fcn.0040dfb0
mov eax, esi
lock xadd dword [ebp - 0x3e8], eax
jns 0x40bc00
lock inc dword [ebp - 0x3e8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x368], 0
mov dword [ebp - 0x364], 0
push 0x14
mov dword [ebp - 0x358], eax
lfence
call fcn.00450e28
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x368], eax
push 0
push 2
mov dword [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x338], eax
cmp eax, 0xffffffff
je 0x40bdff
push 0x228
lea eax, [ebp - 0x32c]
push 0
push eax
call fcn.00495790
mov edi, dword [ebp - 0x338]
lea eax, [ebp - 0x330]
add esp, 0xc
mov dword [ebp - 0x330], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40bdf3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x318], eax
jne 0x40bcdd
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x368]
call fcn.0040adb0
lea eax, [ebp - 0x330]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x40bdf3
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0x318], eax
jne 0x40bdd9
mov eax, dword [ebp - 0x368]
xor edi, edi
mov dword [ebp - 0x3f8], eax
mov edx, eax
mov ecx, dword [eax + 4]
mov dword [ebp - 0x33c], ecx
cmp byte [ecx + 0xd], 0
jne 0x40bd53
mov eax, ecx
mov ecx, dword [ebp - 0x328]
nop dword [eax + eax]
mov dword [ebp - 0x33c], eax
cmp dword [eax + 0x10], ecx
jae 0x40bd42
mov eax, dword [eax + 8]
xor edi, edi
jmp 0x40bd4b
mov edx, eax
mov edi, 1
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x40bd30
jmp 0x40bd59
mov ecx, dword [ebp - 0x328]
cmp byte [edx + 0xd], 0
jne 0x40bd64
cmp ecx, dword [edx + 0x10]
jae 0x40bdd9
cmp dword [ebp - 0x364], 0xccccccc
je 0x40df52
lea eax, [ebp - 0x368]
mov dword [ebp - 0x45c], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x458], 0
push 0x14
lfence
call fcn.00450e28
mov ecx, dword [ebp - 0x328]
add esp, 4
mov byte [ebp - 4], 1
mov dword [ebp - 0x458], 0
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x3f8]
mov dword [eax], ecx
push eax
mov dword [eax + 4], ecx
push edi
push dword [ebp - 0x33c]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x368]
mov word [eax + 0xc], 0
call fcn.0040e310
lea eax, [ebp - 0x330]
push eax
push dword [ebp - 0x338]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40bcf2
push dword [ebp - 0x338]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x448], eax
lea ecx, [ebp - 0x368]
lea eax, [ebp - 0x448]
push eax
call fcn.0040e5f0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x368]
call fcn.0040e5f0
cmp dword [ebp - 0x364], 0
jne 0x40bf0d
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x40bebc
mov dword [ebp - 0x3f0], 0
call fcn.0040ba10
mov dword [ebp - 0x3f4], eax
lock inc dword [ebp - 0x3f0]
or dword [ebp - 0x334], 2
cmp dword [ebp - 0x3f4], 0
mov byte [ebp - 4], 3
jne 0x40be88
call fcn.0040ba10
mov dword [ebp - 0x3f4], eax
lock inc dword [ebp - 0x3f0]
mov eax, dword [ebp - 0x3f4]
lea ecx, [ebp - 0x434]
push dword [ebp + 8]
mov dword [ebp - 0x434], 0x20
push str.No_child_processes_found_for_closing_pid__ld
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push ecx
push 0
push eax
call fcn.0040df80
add esp, 0x1c
mov eax, dword [ebp - 0x334]
test al, 2
je 0x40df2c
and eax, 0xfffffffd
mov dword [ebp - 0x334], eax
mov eax, esi
mov dword [ebp - 0x3f4], 0
lock xadd dword [ebp - 0x3f0], eax
js 0x40bf01
nop dword [eax]
call fcn.0040dfb0
mov eax, esi
lock xadd dword [ebp - 0x3f0], eax
jns 0x40bef0
lock inc dword [ebp - 0x3f0]
jmp 0x40df2c
mov byte [ebp - 4], 4
call fcn.00404430
mov edi, eax
test edi, edi
je 0x40df57
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4c758c]
mov ecx, edi
call esi
lea edi, [eax + 0x10]
mov dword [ebp - 0x344], edi
mov byte [ebp - 4], 6
call fcn.00404430
mov dword [ebp - 0x340], eax
test eax, eax
je 0x40df61
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4c758c]
mov ecx, dword [ebp - 0x340]
call esi
add eax, 0x10
mov dword [ebp - 0x348], eax
mov esi, dword [ebp - 0x368]
mov byte [ebp - 4], 7
mov byte [ebp - 0x401], 0
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
jne 0x40c021
nop dword [eax]
push dword [esi + 0x10]
lea eax, [ebp - 0x348]
push 0x4c949c
push eax
call fcn.0040b5b0
add esp, 0xc
cmp dword [edi - 0xc], 0
je 0x40bfbf
push 1
push 0x4c94a4
lea ecx, [ebp - 0x344]
call fcn.00405580
mov eax, dword [ebp - 0x348]
lea ecx, [ebp - 0x344]
push dword [eax - 0xc]
push eax
call fcn.00405580
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x40bffa
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x40bff6
cmp esi, dword [eax + 8]
jne 0x40bff6
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x40bfe6
mov esi, eax
jmp 0x40c010
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x40c010
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x40c004
cmp byte [esi + 0xd], 0
jne 0x40c021
mov edi, dword [ebp - 0x344]
jmp 0x40bf90
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x40c0b4
mov dword [ebp - 0x370], 0
call fcn.0040ba10
mov dword [ebp - 0x374], eax
lock inc dword [ebp - 0x370]
or dword [ebp - 0x334], 4
cmp dword [ebp - 0x374], 0
mov byte [ebp - 4], 8
jne 0x40c074
