Function at 0x429b60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c4
mov eax, dword [0x4a22d0]
xor eax, esp
mov dword [esp + 0x4c0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], ebx
mov esi, ecx
push ebx
push 2
mov byte [esp + 0x1b], 1
mov dword [esp + 0x278], 0x49d3a0
mov byte [esp + 0x280], bl
mov dword [esp + 0x4b0], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [esp + 0x274], eax
lea ecx, [esp + 0x4ac]
xor eax, eax
mov dword [esp + 0x270], 0x49d250
push 0xffffffffffffffff
push eax
push esi
mov dword [esp + 0x4cc], 7
mov dword [esp + 0x4c8], ebx
mov word [esp + 0x4b8], ax
call fcn.00407bd0
lea ecx, [esp + 0x270]
call fcn.00429f20
test eax, eax
je 0x429e9f
push dword [eax + 8]
push 0
push 0x100401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
lea ecx, [esp + 0x2c]
call fcn.0041a810
push eax
lea ecx, [esp + 0x24]
call fcn.0041a8a0
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x429c93
cmp eax, 0xffffffff
je 0x429c93
call fcn.0041c610
mov edi, dword [ebp + 4]
mov esi, eax
mov ecx, dword [0x4a574c]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
test ecx, ecx
jne 0x429c5d
call fcn.0041c6d0
mov ecx, dword [0x4a574c]
mov eax, dword [ecx]
lea edx, [esp + 0x2c]
push esi
push edi
push edx
push dword [esp + 0x20]
call dword [eax + 8]
mov ecx, dword [0x4a574c]
mov esi, dword [esp + 0x2c]
test ecx, ecx
jne 0x429c86
call fcn.0041c6d0
mov ecx, dword [0x4a574c]
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.0041a8a0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x429d0b
cmp eax, 0xffffffff
je 0x429d0b
call fcn.0041c610
mov edi, dword [ebp + 4]
mov esi, eax
mov ecx, dword [0x4a574c]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
test ecx, ecx
jne 0x429cd5
call fcn.0041c6d0
mov ecx, dword [0x4a574c]
mov eax, dword [ecx]
lea edx, [esp + 0x24]
push esi
push edi
push edx
push dword [esp + 0x20]
call dword [eax + 8]
mov ecx, dword [0x4a574c]
mov esi, dword [esp + 0x24]
test ecx, ecx
jne 0x429cfe
call fcn.0041c6d0
mov ecx, dword [0x4a574c]
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esp + 0x24], 0
test bl, 1
je 0x429d1f
lea ecx, [esp + 0xf0]
and ebx, 0xfffffffe
call fcn.00409ac0
cmp byte [esp + 0x18], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
je 0x429d30
call esi
jmp 0x429d34
mov eax, dword [esp + 0x1c]
push dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
mov byte [esp + 0x12], al
test al, al
je 0x429d8c
cmp byte [esp + 0x18], 0
je 0x429d57
call esi
jmp 0x429d5b
mov eax, dword [esp + 0x1c]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x429e19
test bl, 2
je 0x429e19
lea ecx, [esp + 0x1a0]
and ebx, 0xfffffffd
call fcn.0040a2c0
jmp 0x429e19
test bl, 4
je 0x429e1d
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x258]
and ebx, 0xfffffffb
call fcn.0040a0a0
push eax
lea eax, [esp + 0x4c]
push 0x49c2a4
push eax
call fcn.00408be0
add esp, 8
push eax
call fcn.0040bd20
add esp, 8
cmp dword [esp + 0x26c], 0x10
jb 0x429ddd
push dword [esp + 0x258]
call fcn.0046d967
add esp, 4
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x270], 0xf
mov dword [esp + 0x26c], 0
mov byte [esp + 0x25c], 0
call fcn.00425d60
add esp, 4
lea ecx, [esp + 0x40]
call fcn.00409ac0
mov al, byte [esp + 0x12]
and byte [esp + 0x13], al
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x429e8b
cmp eax, 0xffffffff
je 0x429e8b
call fcn.0041c610
mov edi, dword [ebp + 4]
mov esi, eax
mov ecx, dword [0x4a574c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
test ecx, ecx
jne 0x429e55
call fcn.0041c6d0
mov ecx, dword [0x4a574c]
mov eax, dword [ecx]
lea edx, [esp + 0x1c]
push esi
push edi
push edx
push dword [esp + 0x20]
call dword [eax + 8]
mov ecx, dword [0x4a574c]
mov esi, dword [esp + 0x1c]
test ecx, ecx
jne 0x429e7e
call fcn.0041c6d0
mov ecx, dword [0x4a574c]
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x270]
call fcn.00429f20
test eax, eax
jne 0x429c05
cmp dword [esp + 0x4c0], 8
mov dword [esp + 0x270], 0x49d250
jb 0x429ec3
push dword [esp + 0x4ac]
call fcn.0046d967
add esp, 4
push dword [esp + 0x274]
xor eax, eax
mov dword [esp + 0x4c4], 7
mov dword [esp + 0x4c0], 0
mov word [esp + 0x4b0], ax
mov dword [esp + 0x274], 0x49d3a0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x4cc]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046e2b4
mov esp, ebp
pop ebp
ret