Function at 0x401450
Capabilities:
Enumerate gui resources
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34
cmp dword [ebp + 8], 1
jle 0x401780
cmp dword [ebp + 8], 2
je 0x401730
mov dword [ebp - 0x20], 0
mov esi, 1
mov dword [ebp - 0x1c], 0
jmp 0x401494
mov dword [0x406010], 1
add esi, 1
cmp dword [ebp + 8], esi
jle 0x4014f8
mov eax, dword [ebp + 0xc]
lea edi, [esi*4]
add eax, edi
mov ebx, dword [eax]
mov dword [ebp - 0x18], eax
movzx eax, word [ebx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x4016b0
add ebx, 2
mov dword [esp], 0x405012
mov dword [esp + 4], ebx
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x401482
mov dword [esp + 4], ebx
mov dword [esp], 0x405016
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x4015f0
mov dword [0x406014], 1
add esi, 1
cmp dword [ebp + 8], esi
jg 0x401494
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov esi, eax
cmp eax, 0xffffffff
je 0x401694
mov dword [esp], 0x11a00
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x406004], eax
test eax, eax
je 0x401694
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._Process32FirstW_8
sub esp, 8
test eax, eax
je 0x401694
mov ebx, pe_nt_image_headers32
jmp 0x401584
lea eax, [eax + ecx + 0x234]
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._Process32NextW_8
sub esp, 8
test eax, eax
je 0x4017b0
mov edx, dword [section..bss]
mov eax, dword [0x406004]
imul ecx, edx, 0x234
add edx, 1
mov dword [section..bss], edx
lea edi, [eax + ecx]
mov dword [edi + 0x230], 0
mov dword [edi + 0x22c], 0
cmp edx, ebx
jne 0x401560
lea edi, [ebx + ebx]
mov dword [ebp - 0x18], ecx
imul ebx, ebx, 0x468
mov dword [esp], eax
mov dword [esp + 4], ebx
call dword [sym.imp.ucrtbase.dll_realloc]
test eax, eax
je 0x401694
mov dword [0x406004], eax
mov ebx, edi
mov ecx, dword [ebp - 0x18]
jmp 0x401560
mov dword [esp + 4], ebx
mov dword [esp], 0x40501a
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x401660
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + edi + 4]
test ebx, ebx
je 0x401cd3
movzx eax, byte [ebp - 0x20]
mov dword [ebp - 0x1c], 1
and eax, 1
test al, al
jne 0x401cfe
mov eax, dword [0x40600c]
mov edx, dword [section..data]
test eax, eax
je 0x4016e0
mov edi, dword [0x406008]
cmp edi, edx
je 0x401704
lea edx, [edi + 1]
mov dword [eax + edi*4], ebx
add esi, 1
mov dword [0x406008], edx
jmp 0x40148c
mov dword [esp + 4], ebx
mov dword [esp], 0x405020
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x4016b0
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + edi + 4]
test ebx, ebx
je 0x401cd3
movzx eax, byte [ebp - 0x1c]
mov dword [ebp - 0x20], 1
and eax, 1
jmp 0x401622
mov eax, 0x70
call dbg.taskkill_message
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
lea esp, [info.pid]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x66
call dbg.taskkill_message
mov eax, 0x65
call dbg.taskkill_message
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
lea esp, [info.pid]
pop ebx
pop esi
pop edi
pop ebp
ret
shl edx, 2
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x40600c], eax
test eax, eax
je 0x401794
mov edi, dword [0x406008]
jmp 0x40164b
lea edx, [edi + edi]
mov dword [esp], eax
mov dword [section..data], edx
lea edx, [edi*8]
mov dword [esp + 4], edx
call dword [sym.imp.ucrtbase.dll_realloc]
test eax, eax
je 0x401794
mov dword [0x40600c], eax
jmp 0x40164b
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
movzx eax, word [edx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x40146d
add edx, 2
mov dword [esp], 0x40500e
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x40146d