call fcn.0040ba10
mov dword [ebp - 0x374], eax
lock inc dword [ebp - 0x370]
mov eax, dword [ebp - 0x374]
lea ecx, [ebp - 0x34c]
mov esi, dword [ebp - 0x344]
push esi
push dword [ebp - 0x358]
mov dword [ebp - 0x34c], 0x20
push 0x4c94a8
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push ecx
push 0
push eax
call fcn.0040df80
add esp, 0x20
jmp 0x40c0ba
mov esi, dword [ebp - 0x344]
mov eax, dword [ebp - 0x334]
or edi, 0xffffffff
mov dword [ebp - 4], 7
test al, 4
je 0x40c108
and eax, 0xfffffffb
mov dword [ebp - 0x334], eax
mov eax, edi
mov dword [ebp - 0x374], 0
lock xadd dword [ebp - 0x370], eax
js 0x40c101
nop dword [eax]
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x370], eax
jns 0x40c0f0
lock inc dword [ebp - 0x370]
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 9
push eax
call fcn.00419650
add esp, 4
test al, al
jne 0x40c1de
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40c175
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c16b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df70
push edx
push ecx
call fcn.00450975
add esp, 8
mov ecx, dword [ebp - 0x348]
xor eax, eax
mov word [ebp - 0x28], ax
add ecx, 0xfffffff0
mov dword [ebp - 0x18], 0
mov eax, edi
mov dword [ebp - 0x14], 7
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40c1c2
lfence
mov eax, dword [ecx]
mov dword [ebp - 0x34c], eax
push ecx
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x4c758c]
mov ecx, dword [ebp - 0x34c]
call edi
or edi, 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x40df2c
lfence
mov edi, dword [esi]
push esi
jmp 0x40df1b
cmp dword [ebp - 0x18], 0
jne 0x40c273
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40c222
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c218
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df70
push edx
push ecx
call fcn.00450975
add esp, 8
mov ecx, dword [ebp - 0x348]
xor eax, eax
mov word [ebp - 0x28], ax
add ecx, 0xfffffff0
mov dword [ebp - 0x18], 0
mov eax, edi
mov dword [ebp - 0x14], 7
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40c1c2
lfence
mov eax, dword [ecx]
mov dword [ebp - 0x34c], eax
push ecx
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x4c758c]
mov ecx, dword [ebp - 0x34c]
jmp 0x40c1bd
push 7
xor eax, eax
mov dword [ebp - 0xb8], 0
push 0x4c94e8
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
call fcn.004038a0
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004191f0
mov edx, dword [ebp - 0xa4]
add esp, 8
test al, al
mov byte [ebp - 4], 9
sete al
mov byte [ebp - 0x359], al
cmp edx, 8
jb 0x40c318
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c308
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df6b
push edx
push ecx
call fcn.00450975
mov al, byte [ebp - 0x359]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], cx
test al, al
je 0x40c3c8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40c377
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c36d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df70
push edx
push ecx
call fcn.00450975
add esp, 8
mov ecx, dword [ebp - 0x348]
xor eax, eax
mov word [ebp - 0x28], ax
add ecx, 0xfffffff0
mov dword [ebp - 0x18], 0
mov eax, edi
mov dword [ebp - 0x14], 7
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40c1c2
lfence
mov eax, dword [ecx]
mov dword [ebp - 0x34c], eax
push ecx
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x4c758c]
mov ecx, dword [ebp - 0x34c]
jmp 0x40c1bd
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x340], ecx
cmp eax, 8
jae 0x40c400
movups xmm0, xmmword [ecx]
mov dword [ebp - 0x2c], 7
movups xmmword [ebp - 0x40], xmm0
jmp 0x40c444
mov edi, eax
lea ecx, [ebp - 0x40]
mov eax, SysReAllocString
or edi, 7
cmp edi, eax
cmova edi, eax
lea eax, [edi + 1]
push eax
call fcn.00403d40
mov ecx, dword [ebp - 0x33c]
mov dword [ebp - 0x40], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x340]
push eax
call fcn.00495210
mov eax, dword [ebp - 0x33c]
add esp, 0xc
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xb
push eax
call fcn.00419900
add esp, 4
test al, al
jne 0x40c545
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x40c499
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c48f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df70
push edx
push ecx
call fcn.00450975
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x40c4e7
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c4dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df70
push edx
push ecx
call fcn.00450975
add esp, 8
mov ecx, dword [ebp - 0x348]
xor eax, eax
mov word [ebp - 0x28], ax
add ecx, 0xfffffff0
mov dword [ebp - 0x18], 0
or eax, 0xffffffff
mov dword [ebp - 0x14], 7
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40c532
lfence
mov eax, dword [ecx]
mov dword [ebp - 0x34c], eax
push ecx
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x4c758c]
mov ecx, dword [ebp - 0x34c]
call edi
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jmp 0x40c1cd
cmp dword [ebp - 0x30], 0
jne 0x40c639
