Function at 0x418410
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586993
mov eax, dword fs:[0]
push eax
sub esp, 0x4fc
mov eax, dword [0x60940c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 2
mov dword [ebp - 0x434], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x43c], 0
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x438], 0
call fcn.0041fe40
mov dword [ebp - 0x43c], eax
mov dword [ebp - 4], 2
lea eax, [esi + 0x14]
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x45c], eax
push ecx
mov ecx, eax
call fcn.00408610
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
push 0
push ecx
mov ecx, eax
call fcn.004131f0
mov byte [ebp - 4], 4
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x474]
push 0
push eax
call fcn.0040bf60
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x4184fc
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.0040b090
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x450]
test eax, eax
je 0x418582
push dword [ebp - 0x440]
lea ecx, [ebp - 0x450]
push ecx
push dword [ebp - 0x44c]
push eax
call fcn.00405980
mov ecx, dword [ebp - 0x448]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x450]
add esp, 0x10
sub ecx, esi
imul ecx
lea ecx, [ebp - 0x450]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.0040b140
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0
lea eax, [ebp - 0x434]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x418fdd
lea eax, [ebp - 0x434]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x418fdd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x42c]
cmp ecx, eax
je 0x418fc7
push ecx
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x458], eax
test eax, eax
je 0x418fc7
push eax
lea eax, [ebp - 0x488]
push eax
call fcn.0047d080
add esp, 8
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x160]
push 0
push eax
lea ecx, [ebp - 0x474]
call fcn.004131f0
mov esi, eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x488]
call fcn.00412ce0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x178]
push 0
push ecx
mov ecx, eax
call fcn.004131f0
mov byte [ebp - 4], 0xd
cmp dword [esi + 0x14], 0x10
jb 0x418645
mov edx, dword [esi]
jmp 0x418647
mov edx, esi
cmp dword [eax + 0x14], 0x10
jb 0x418651
mov ecx, dword [eax]
jmp 0x418653
mov ecx, eax
mov ebx, dword [eax + 0x10]
mov esi, dword [esi + 0x10]
cmp ebx, esi
mov eax, esi
cmovb eax, ebx
push eax
push edx
push ecx
call fcn.0040b020
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x41867e
cmp esi, ebx
jbe 0x41867a
or edi, 0xffffffff
jmp 0x41867e
sbb edi, edi
neg edi
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x164]
cmp eax, 0x10
jb 0x4186a0
inc eax
lea ecx, [ebp - 0x178]
push eax
push dword [ebp - 0x178]
call fcn.0040b090
mov dword [ebp - 0x164], 0xf
mov dword [ebp - 0x168], 0
mov byte [ebp - 0x178], 0
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x450]
test eax, eax
je 0x41872f
push dword [ebp - 0x440]
lea ecx, [ebp - 0x450]
push ecx
push dword [ebp - 0x44c]
push eax
call fcn.00405980
mov ecx, dword [ebp - 0x448]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x450]
add esp, 0x10
sub ecx, esi
imul ecx
lea ecx, [ebp - 0x450]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.0040b140
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x14c]
cmp eax, 0x10
jb 0x418751
inc eax
lea ecx, [ebp - 0x160]
push eax
push dword [ebp - 0x160]
call fcn.0040b090
mov dword [ebp - 0x14c], 0xf
mov dword [ebp - 0x150], 0
mov byte [ebp - 0x160], 0
test edi, edi
jne 0x418fac
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
cmp word [ebp - 0x410], ax
jne 0x418797
xor ecx, ecx
jmp 0x4187af
lea ecx, [ebp - 0x410]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4187a0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040ae40
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x43c]
call fcn.0049cad0
mov edi, dword [ebp - 0x43c]
mov esi, eax
cmp esi, edi
je 0x41880b
cmp dword [esi + 0x24], 8
jb 0x4187e9
mov edx, dword [esi + 0x10]
jmp 0x4187ec
lea edx, [esi + 0x10]
push dword [esi + 0x20]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edx
cmovae eax, dword [ebp - 0x28]
push dword [ebp - 0x18]
push eax
call fcn.00420c60
add esp, 0x10
test eax, eax
jns 0x41880d
mov esi, edi
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x418826
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040b0e0
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp esi, dword [ebp - 0x43c]
jne 0x418e5f
push 0xa
mov dword [ebp - 0x78], eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x74], eax
push str._appName
mov dword [ebp - 0x74], 0xf
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x88], al
call fcn.0040ac20
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00415b20
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x70]
push 0xe
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
push str._processName
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x70], 0
call fcn.0040ac20
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x58]
push 0x13
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
push str.Update.ForceQuitMsg
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
call fcn.0040ac20
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x130]
mov ebx, dword [ebp - 0x45c]
mov ecx, ebx
push eax
call fcn.0041b9f0
mov esi, eax
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.0047f0d0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x88]
push esi
push ecx
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.00499790
add esp, 0x20
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x134]
cmp eax, 0x10
jb 0x418961
inc eax
lea ecx, [ebp - 0x148]
push eax
push dword [ebp - 0x148]
call fcn.0040b090
mov dword [ebp - 0x134], 0xf