mov eax, 0x65
call dbg.taskkill_message
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, [esi]
mov eax, 0x68
call dbg.taskkill_message
mov eax, 0x65
call dbg.taskkill_message
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
lea esp, [info.pid]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x20], eax
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call eax
mov eax, dword [0x406008]
mov dword [ebp - 0x24], 0
sub esp, 4
mov dword [ebp - 0x18], 0
test eax, eax
je 0x4018a5
nop
mov eax, dword [0x40600c]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [eax + ecx*4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov esi, ebx
mov dword [ebp - 0x1c], eax
jmp 0x401814
add esi, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_iswdigit]
test eax, eax
je 0x401990
movzx eax, word [esi]
test ax, ax
jne 0x401800
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstol]
mov edi, dword [section..bss]
test edi, edi
je 0x40187b
mov edx, dword [0x406004]
mov esi, edx
cmp eax, dword [edx + 8]
je 0x4019e3
add edx, 0x234
xor ecx, ecx
jmp 0x401874
mov esi, edx
add edx, 0x234
cmp eax, dword [edx - 0x22c]
je 0x4019e3
add ecx, 1
cmp edi, ecx
jne 0x401860
mov dword [esp + 4], ebx
mov dword [esp], 0x6f
call dbg.taskkill_message_printfW
mov dword [ebp - 0x24], pe_nt_image_headers32
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
cmp dword [0x406008], eax
ja 0x4017e0
mov eax, dword [0x406010]
mov ecx, dword [section..bss]
test eax, eax
jne 0x401c00
mov eax, dword [0x406014]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x401aa0
xor edi, edi
xor esi, esi
test ecx, ecx
jne 0x401925
jmp 0x401a80
mov ecx, dword [0x406004]
mov edx, dword [0x406010]
mov eax, dword [ebp - 0x14]
add ecx, edi
test edx, edx
jne 0x401ba0
mov edx, dword [ecx + 0x230]
test edx, edx
je 0x401b80
mov dword [esp + 4], eax
mov dword [esp], 0x6b
call dbg.taskkill_message_printfW
lea esi, [esi]
add esi, 1
add edi, 0x234
cmp esi, dword [section..bss]
jae 0x401a80
mov ebx, dword [0x406004]
add ebx, edi
mov eax, dword [ebx + 0x22c]
test eax, eax
je 0x401910
mov eax, dword [ebx + 8]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
test byte [0x403004], 8
jne 0x401a40
lea eax, [ebp - 0x14]
mov dword [esp], dbg.pid_enum_proc
mov dword [esp + 4], eax
call dword [sym.imp.user32.dll_EnumWindows]
mov ecx, dword [ebp - 0x10]
sub esp, 8
test ecx, ecx
jne 0x4018d5
mov edx, esi
mov eax, 0x6f
call dbg.taskkill_message_print_process
mov dword [ebp - 0x18], pe_nt_image_headers32
jmp 0x401910
mov eax, dword [section..bss]
xor esi, esi
xor edi, edi
test eax, eax
je 0x40187b
mov eax, dword [0x406004]
mov dword [esp + 4], ebx
add eax, esi
add eax, 0x24
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x4019cd
mov eax, dword [0x406004]
add eax, esi
mov edx, dword [eax + 0x22c]
test edx, edx
je 0x401a24
add edi, 1
add esi, 0x234
cmp edi, dword [section..bss]
jb 0x4019a1
jmp 0x40187b
mov ecx, dword [esi + 0x22c]
test ecx, ecx
jne 0x40187b
mov dword [esi + 0x22c], 1
mov dword [esi + 0x230], 1
cmp dword [ebp - 0x1c], eax
jne 0x401892
mov eax, 0x72
call dbg.taskkill_message
mov dword [ebp - 0x24], 1
jmp 0x401892
mov dword [eax + 0x22c], 1
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 8]
jne 0x401892
jmp 0x401a0e
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Terminating_pid__04lx._n
mov dword [esp + 8], str.send_close_messages
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
jmp 0x401951
mov eax, dword [0x406014]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x401a86
lea esi, [esi]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