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x40c589
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c57f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df70
push edx
push ecx
call fcn.00450975
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x40c5d7
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c5cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df70
push edx
push ecx
call fcn.00450975
add esp, 8
mov ecx, dword [ebp - 0x348]
xor eax, eax
mov word [ebp - 0x28], ax
add ecx, 0xfffffff0
mov dword [ebp - 0x18], 0
or eax, 0xffffffff
mov dword [ebp - 0x14], 7
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40c532
lfence
mov eax, dword [ecx]
mov dword [ebp - 0x34c], eax
push ecx
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x4c758c]
mov ecx, dword [ebp - 0x34c]
call edi
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jmp 0x40c1cd
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x40c6db
mov dword [ebp - 0x378], 0
call fcn.0040ba10
mov dword [ebp - 0x37c], eax
lock inc dword [ebp - 0x378]
or dword [ebp - 0x334], 8
cmp dword [ebp - 0x37c], 0
mov byte [ebp - 4], 0xc
jne 0x40c68c
call fcn.0040ba10
mov dword [ebp - 0x37c], eax
lock inc dword [ebp - 0x378]
mov edx, dword [ebp - 0x37c]
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x430], 0x20
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x358]
lea eax, [ebp - 0x430]
push str.pid_ld_path_s_quoted_s
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push eax
push 0
push edx
call fcn.0040df80
add esp, 0x24
mov eax, dword [ebp - 0x334]
or edi, 0xffffffff
mov dword [ebp - 4], 0xb
test al, 8
je 0x40c728
and eax, 0xfffffff7
mov dword [ebp - 0x334], eax
mov eax, edi
mov dword [ebp - 0x37c], 0
lock xadd dword [ebp - 0x378], eax
js 0x40c721
nop
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x378], eax
jns 0x40c710
lock inc dword [ebp - 0x378]
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x350], 0
push 0x48
lfence
call fcn.00450e28
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x354], eax
mov esi, dword [ebp - 0x368]
mov byte [ebp - 4], 0xd
mov byte [ebp - 0x3f9], 0
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
jne 0x40d08e
nop word [eax + eax]
push dword [esi + 0x10]
push 0
push 0x1010
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x338], eax
test eax, eax
je 0x40d044
xor ecx, ecx
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], cx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xe
push ecx
push eax
call fcn.004197b0
add esp, 8
test al, al
je 0x40c90c
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x58]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x44], 8
push ecx
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.00498d5f
add esp, 8
test eax, eax
je 0x40c96f
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x40c899
mov dword [ebp - 0x3a0], 0
call fcn.0040ba10
mov dword [ebp - 0x3a4], eax
lock inc dword [ebp - 0x3a0]
or dword [ebp - 0x334], 0x10
cmp dword [ebp - 0x3a4], 0
mov byte [ebp - 4], 0xf
jne 0x40c84d
call fcn.0040ba10
mov dword [ebp - 0x3a4], eax
lock inc dword [ebp - 0x3a0]
mov edx, dword [ebp - 0x3a4]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x58]
mov dword [ebp - 0x428], 0x20
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x44], 8
push ecx
cmovae eax, dword [ebp - 0x58]
push eax
push dword [esi + 0x10]
lea eax, [ebp - 0x428]
push str._pid__ld_szProcPath_curExePath___s____s_
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push eax
push 0
push edx
call fcn.0040df80
add esp, 0x24
mov eax, dword [ebp - 0x334]
mov dword [ebp - 4], 0xe
test al, 0x10
je 0x40c8e8
and eax, 0xffffffef
mov dword [ebp - 0x334], eax
mov eax, edi
mov dword [ebp - 0x3a4], 0
lock xadd dword [ebp - 0x3a0], eax
js 0x40c8e1
nop dword [eax]
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x3a0], eax
jns 0x40c8d0
lock inc dword [ebp - 0x3a0]
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x58]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x44], 8
push ecx
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.00498d5f
add esp, 8
test eax, eax
je 0x40c96f
mov edx, dword [ebp - 0x44]
mov byte [ebp - 4], 0xd
cmp edx, 8
jb 0x40c94a
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c940
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df6b
push edx
push ecx
call fcn.00450975
add esp, 8
push dword [ebp - 0x338]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d044
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x40ca02
mov dword [ebp - 0x388], 0
call fcn.0040ba10
mov dword [ebp - 0x38c], eax
lock inc dword [ebp - 0x388]
or dword [ebp - 0x334], 0x20
cmp dword [ebp - 0x38c], 0
mov byte [ebp - 4], 0x10
jne 0x40c9c2
call fcn.0040ba10
mov dword [ebp - 0x38c], eax
lock inc dword [ebp - 0x388]
mov ecx, dword [ebp - 0x38c]
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
mov dword [ebp - 0x424], 0x20
cmovae eax, dword [ebp - 0x58]
push eax
push dword [esi + 0x10]
lea eax, [ebp - 0x424]
push str._adding_pid__ld_path_s_to_orphan_pids_list.
