Function at 0x4016c2
Capabilities:
Capture process snapshot data
Terminate process

Disassembly:
push 0x594
mov eax, 0x40332c
call fcn.00403257
mov edi, edx
mov dword [ebp - 0x598], edi
lea eax, [ecx - 7]
mov dword [ebp - 0x1c], eax
cmp eax, 0xb
ja 0x401aad
push dword [edi + 4]
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.00401e90
and dword [ebp - 4], 0
mov ecx, 0x404270
mov eax, dword [ebp - 0x18]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401729
test dx, dx
je 0x401725
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401729
add eax, 4
add ecx, 4
test dx, dx
jne 0x401703
xor esi, esi
jmp 0x40172e
sbb esi, esi
or esi, 1
mov edx, dword [edi + 8]
lea ecx, [ebp - 0x33c]
xor eax, eax
mov dword [ebp - 0x340], esi
test esi, esi
setne al
mov dword [ebp - 0x594], eax
call fcn.00401ab8
mov ebx, eax
test ebx, ebx
js 0x401aa1
mov edx, dword [edi + 0xc]
lea ecx, [ebp - 0x14]
call fcn.00401ab8
mov ebx, eax
test ebx, ebx
js 0x401aa1
mov edx, dword [edi + 0x10]
lea ecx, [ebp - 0x348]
call fcn.00401ab8
mov ebx, eax
test ebx, ebx
js 0x401aa1
mov edx, dword [edi + 0x18]
lea ecx, [ebp - 0x59c]
call fcn.00401ab8
mov ebx, eax
test ebx, ebx
js 0x401aa1
mov eax, dword [ebp - 0x33c]
test esi, esi
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x348]
mov dword [ebp - 0x5a0], eax
je 0x4017d6
test eax, eax
je 0x4017cc
test esi, esi
je 0x4017cc
test edi, edi
je 0x4017cc
cmp dword [ebp - 0x59c], 0
jne 0x4017d6
mov ebx, 0x800700a0
jmp 0x401aa1
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x348], edi
mov byte [ebp - 4], 3
cmp dword [ebp - 0x340], 0
je 0x4018d3
mov eax, dword [ebp - 0x594]
push str.PssCaptureSnapshot
push str.kernel32.dll
mov dword [ebp - 0x594], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4018d3
and dword [ebp - 0x594], eax
and dword [ebp - 0x344], eax
test esi, esi
je 0x40183d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 0x14], esi
test edi, edi
je 0x401850
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov dword [ebp - 0x348], edi
mov eax, dword [ebp - 0x33c]
test eax, eax
je 0x40187c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x5a0], eax
mov dword [ebp - 0x350], eax
test ebx, ebx
js 0x401a7a
xor ecx, ecx
mov dword [ebp - 0x33c], ecx
cmp dword [ebp - 0x594], ecx
je 0x40192c
push 4
lea eax, [ebp - 0x33c]
push eax
push 1
push dword [ebp - 0x344]
call dword [sym.imp.KERNEL32.dll_PssQuerySnapshot]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x401926
push dword [ebp - 0x344]
push esi
call dword [sym.imp.KERNEL32.dll_PssFreeSnapshot]
jmp 0x401a7a
and dword [ebp - 0x344], 0
cmp dword [ebp - 0x594], 0
je 0x40182d
lea eax, [ebp - 0x344]
push eax
push 0x1003f
push 0xc00019fd
push esi
call dword [sym.imp.KERNEL32.dll_PssCaptureSnapshot]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test esi, esi
je 0x401850
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 0x14], esi
jmp 0x401850
mov ecx, dword [ebp - 0x33c]
test ecx, ecx
je 0x401935
call fcn.00401cea
lea eax, [ebp - 0x340]
push eax
mov eax, dword [ebp - 0x598]
push 0
push 0
push dword [eax + 0x14]
call dword [sym.imp.wer.dll_WerReportCreate]
mov ebx, eax
test ebx, ebx
js 0x401a56
mov eax, dword [ebp - 0x598]
mov edx, dword [ebp - 0x1c]
add eax, 0x1c
push ecx
mov ecx, dword [ebp - 0x340]
push eax
call fcn.00401b04
mov ebx, eax
test ebx, ebx
js 0x401a4a
cmp dword [ebp - 0x594], 0
je 0x401a34
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x59c]
push ecx
call fcn.00401c65
xorps xmm0, xmm0
movlpd qword [ebp - 0x354], xmm0
test eax, eax
js 0x4019dd
and dword [ebp - 0x350], 0
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x34c], eax
lea eax, [ebp - 0x338]
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x354], eax
mov ebx, 0x23c
lea eax, [ebp - 0x590]
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x344]
add esp, 0xc
mov dword [ebp - 0x35c], eax
lea eax, [ebp - 0x590]
mov dword [ebp - 0x590], ebx
push 0
push eax
lea eax, [ebp - 0x354]
push eax
push 3
push edi
push 0
push dword [ebp - 0x340]
call dword [sym.imp.wer.dll_WerReportAddDump]
test edi, edi
je 0x401a34
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
lea eax, [ebp - 0x1c]
push eax
push 0x10
push 1
push dword [ebp - 0x340]
call dword [sym.imp.wer.dll_WerReportSubmit]
mov ebx, eax
push dword [ebp - 0x340]
call dword [sym.imp.wer.dll_WerReportCloseHandle]
cmp dword [ebp - 0x594], 0
je 0x401a7a
push dword [ebp - 0x344]
push esi
call dword [sym.imp.KERNEL32.dll_PssFreeSnapshot]
push 0
push dword [ebp - 0x33c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test edi, edi
je 0x401a85
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x401a90
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5a0]
test eax, eax
je 0x401aa1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.00401f0d
mov eax, ebx
jmp 0x401ab2
mov eax, 0x800700a0
call fcn.00403215
ret