Function at 0x402250
Capabilities:
Enumerate gui resources
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x50
cmp dword [ebp + 8], 1
jle 0x402a03
cmp dword [ebp + 8], 2
je 0x4027d0
mov dword [ebp - 0x40], 0
mov edi, 1
mov dword [ebp - 0x3c], 0
jmp 0x402298
mov dword [0x403058], 1
inc edi
cmp dword [ebp + 8], edi
jle 0x4022fa
mov eax, dword [ebp + 0xc]
lea esi, [edi*4]
add eax, esi
mov ebx, dword [eax]
mov dword [ebp - 0x38], eax
movzx eax, word [ebx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x402740
add ebx, 2
mov dword [esp], 0x40400a
mov dword [esp + 4], ebx
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x402288
mov dword [esp + 4], ebx
mov dword [esp], 0x40400e
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x4023f0
mov dword [0x403048], 1
inc edi
cmp dword [ebp + 8], edi
jg 0x402298
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov esi, eax
cmp eax, 0xffffffff
je 0x40281c
mov dword [esp], 0x11a00
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x403108], eax
test eax, eax
je 0x40281c
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._Process32FirstW_8
sub esp, 8
test eax, eax
je 0x40281c
mov ebx, pe_nt_image_headers32
jmp 0x402384
lea eax, [ecx + edx + 0x234]
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._Process32NextW_8
sub esp, 8
test eax, eax
je 0x402494
mov eax, dword [0x403104]
mov ecx, dword [0x403108]
imul edx, eax, 0x234
inc eax
mov dword [0x403104], eax
lea edi, [ecx + edx]
mov dword [edi + 0x230], 0
mov dword [edi + 0x22c], 0
cmp eax, ebx
jne 0x402360
lea edi, [ebx + ebx]
mov dword [esp], ecx
imul ebx, ebx, 0x468
mov dword [ebp - 0x38], edx
mov dword [esp + 4], ebx
call dword [sym.imp.ucrtbase.dll_realloc]
mov ecx, eax
test eax, eax
je 0x40281c
mov dword [0x403108], eax
mov edx, dword [ebp - 0x38]
mov ebx, edi
jmp 0x402360
mov dword [esp + 4], ebx
mov dword [esp], 0x404012
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x402460
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + esi + 4]
test esi, esi
je 0x402bd9
mov dword [ebp - 0x3c], 1
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x402c04
mov eax, dword [0x403110]
mov ecx, dword [0x4030e0]
test eax, eax
je 0x402770
mov ebx, dword [0x40310c]
cmp ecx, ebx
je 0x402798
lea ecx, [ebx + 1]
mov dword [eax + ebx*4], esi
inc edi
mov dword [0x40310c], ecx
jmp 0x402292
mov dword [esp + 4], ebx
mov dword [esp], 0x404018
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x402740
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + esi + 4]
test esi, esi
je 0x402bd9
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x3c]
jmp 0x40241e
mov dword [ebp - 0x40], eax
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], esi
mov dword [ebp - 0x48], eax
call eax
mov eax, dword [0x40310c]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x38], 0
sub esp, 4
test eax, eax
je 0x402592
lea esi, [esi]
mov eax, dword [0x403110]
mov ecx, dword [ebp - 0x38]
mov ebx, dword [eax + ecx*4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov edi, ebx
mov dword [ebp - 0x3c], eax
jmp 0x4024fc
add edi, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_iswdigit]
test eax, eax
je 0x4026a0
movzx eax, word [edi]
test ax, ax
jne 0x4024e8
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstol]
mov edi, dword [0x403104]
xor edx, edx
mov ecx, eax
mov eax, dword [0x403108]
test edi, edi
jne 0x402546
jmp 0x4026eb
inc edx
add eax, 0x234
cmp edx, edi
je 0x4026eb
cmp ecx, dword [eax + 8]
jne 0x402538
mov esi, dword [eax + 0x22c]
test esi, esi
jne 0x4026eb
mov dword [eax + 0x22c], 1
mov dword [eax + 0x230], 1
cmp dword [ebp - 0x3c], ecx
je 0x402726
lea esi, cs:[esi]
nop
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp dword [0x40310c], eax
ja 0x4024c8
mov eax, dword [0x403058]