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push eax
push 0
push ecx
call fcn.0040df80
add esp, 0x20
mov eax, dword [ebp - 0x334]
mov dword [ebp - 4], 0xe
test al, 0x20
je 0x40ca4a
and eax, 0xffffffdf
mov dword [ebp - 0x334], eax
mov eax, edi
mov dword [ebp - 0x38c], 0
lock xadd dword [ebp - 0x388], eax
js 0x40ca43
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x388], eax
jns 0x40ca32
lock inc dword [ebp - 0x388]
xor eax, eax
mov dword [ebp - 0xa0], 0
push eax
push 0x4e0f24
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
call fcn.004038a0
mov eax, dword [esi + 0x10]
lea edi, [esi + 0x10]
mov dword [ebp - 0x104], eax
lea ecx, [ebp - 0x100]
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x11
push eax
call fcn.00405c80
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0xe8]
call fcn.00405c80
push edi
lea eax, [ebp - 0x470]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x354]
call fcn.0040ad60
mov edx, dword [ebp - 0x468]
mov dword [ebp - 0x33c], edx
cmp byte [edx + 0xd], 0
jne 0x40caeb
mov eax, dword [edi]
cmp eax, dword [edx + 0x10]
jae 0x40cb9e
cmp dword [ebp - 0x350], 0x38e38e3
je 0x40df52
mov edi, dword [ebp - 0x354]
lea eax, [ebp - 0x354]
mov dword [ebp - 0x464], eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x460], 0
push 0x48
lfence
call fcn.00450e28
mov ecx, dword [esi + 0x10]
add esp, 4
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x460], 0
mov dword [eax + 0x10], ecx
lea ecx, [ebp - 0x354]
push eax
push dword [ebp - 0x46c]
mov dword [eax + 0x14], 0
push dword [ebp - 0x470]
mov dword [eax + 0x18], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 7
mov dword [eax + 0x30], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 7
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov word [eax + 0xc], 0
call fcn.0040e310
mov edx, eax
lea edi, [esi + 0x10]
mov dword [ebp - 0x33c], edx
mov ecx, dword [ebp - 0x104]
lea eax, [ebp - 0x100]
mov dword [edx + 0x14], ecx
lea ecx, [edx + 0x18]
cmp ecx, eax
je 0x40cbd4
cmp dword [ebp - 0xec], 8
push dword [ebp - 0xf0]
cmovae eax, dword [ebp - 0x100]
push eax
call fcn.004038a0
mov edx, dword [ebp - 0x33c]
lea ecx, [edx + 0x30]
lea eax, [ebp - 0xe8]
cmp ecx, eax
je 0x40cbfb
cmp dword [ebp - 0xd4], 8
push dword [ebp - 0xd8]
cmovae eax, dword [ebp - 0xe8]
push eax
call fcn.004038a0
lea ecx, [ebp - 0xe8]
call fcn.00403690
lea ecx, [ebp - 0x100]
call fcn.00403690
mov edx, dword [ebp - 0x8c]
mov byte [ebp - 4], 0xe
cmp edx, 8
jb 0x40cc55
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40cc4b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df6b
push edx
push ecx
call fcn.00450975
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
mov byte [ebp - 4], 0xd
cmp edx, 8
jb 0x40ccb0
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40cca6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df6b
push edx
push ecx
call fcn.00450975
add esp, 8
push dword [ebp - 0x338]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x36c], 0
lea eax, [ebp - 0x36c]
mov byte [ebp - 4], 0x15
push eax
push dword [edi]
call fcn.0040b740
add esp, 8
test al, al
mov eax, dword [0x4f8ee0]
je 0x40cf3d
add eax, dword [0x4f8edc]
je 0x40cd77
mov dword [ebp - 0x398], 0
call fcn.0040ba10
mov dword [ebp - 0x39c], eax
lock inc dword [ebp - 0x398]
or dword [ebp - 0x334], 0x40
cmp dword [ebp - 0x39c], 0
mov byte [ebp - 4], 0x16
jne 0x40cd46
call fcn.0040ba10
mov dword [ebp - 0x39c], eax
lock inc dword [ebp - 0x398]
mov eax, dword [ebp - 0x39c]
lea ecx, [ebp - 0x420]
push str.GetCmdLineOfPid_succeeds
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push ecx
push 0
push eax
mov dword [ebp - 0x420], 0x20
call fcn.0040df80
add esp, 0x18
mov eax, dword [ebp - 0x334]
or edi, 0xffffffff
mov dword [ebp - 4], 0x15
test al, 0x40
je 0x40cdc8
and eax, 0xffffffbf
mov dword [ebp - 0x334], eax
mov eax, edi
mov dword [ebp - 0x39c], 0
lock xadd dword [ebp - 0x398], eax
js 0x40cdc1
nop word [eax + eax]
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x398], eax
jns 0x40cdb0
lock inc dword [ebp - 0x398]
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x338], eax
test eax, eax
je 0x40d025
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0x354]
call fcn.0040ad60
mov ecx, dword [ebp - 0x474]
mov edx, dword [ebp - 0x354]
mov dword [ebp - 0x33c], ecx
cmp byte [ecx + 0xd], 0
jne 0x40ce12
mov eax, dword [esi + 0x10]
cmp eax, dword [ecx + 0x10]
jae 0x40ce1a
mov ecx, edx
mov dword [ebp - 0x33c], edx
mov eax, dword [ebp - 0x338]
cmp ecx, edx
je 0x40d025
add ecx, 0x30
mov dword [ebp - 0x340], ecx
cmp ecx, eax
je 0x40ce47
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x40ce40
mov eax, dword [eax]
push edx
push eax
call fcn.004038a0
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x40cee6
mov dword [ebp - 0x390], 0
call fcn.0040ba10
mov dword [ebp - 0x394], eax
lock inc dword [ebp - 0x390]
or dword [ebp - 0x334], 0x80
cmp dword [ebp - 0x394], 0
mov byte [ebp - 4], 0x17
jne 0x40ce9d
call fcn.0040ba10
mov dword [ebp - 0x394], eax
lock inc dword [ebp - 0x390]
mov eax, dword [ebp - 0x340]
mov ecx, dword [ebp - 0x394]
cmp dword [eax + 0x14], 8
jb 0x40ceb1