test eax, eax
cmove eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
lea esp, [info.pid]
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
xor esi, esi
test ecx, ecx
jne 0x401adc
jmp 0x401a86
mov dword [esp + 4], eax
mov dword [esp], 0x6d
call dbg.taskkill_message_printfW
mov dword [esp], edi
mov eax, dword [ebp - 0x2c]
call eax
sub esp, 4
add esi, 1
add ebx, 0x234
cmp esi, dword [section..bss]
jae 0x401a86
mov edx, dword [0x406004]
add edx, ebx
mov edi, dword [edx + 0x22c]
test edi, edi
je 0x401acb
mov eax, dword [edx + 8]
mov dword [ebp - 0x18], edx
mov dword [esp + 4], 0
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], eax
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_OpenProcess]
mov edx, dword [ebp - 0x18]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x401be0
mov dword [ebp - 0x18], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov edx, dword [ebp - 0x18]
sub esp, 8
test eax, eax
je 0x401cb0
mov eax, dword [0x406004]
mov ecx, dword [0x406010]
add eax, ebx
test ecx, ecx
jne 0x401bc0
mov eax, dword [eax + 0x230]
test eax, eax
mov eax, dword [ebp - 0x1c]
jne 0x401ab0
add edx, 0x24
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x6e
call dbg.taskkill_message_printfW
jmp 0x401ac0
lea edx, [ebx + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x6c
call dbg.taskkill_message_printfW
jmp 0x401910
mov edx, dword [ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x74
mov dword [esp + 8], edx
call dbg.taskkill_message_printfW
jmp 0x401910
mov eax, dword [eax + 0x18]
mov dword [esp], 0x73
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
call dbg.taskkill_message_printfW
jmp 0x401ac0
mov edx, esi
mov eax, 0x6f
call dbg.taskkill_message_print_process
mov dword [ebp - 0x20], pe_nt_image_headers32
jmp 0x401acb
test ecx, ecx
je 0x401a6d
mov eax, dword [0x406004]
mov dword [ebp - 0x18], 0
xor edi, edi
mov dword [ebp - 0x1c], eax
jmp 0x401c32
add edi, 1
add dword [ebp - 0x18], 0x234
cmp ecx, edi
jbe 0x4018b8
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
mov edx, edi
mov dword [ebp - 0x28], eax
mov eax, dword [eax + 0x22c]
test eax, eax
jne 0x401c20
imul edx, edx, 0x234
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + edx + 0x18]
test ebx, ebx
je 0x401c20
cmp ebx, dword [eax + 8]
je 0x401d1e
add eax, 0x234
xor edx, edx
lea esi, [esi]
nop
add edx, 1
cmp ecx, edx
je 0x401c20
mov esi, eax
add eax, 0x234
cmp ebx, dword [eax - 0x22c]
jne 0x401c70
mov eax, dword [esi + 0x22c]
test eax, eax
je 0x401c47
test byte [0x403004], 8
jne 0x401d28
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x22c], 1
jmp 0x401c20
mov edx, esi
mov eax, 0x71
call dbg.taskkill_message_print_process
mov dword [esp], edi
mov eax, dword [ebp - 0x2c]
call eax
mov dword [ebp - 0x20], 1
sub esp, 4
jmp 0x401acb
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp], 0x69
mov dword [esp + 4], eax
call dbg.taskkill_message_printfW
mov eax, 0x65
call dbg.taskkill_message
mov dword [ebp - 0x20], 1
jmp 0x4016a5
mov eax, 0x6a
call dbg.taskkill_message
mov eax, 0x65
call dbg.taskkill_message
mov dword [ebp - 0x20], 1
jmp 0x4016a5
mov esi, dword [ebp - 0x1c]
xor edx, edx
jmp 0x401c86
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
mov dword [esp + 0xc], str.Adding_child__04lx._n
mov dword [esp + 8], str.mark_child_processes
mov dword [esp + 0x10], eax
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov eax, dword [0x406004]
mov ecx, dword [section..bss]
mov dword [ebp - 0x1c], eax
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
jmp 0x401c9d