mov ebx, dword [0x403104]
test eax, eax
jne 0x402a75
mov eax, dword [0x403048]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x402838
xor edi, edi
xor esi, esi
test ebx, ebx
jne 0x4025f9
jmp 0x402941
mov dword [esp + 4], eax
mov dword [esp], 0x6d
call sym._taskkill_message_printfW
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [ebp - 0x48]
call eax
sub esp, 4
inc esi
add edi, 0x234
cmp esi, dword [0x403104]
jae 0x402941
mov ebx, dword [0x403108]
add ebx, edi
mov eax, dword [ebx + 0x22c]
test eax, eax
je 0x4025e6
mov eax, dword [ebx + 8]
mov dword [esp + 4], 0
mov dword [esp], 1
mov dword [ebp - 0x3c], eax
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [ebp - 0x38], eax
sub esp, 0xc
test eax, eax
je 0x402a29
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
sub esp, 8
test eax, eax
mov eax, edi
je 0x402b02
mov edx, dword [0x403058]
add eax, dword [0x403108]
test edx, edx
jne 0x4029e4
mov eax, dword [eax + 0x230]
test eax, eax
mov eax, dword [ebp - 0x3c]
jne 0x4025c8
lea edx, [ebx + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x6e
call sym._taskkill_message_printfW
jmp 0x4025d8
mov eax, dword [0x403104]
xor edi, edi
xor esi, esi
test eax, eax
je 0x4026eb
lea esi, [esi]
mov eax, dword [0x403108]
mov dword [esp + 4], ebx
add eax, edi
add eax, 0x24
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x4026dc
mov eax, dword [0x403108]
add eax, edi
mov edx, dword [eax + 0x22c]
test edx, edx
je 0x402710
inc esi
add edi, 0x234
cmp esi, dword [0x403104]
jb 0x4026b0
mov dword [esp + 4], ebx
mov dword [esp], 0x6f
call sym._taskkill_message_printfW
mov dword [ebp - 0x44], pe_nt_image_headers32
jmp 0x402580
mov dword [eax + 0x22c], 1
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [eax + 8]
jne 0x402580
mov eax, 0x72
call sym._taskkill_message
mov dword [ebp - 0x44], 1
jmp 0x402580
mov eax, 0x66
call sym._taskkill_message
mov eax, 0x65
call sym._taskkill_message
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
shl ecx, 2
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x403110], eax
test eax, eax
je 0x402a17
mov ebx, dword [0x40310c]
jmp 0x402447
lea ecx, [ebx + ebx]
mov dword [esp], eax
mov dword [0x4030e0], ecx
lea ecx, [ebx*8]
mov dword [esp + 4], ecx
call dword [sym.imp.ucrtbase.dll_realloc]
test eax, eax
je 0x402a17
mov dword [0x403110], eax
jmp 0x402447
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
movzx eax, word [edx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x40226d
add edx, 2
mov dword [esp], 0x404006
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x40226d
mov eax, 0x65
call sym._taskkill_message
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_exit]
mov eax, 0x70
call sym._taskkill_message
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
xor edi, edi
test ebx, ebx
jne 0x402893
jmp 0x40293b
mov ecx, dword [0x403108]
mov edx, dword [0x403058]
mov eax, dword [ebp - 0x34]
add ecx, esi
test edx, edx
jne 0x4029c8
mov edx, dword [ecx + 0x230]
test edx, edx
je 0x4029ac
mov dword [esp + 4], eax
mov dword [esp], 0x6b
call sym._taskkill_message_printfW
nop
inc edi
add esi, 0x234
cmp edi, dword [0x403104]
jae 0x40293b
mov ebx, dword [0x403108]
add ebx, esi
mov eax, dword [ebx + 0x22c]
test eax, eax
je 0x402880
mov eax, dword [ebx + 8]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], eax
test byte [0x403020], 8
jne 0x402960
lea eax, [ebp - 0x34]
mov dword [esp], sym._pid_enum_proc_8
mov dword [esp + 4], eax
call dword [sym.imp.user32.dll_EnumWindows]
mov ecx, dword [ebp - 0x30]
sub esp, 8
test ecx, ecx
jne 0x402848
mov eax, dword [0x403108]
add eax, esi
mov ecx, dword [eax + 0x230]
test ecx, ecx
je 0x40298d
mov eax, dword [eax + 8]
lea ebx, [ebp - 0x2c]
mov dword [esp + 4], 0x404036
inc edi
mov dword [esp], ebx