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x41c], 0x20
push dword [eax + 0x10]
lea eax, [ebp - 0x41c]
push str._pid_ld_cmd_s
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push eax
push 0
push ecx
call fcn.0040df80
add esp, 0x20
mov eax, dword [ebp - 0x334]
mov dword [ebp - 4], 0x15
test al, al
jns 0x40d019
and eax, 0xffffff7f
mov dword [ebp - 0x334], eax
mov eax, edi
mov dword [ebp - 0x394], 0
lock xadd dword [ebp - 0x390], eax
js 0x40cf31
nop dword [eax]
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x390], eax
jns 0x40cf20
lock inc dword [ebp - 0x390]
jmp 0x40d019
add eax, dword [0x4f8edc]
je 0x40cfc9
mov dword [ebp - 0x380], 0
call fcn.0040ba10
mov dword [ebp - 0x384], eax
lock inc dword [ebp - 0x380]
or dword [ebp - 0x334], 0x100
cmp dword [ebp - 0x384], 0
mov byte [ebp - 4], 0x18
jne 0x40cf8e
call fcn.0040ba10
mov dword [ebp - 0x384], eax
lock inc dword [ebp - 0x380]
mov edi, dword [ebp - 0x384]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 0x10]
lea eax, [ebp - 0x454]
mov dword [ebp - 0x454], 0x20
push str.GetCmdLineOfPid_pid_ld_failed_error__ld
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push eax
push 0
push edi
call fcn.0040df80
add esp, 0x20
mov eax, dword [ebp - 0x334]
mov dword [ebp - 4], 0x15
test eax, 0x100
je 0x40d019
and eax, 0xfffffeff
or edi, 0xffffffff
mov dword [ebp - 0x334], eax
mov eax, edi
mov dword [ebp - 0x384], 0
lock xadd dword [ebp - 0x380], eax
js 0x40d012
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x380], eax
jns 0x40d001
lock inc dword [ebp - 0x380]
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x338], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x40d044
mov ecx, eax
call fcn.00403690
push 0x18
push dword [ebp - 0x338]
call fcn.00450975
add esp, 8
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x40d06a
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x40d066
cmp esi, dword [eax + 8]
jne 0x40d066
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x40d056
mov esi, eax
jmp 0x40d080
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x40d080
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x40d074
cmp byte [esi + 0xd], 0
jne 0x40d08e
or edi, 0xffffffff
jmp 0x40c780
cmp dword [ebp - 0x350], 0
jne 0x40d26c
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x40d140
mov dword [ebp - 0x3e0], 0
call fcn.0040ba10
mov dword [ebp - 0x3e4], eax
lock inc dword [ebp - 0x3e0]
or dword [ebp - 0x334], 0x200
cmp dword [ebp - 0x3e4], 0
mov byte [ebp - 4], 0x19
jne 0x40d0f1
call fcn.0040ba10
mov dword [ebp - 0x3e4], eax
lock inc dword [ebp - 0x3e0]
mov edx, dword [ebp - 0x3e4]
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x450], 0x20
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x358]
lea eax, [ebp - 0x450]
push str.No_child_processes_found_for_closing_pid__ld_and_the_same_path__s_or__s
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push eax
push 0
push edx
call fcn.0040df80
add esp, 0x24
mov eax, dword [ebp - 0x334]
or esi, 0xffffffff
test eax, 0x200
je 0x40d189
and eax, 0xfffffdff
mov dword [ebp - 0x334], eax
mov eax, esi
mov dword [ebp - 0x3e4], 0
lock xadd dword [ebp - 0x3e0], eax
js 0x40d182
call fcn.0040dfb0
mov eax, esi
lock xadd dword [ebp - 0x3e0], eax
jns 0x40d171
lock inc dword [ebp - 0x3e0]
mov eax, dword [ebp - 0x354]
push dword [eax + 4]
lea eax, [ebp - 0x354]
push eax
mov ecx, eax
call fcn.0040ad10
push 0x48
push dword [ebp - 0x354]
call fcn.00450975
mov edx, dword [ebp - 0x2c]
add esp, 8
cmp edx, 8
jb 0x40d1ea
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d1e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40df70
push edx
push ecx
call fcn.00450975
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 7
cmp eax, 8
jb 0x40d213
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00403a30
mov ecx, dword [ebp - 0x348]
xor eax, eax
mov word [ebp - 0x28], ax
add ecx, 0xfffffff0
mov dword [ebp - 0x18], 0
mov eax, esi
mov dword [ebp - 0x14], 7
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40d256
lfence
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4c758c]
mov ecx, edi
call esi
or esi, 0xffffffff
mov ecx, dword [ebp - 0x344]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jmp 0x40df13
push 0
push 0x4e0f24
lea ecx, [ebp - 0x344]
call fcn.00405750
mov esi, dword [ebp - 0x354]
mov byte [ebp - 0x3fa], 0
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
jne 0x40d336
cmp dword [esi + 0x44], 8
lea eax, [esi + 0x30]
jb 0x40d2a2
mov eax, dword [eax]
cmp dword [esi + 0x2c], 8
lea ecx, [esi + 0x18]
jb 0x40d2ad
mov ecx, dword [ecx]
push eax
push ecx
push dword [esi + 0x10]
lea eax, [ebp - 0x348]
push str._tpid_ld_path_s_cmd_s
push eax
call fcn.0040b5b0
mov eax, dword [ebp - 0x348]
lea ecx, [ebp - 0x344]
add esp, 0x14
push dword [eax - 0xc]
push eax
call fcn.00405580
push 2
push 0x4c9760
lea ecx, [ebp - 0x344]
call fcn.00405580
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x40d314
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x40d310
nop
cmp esi, dword [eax + 8]
jne 0x40d310
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x40d300
mov esi, eax
jmp 0x40d32c
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x40d32c
nop
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x40d320
cmp byte [esi + 0xd], 0
je 0x40d297
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x40d3c9
mov dword [ebp - 0x3d8], 0
call fcn.0040ba10
mov dword [ebp - 0x3dc], eax
lock inc dword [ebp - 0x3d8]
or dword [ebp - 0x334], 0x400
cmp dword [ebp - 0x3dc], 0
mov byte [ebp - 4], 0x1a
jne 0x40d38c
call fcn.0040ba10
mov dword [ebp - 0x3dc], eax
lock inc dword [ebp - 0x3d8]
mov eax, dword [ebp - 0x3dc]
lea ecx, [ebp - 0x44c]
push dword [ebp - 0x344]
mov dword [ebp - 0x44c], 0x20
push dword [ebp - 0x358]
push str._pid__ld_OBK.exe_child_processes_remained_orphans:_r_n_s
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push ecx
push 0
push eax
call fcn.0040df80
add esp, 0x20
mov edi, dword [ebp - 0x334]
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x338], edi
test edi, 0x400
je 0x40d428
and edi, 0xfffffbff
or esi, 0xffffffff
mov dword [ebp - 0x334], edi
mov eax, esi
mov dword [ebp - 0x338], edi
mov dword [ebp - 0x3dc], 0
lock xadd dword [ebp - 0x3d8], eax
js 0x40d421
nop
call fcn.0040dfb0
mov eax, esi
lock xadd dword [ebp - 0x3d8], eax
jns 0x40d410
lock inc dword [ebp - 0x3d8]
mov esi, dword [ebp - 0x354]
mov byte [ebp - 0x3fb], 0
mov esi, dword [esi]
mov dword [ebp - 0x358], esi
cmp byte [esi + 0xd], 0
jne 0x40de59
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
mov byte [ebp - 4], 0x1b
cmp dword [esi + 0x40], eax
je 0x40d713
cmp dword [esi + 0x44], 8
mov dword [ebp - 0x400], eax
lea eax, [esi + 0x30]
jb 0x40d48f
mov eax, dword [eax]
lea ecx, [ebp - 0x400]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, eax
mov dword [ebp - 0x360], edx
test edx, edx
je 0x40d713
mov ecx, dword [ebp - 0x400]
mov eax, 1
mov dword [ebp - 0x340], eax
cmp ecx, eax
jle 0x40d70c
or esi, 0xffffffff
nop dword [eax]
cmp dword [ebp - 0x78], 0
jne 0x40d706
mov edx, dword [edx + eax*4]
test edx, edx
je 0x40d6f1
mov ecx, edx
mov dword [ebp - 0x70], 0
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d505
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x70]
call fcn.004038a0
mov edi, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x70]
mov byte [ebp - 4], 0x1c
test edi, edi
je 0x40d6bd
cmp eax, 8
lea ecx, [ebp - 0x70]
cmovae ecx, edx
mov dword [ebp - 0x408], ecx
cmp edi, 7
jb 0x40d6bd
lea edx, [edi - 6]
mov eax, ecx
lea edx, [ecx + edx*2]
mov dword [ebp - 0x43c], edx
nop dword [eax]
sub edx, eax
mov edi, 0
sar edx, 1
je 0x40d582
cmp word [eax], 0x2d
je 0x40d580
cmp edx, 1
je 0x40d582
add eax, 2
dec edx
cmp word [eax], 0x2d
jne 0x40d571
mov edi, eax
mov eax, edi
test eax, eax
je 0x40d6b7
movzx edx, word [eax]
mov edi, 0x2d
mov dword [ebp - 0x3f8], 7
mov ecx, str.__type
cmp edx, edi
jb 0x40d5e0
mov dword [ebp - 0x33c], eax
sub dword [ebp - 0x33c], ecx
cmp dx, di
ja 0x40d5e0
mov edx, dword [ebp - 0x3f8]
cmp edx, 1
je 0x40d5ee
movzx edi, word [ecx + 2]
dec edx
mov dword [ebp - 0x3f8], edx
add ecx, 2
mov edx, dword [ebp - 0x33c]
movzx edx, word [edx + ecx]
cmp dx, di
jae 0x40d5b6
mov edx, dword [ebp - 0x43c]
add eax, 2
jmp 0x40d560
sub eax, dword [ebp - 0x408]
sar eax, 1
jne 0x40d6b7
mov eax, dword [ebp - 0x60]
cmp eax, 7
jbe 0x40d6b7
add eax, 0xfffffff9
mov dword [ebp - 0xd0], 0
cmp eax, 0xffffffff
mov dword [ebp - 0xc0], 0
mov ecx, esi
mov dword [ebp - 0xbc], 7
cmovb ecx, eax
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push ecx
add eax, 0xe
lea ecx, [ebp - 0xd0]
push eax
call fcn.004038a0
mov edi, dword [ebp - 0x338]
mov eax, dword [ebp - 0x74]
or edi, 0x20000
mov dword [ebp - 0x338], edi
mov dword [ebp - 0x334], edi
cmp eax, 8
jb 0x40d67f
inc eax
lea ecx, [ebp - 0x88]
push eax
push dword [ebp - 0x88]
call fcn.00403a30
movups xmm0, xmmword [ebp - 0xd0]
xor eax, eax
mov word [ebp - 0xd0], ax
movups xmmword [ebp - 0x88], xmm0
movq xmm0, qword [ebp - 0xc0]
movq qword [ebp - 0x78], xmm0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 7
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 0x1b
cmp eax, 8
jb 0x40d6d1
inc eax
lea ecx, [ebp - 0x70]
push eax
push edx
call fcn.00403a30
mov ecx, dword [ebp - 0x400]
xor eax, eax
mov word [ebp - 0x70], ax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov edx, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x340], eax
cmp eax, ecx
jl 0x40d4d0
mov esi, dword [ebp - 0x358]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x40d7d4
mov dword [ebp - 0x3d0], 0
call fcn.0040ba10
mov dword [ebp - 0x3d4], eax
lock inc dword [ebp - 0x3d0]
or dword [ebp - 0x334], 0x800
cmp dword [ebp - 0x3d4], 0
mov byte [ebp - 4], 0x1d
jne 0x40d769
call fcn.0040ba10
mov dword [ebp - 0x3d4], eax
lock inc dword [ebp - 0x3d0]
mov edi, dword [ebp - 0x3d4]
lea eax, [esi + 0x30]
cmp dword [eax + 0x14], 8
jb 0x40d77a
mov eax, dword [eax]
cmp dword [esi + 0x2c], 8
lea ecx, [esi + 0x18]
jb 0x40d785
mov ecx, dword [ecx]
cmp dword [ebp - 0x78], 0
jne 0x40d792
mov edx, str._empty_
jmp 0x40d7a3
cmp dword [ebp - 0x74], 8
lea edx, [ebp - 0x88]
cmovae edx, dword [ebp - 0x88]
push eax
push ecx
push edx
push dword [esi + 0x10]
lea eax, [ebp - 0x444]
mov dword [ebp - 0x444], 0x20
push str._Child_process_pid_ld_type_s_path_s_cmdline_s