add esi, 0x234
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov dword [esp + 4], ebx
mov dword [esp], 0x6f
call sym._taskkill_message_printfW
mov dword [ebp - 0x38], pe_nt_image_headers32
cmp edi, dword [0x403104]
jb 0x402893
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x44]
test eax, eax
cmove eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Terminating_pid__04lx._n
mov dword [esp + 8], str.send_close_messages
mov dword [esp + 4], 0x403020
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x4028bf
add eax, 0x24
mov dword [esp], 0x6f
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
mov dword [ebp - 0x38], pe_nt_image_headers32
jmp 0x402880
lea edx, [ebx + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x6c
call sym._taskkill_message_printfW
jmp 0x402880
mov edx, dword [ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x74
mov dword [esp + 8], edx
call sym._taskkill_message_printfW
jmp 0x402880
mov eax, dword [eax + 0x18]
mov dword [esp], 0x73
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
jmp 0x4025d8
mov eax, 0x68
call sym._taskkill_message
mov eax, 0x65
call sym._taskkill_message
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x403108]
add eax, edi
mov ebx, dword [eax + 0x230]
test ebx, ebx
je 0x402ba2
mov eax, dword [eax + 8]
lea ebx, [ebp - 0x2c]
mov dword [esp + 4], 0x404036
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov dword [esp + 4], ebx
mov dword [esp], 0x6f
call sym._taskkill_message_printfW
mov dword [ebp - 0x40], pe_nt_image_headers32
jmp 0x4025e6
test ebx, ebx
je 0x402c20
mov dword [ebp - 0x38], 0
mov esi, dword [0x403108]
xor edi, edi
jmp 0x402aa0
inc edi
add dword [ebp - 0x38], 0x234
cmp edi, ebx
jae 0x4025a5
mov eax, dword [ebp - 0x38]
add eax, esi
mov dword [ebp - 0x3c], eax
mov eax, dword [eax + 0x22c]
test eax, eax
jne 0x402a90
mov eax, edi
lea esi, [esi]
imul eax, eax, 0x234
mov ecx, dword [esi + eax + 0x18]
test ecx, ecx
je 0x402a90
test ebx, ebx
je 0x402a90
mov edx, esi
xor eax, eax
jmp 0x402adb
inc eax
add edx, 0x234
cmp eax, ebx
je 0x402a90
cmp ecx, dword [edx + 8]
jne 0x402ad0
mov edx, dword [edx + 0x22c]
test edx, edx
je 0x402ab8
test byte [0x403020], 8
jne 0x402b5b
mov eax, dword [ebp - 0x3c]
mov dword [eax + 0x22c], 1
jmp 0x402a90
add eax, dword [0x403108]
mov ecx, dword [eax + 0x230]
test ecx, ecx
je 0x402bc1
mov eax, dword [eax + 8]
lea ebx, [ebp - 0x2c]
mov dword [esp + 4], 0x404036
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov dword [esp + 4], ebx
mov dword [esp], 0x71
call sym._taskkill_message_printfW
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [ebp - 0x48]
call eax
mov dword [ebp - 0x40], 1
sub esp, 4
jmp 0x4025e6
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
mov dword [esp + 0xc], str.Adding_child__04lx._n
mov dword [esp + 8], str.mark_child_processes
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x403020
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov esi, dword [0x403108]
mov eax, dword [ebp - 0x38]
mov ebx, dword [0x403104]
add eax, esi
mov dword [ebp - 0x3c], eax
jmp 0x402af3
add eax, 0x24
mov dword [esp], 0x6f
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
mov dword [ebp - 0x40], pe_nt_image_headers32
jmp 0x4025e6
add eax, 0x24
mov dword [esp], 0x71
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
jmp 0x402b41
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov dword [esp], 0x69
mov dword [esp + 4], eax
call sym._taskkill_message_printfW
mov eax, 0x65
call sym._taskkill_message
mov dword [ebp - 0x40], 1
jmp 0x40275b
mov dword [ebp - 0x40], eax
mov eax, 0x6a
call sym._taskkill_message
mov eax, 0x65
call sym._taskkill_message
jmp 0x40275b
mov eax, dword [0x403048]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x40293b
jmp 0x402941