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push eax
push 0
push edi
call fcn.0040df80
add esp, 0x28
mov eax, dword [ebp - 0x334]
or edi, 0xffffffff
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x338], eax
test eax, 0x800
je 0x40d830
and eax, 0xfffff7ff
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x338], eax
mov eax, edi
mov dword [ebp - 0x3d4], 0
lock xadd dword [ebp - 0x3d0], eax
js 0x40d829
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x3d0], eax
jns 0x40d818
lock inc dword [ebp - 0x3d0]
cmp dword [ebp - 0x78], 0
je 0x40de3e
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40ddb4
push eax
push 0
push 0x101001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x33c], eax
test eax, eax
je 0x40ddb4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
mov eax, dword [0x4f8ee0]
jne 0x40d993
add eax, dword [0x4f8edc]
je 0x40d92c
mov dword [ebp - 0x3c8], 0
call fcn.0040ba10
mov dword [ebp - 0x3cc], eax
lock inc dword [ebp - 0x3c8]
or dword [ebp - 0x334], 0x1000
cmp dword [ebp - 0x3cc], 0
mov byte [ebp - 4], 0x1e
jne 0x40d8c8
call fcn.0040ba10
mov dword [ebp - 0x3cc], eax
lock inc dword [ebp - 0x3c8]
mov eax, dword [ebp - 0x3cc]
cmp dword [esi + 0x2c], 8
mov dword [ebp - 0x360], eax
lea eax, [esi + 0x18]
mov dword [ebp - 0x340], eax
jb 0x40d8eb
mov eax, dword [eax]
mov dword [ebp - 0x340], eax
mov edi, dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x340]
mov dword [ebp - 0x440], 0x20
push edi
push eax
push str._TerminateProcess_failed_with_error__ld_for_pid__ld_path__s
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
lea eax, [ebp - 0x440]
push eax
push 0
push dword [ebp - 0x360]
call fcn.0040df80
add esp, 0x24
mov edi, dword [ebp - 0x334]
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x338], edi
test edi, 0x1000
je 0x40dda8
and edi, 0xffffefff
mov dword [ebp - 0x334], edi
mov dword [ebp - 0x338], edi
or edi, 0xffffffff
mov dword [ebp - 0x3cc], 0
mov eax, edi
lock xadd dword [ebp - 0x3c8], eax
js 0x40d987
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x3c8], eax
jns 0x40d976
lock inc dword [ebp - 0x3c8]
jmp 0x40dda8
add eax, dword [0x4f8edc]
je 0x40da24
mov dword [ebp - 0x3c0], 0
call fcn.0040ba10
mov dword [ebp - 0x3c4], eax
lock inc dword [ebp - 0x3c0]
or dword [ebp - 0x334], 0x2000
cmp dword [ebp - 0x3c4], 0
mov byte [ebp - 4], 0x1f
jne 0x40d9e4
call fcn.0040ba10
mov dword [ebp - 0x3c4], eax
lock inc dword [ebp - 0x3c0]
mov ecx, dword [ebp - 0x3c4]
lea eax, [esi + 0x18]
cmp dword [eax + 0x14], 8
jb 0x40d9f5
mov eax, dword [eax]
push eax
push dword [esi + 0x10]
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x20
push str._TerminateProcess_succeeded_for_pid__ld_path__s._Waiting_for_2_seconds_to_close.
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push eax
push 0
push ecx
call fcn.0040df80
add esp, 0x20
mov eax, dword [ebp - 0x334]
mov dword [ebp - 4], 0x1b
test eax, 0x2000
je 0x40da78
and eax, 0xffffdfff
mov dword [ebp - 0x334], eax
mov eax, edi
mov dword [ebp - 0x3c4], 0
lock xadd dword [ebp - 0x3c0], eax
js 0x40da71
nop dword [eax]
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x3c0], eax
jns 0x40da60
lock inc dword [ebp - 0x3c0]
push 0x7d0
push dword [ebp - 0x33c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x4f8ee0]
mov dword [ebp - 0x360], eax
add ecx, dword [0x4f8edc]
je 0x40db2c
mov dword [ebp - 0x3b8], 0
call fcn.0040ba10
mov dword [ebp - 0x3bc], eax
lock inc dword [ebp - 0x3b8]
or dword [ebp - 0x334], 0x4000
cmp dword [ebp - 0x3bc], 0
mov byte [ebp - 4], 0x20
jne 0x40dae6
call fcn.0040ba10
mov dword [ebp - 0x3bc], eax
lock inc dword [ebp - 0x3b8]
mov ecx, dword [ebp - 0x3bc]
lea eax, [esi + 0x18]
cmp dword [eax + 0x14], 8
jb 0x40daf7
mov eax, dword [eax]
push dword [ebp - 0x360]
mov dword [ebp - 0x42c], 0x20
push eax
push dword [esi + 0x10]
lea eax, [ebp - 0x42c]
push str._termination_WaitForSingleObject_pid__ld_path__s_returned__ld
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push eax
push 0
push ecx
call fcn.0040df80
add esp, 0x24
mov eax, dword [ebp - 0x334]
mov dword [ebp - 4], 0x1b
test eax, 0x4000
je 0x40db79
and eax, 0xffffbfff
mov dword [ebp - 0x334], eax
mov eax, edi
mov dword [ebp - 0x3bc], 0
lock xadd dword [ebp - 0x3b8], eax
js 0x40db72
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x3b8], eax
jns 0x40db61
lock inc dword [ebp - 0x3b8]
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x33c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
mov eax, dword [0x4f8ee0]
je 0x40dc92
add eax, dword [0x4f8edc]
je 0x40dc30
mov dword [ebp - 0x3a8], 0
call fcn.0040ba10
mov dword [ebp - 0x3ac], eax
lock inc dword [ebp - 0x3a8]
or dword [ebp - 0x334], 0x8000
cmp dword [ebp - 0x3ac], 0
mov byte [ebp - 4], 0x21
jne 0x40dbea
call fcn.0040ba10
mov dword [ebp - 0x3ac], eax
lock inc dword [ebp - 0x3a8]
mov ecx, dword [ebp - 0x3ac]
lea eax, [esi + 0x18]
cmp dword [eax + 0x14], 8
jb 0x40dbfb
mov eax, dword [eax]
push dword [ebp - 0x414]
mov dword [ebp - 0x410], 0x20
push eax
push dword [esi + 0x10]
lea eax, [ebp - 0x410]
push str.GetExitCodeProcess_succeeded_for_pid__ld_path__s._Exit_code_is__ld.
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
push eax
push 0
push ecx
call fcn.0040df80
add esp, 0x24
mov eax, dword [ebp - 0x334]
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x338], eax
test eax, 0x8000
je 0x40dda8
and eax, 0xffff7fff
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x338], eax
mov eax, edi
mov dword [ebp - 0x3ac], 0
lock xadd dword [ebp - 0x3a8], eax
js 0x40dc86
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x3a8], eax
jns 0x40dc75
lock inc dword [ebp - 0x3a8]
jmp 0x40dda8
add eax, dword [0x4f8edc]
je 0x40dd47
mov dword [ebp - 0x3b0], 0
call fcn.0040ba10
mov dword [ebp - 0x3b4], eax
lock inc dword [ebp - 0x3b0]
or dword [ebp - 0x334], 0x10000
cmp dword [ebp - 0x3b4], 0
mov byte [ebp - 4], 0x22
jne 0x40dce3
call fcn.0040ba10
mov dword [ebp - 0x3b4], eax
lock inc dword [ebp - 0x3b0]
mov eax, dword [ebp - 0x3b4]
cmp dword [esi + 0x2c], 8
mov dword [ebp - 0x360], eax
lea eax, [esi + 0x18]
mov dword [ebp - 0x340], eax
jb 0x40dd06
mov eax, dword [eax]
mov dword [ebp - 0x340], eax
mov edi, dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x340]
mov dword [ebp - 0x418], 0x20
push edi
push eax
push str.GetExitCodeProcess_failed_with_error__ld_for_pid__ld_path__s.
push str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
push 0x400000
lea eax, [ebp - 0x418]
push eax
push 0
push dword [ebp - 0x360]
call fcn.0040df80
add esp, 0x24
mov edi, dword [ebp - 0x334]
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x338], edi
test edi, 0x10000
je 0x40dda8
and edi, 0xfffeffff
mov dword [ebp - 0x334], edi
mov dword [ebp - 0x338], edi
or edi, 0xffffffff
mov dword [ebp - 0x3b4], 0
mov eax, edi
lock xadd dword [ebp - 0x3b0], eax
js 0x40dda1
nop dword [eax]
call fcn.0040dfb0
mov eax, edi
lock xadd dword [ebp - 0x3b0], eax
jns 0x40dd90
lock inc dword [ebp - 0x3b0]
push dword [ebp - 0x33c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x74]
mov byte [ebp - 4], 0xd
cmp eax, 8
jb 0x40ddd3
inc eax
lea ecx, [ebp - 0x88]
push eax
push dword [ebp - 0x88]
call fcn.00403a30
xor eax, eax
mov word [ebp - 0x88], ax
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x40de0a
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x40de00
nop
cmp esi, dword [eax + 8]
jne 0x40de00
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x40ddf0
mov esi, eax
mov dword [ebp - 0x358], esi
jmp 0x40de32
mov esi, eax
mov dword [ebp - 0x358], esi
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x40de32
nop word [eax + eax]
mov eax, dword [ecx]
mov esi, ecx
mov dword [ebp - 0x358], esi
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x40de20
cmp byte [esi + 0xd], 0
je 0x40d450
jmp 0x40de59
mov eax, dword [ebp - 0x74]
cmp eax, 8
jb 0x40de59
inc eax
lea ecx, [ebp - 0x88]
push eax
push dword [ebp - 0x88]
call fcn.00403a30
mov eax, dword [ebp - 0x354]
push dword [eax + 4]
lea eax, [ebp - 0x354]
push eax
mov ecx, eax
call fcn.0040ad10
push 0x48
push dword [ebp - 0x354]
call fcn.00450975
mov eax, dword [ebp - 0x2c]
add esp, 8
cmp eax, 8
jb 0x40de95
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00403a30
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 7
cmp eax, 8
jb 0x40debe
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00403a30
mov ecx, dword [ebp - 0x348]
xor eax, eax
mov word [ebp - 0x28], ax
add ecx, 0xfffffff0
mov dword [ebp - 0x18], 0
or eax, 0xffffffff
mov dword [ebp - 0x14], 7
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40deff
lfence
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4c758c]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x344]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40df2c
lfence
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4c758c]
mov ecx, edi
call esi
lea ecx, [ebp - 0x368]
call fcn.0040b2e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00450df0
mov esp, ebp
pop ebp
ret
call fcn.0040e5e0
push 0x80004005
call fcn.00404140
push 0x80004005
call fcn.00404140
call fcn.004984ff
call fcn.004984ff
int3