mov dword [ebp - 0x138], 0
mov byte [ebp - 0x148], 0
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x11c]
cmp eax, 0x10
jb 0x41899e
inc eax
lea ecx, [ebp - 0x130]
push eax
push dword [ebp - 0x130]
call fcn.0040b090
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x4189d2
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.0040b090
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x5c]
cmp eax, 0x10
jb 0x4189fd
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.0040b090
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x70], 0
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0xd4]
cmp eax, 8
jb 0x418a31
inc eax
lea ecx, [ebp - 0xe8]
push eax
push dword [ebp - 0xe8]
call fcn.0040b0e0
xor eax, eax
mov dword [ebp - 0xd4], 7
mov dword [ebp - 0xd8], 0
mov word [ebp - 0xe8], ax
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x74]
cmp eax, 0x10
jb 0x418a6d
inc eax
lea ecx, [ebp - 0x88]
push eax
push dword [ebp - 0x88]
call fcn.0040b090
push 0xa
mov dword [ebp - 0xc0], 0
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xbc], 0
push str._appName
mov dword [ebp - 0x74], 0xf
mov dword [ebp - 0x78], 0
mov byte [ebp - 0x88], 0
mov dword [ebp - 0xbc], 0xf
mov dword [ebp - 0xc0], 0
mov byte [ebp - 0xd0], 0
call fcn.0040ac20
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x40]
call fcn.00415b20
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xb8]
push 0xe
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
push str._processName
mov dword [ebp - 0xa4], 0xf
mov dword [ebp - 0xa8], 0
mov byte [ebp - 0xb8], 0
call fcn.0040ac20
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xa0]
push 0x15
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
push str.Update.ForceQuitTitle
mov dword [ebp - 0x8c], 0xf
mov dword [ebp - 0x90], 0
mov byte [ebp - 0xa0], 0
call fcn.0040ac20
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x100]
push eax
mov ecx, ebx
call fcn.0041b9f0
mov esi, eax
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0047f0d0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xd0]
push esi
push ecx
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.00499790
add esp, 0x20
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x104]
cmp eax, 0x10
jb 0x418bd4
inc eax
lea ecx, [ebp - 0x118]
push eax
push dword [ebp - 0x118]
call fcn.0040b090
mov dword [ebp - 0x104], 0xf
mov dword [ebp - 0x108], 0
mov byte [ebp - 0x118], 0
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0xec]
cmp eax, 0x10
jb 0x418c11
inc eax
lea ecx, [ebp - 0x100]
push eax
push dword [ebp - 0x100]
call fcn.0040b090
mov dword [ebp - 0xec], 0xf
mov dword [ebp - 0xf0], 0
mov byte [ebp - 0x100], 0
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x8c]
cmp eax, 0x10
jb 0x418c4e
inc eax
lea ecx, [ebp - 0xa0]
push eax
push dword [ebp - 0xa0]
call fcn.0040b090
mov dword [ebp - 0x8c], 0xf
mov dword [ebp - 0x90], 0
mov byte [ebp - 0xa0], 0
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0xa4]
cmp eax, 0x10
jb 0x418c8b
inc eax
lea ecx, [ebp - 0xb8]
push eax
push dword [ebp - 0xb8]
call fcn.0040b090
mov dword [ebp - 0xa4], 0xf
mov dword [ebp - 0xa8], 0
mov byte [ebp - 0xb8], 0
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x418cbf
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.0040b0e0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0xbc]
cmp eax, 0x10
jb 0x418cf5
inc eax
lea ecx, [ebp - 0xd0]
push eax
push dword [ebp - 0xd0]
call fcn.0040b090
cmp dword [ebp - 0x17c], 8
lea ecx, [ebp - 0x190]
push 0x2710
cmovae ecx, dword [ebp - 0x190]
lea eax, [ebp - 0x1a8]
cmp dword [ebp - 0x194], 8
push 0
cmovae eax, dword [ebp - 0x1a8]
push 0x34
push ecx
push eax
push 0
mov dword [ebp - 0xbc], 0xf
mov dword [ebp - 0xc0], 0
mov byte [ebp - 0xd0], 0
call fcn.00499d50
add esp, 0x18
cmp eax, 6
je 0x418d5d
cmp eax, 0x7d00
jne 0x41904a
lea eax, [ebp - 0x1f0]
mov ecx, ebx
push eax
call fcn.00408540
mov edi, eax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x508]
push 0
push 2
push str.bool___thiscall_AppUpdateManager::AskClose_void_
push 0x6d
push str.D:jenkinsworkspacemicroclient_buildlauncherAppUpdateManager.cpp
push 0x80
call fcn.00416340
mov byte [ebp - 4], 0x2b
push str.app.
push dword [0x608004]
push 1
push eax
call fcn.0048d730
add esp, 0xc
mov ecx, eax
call fcn.00425140
mov esi, eax
cmp byte [esi + 0x20], 0
je 0x418dc3
push edi
lea ecx, [esi + 0x24]
call fcn.0040e8b0
push str.user_agree_to_quit
push 0x59aef0
mov ecx, esi
call fcn.00425140
mov ecx, eax
call fcn.00425140
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x508]
call fcn.0040e200
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x1f0]
call fcn.00406cc0
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x1d8]
call fcn.00415b20
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0x1d8]
push eax
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00415160
mov eax, dword [ebp - 0x490]
mov byte [eax + 0x28], 1
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x1d8]
call fcn.00406d40
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x190]
call fcn.00406d40
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1a8]
call fcn.00406d40
push dword [ebp - 0x42c]
call fcn.00498680
add esp, 4
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x460], eax
lea ecx, [ebp - 0x488]
push 0
lea eax, [ebp - 0x1c0]
push eax
call fcn.004131f0
mov ebx, eax
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x208]
mov ecx, dword [ebp - 0x45c]
push eax
call fcn.00408540
mov edi, eax
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x4cc]
push 0
push 2
push str.bool___thiscall_AppUpdateManager::AskClose_void_
push 0x7b
push str.D:jenkinsworkspacemicroclient_buildlauncherAppUpdateManager.cpp
push 0x80
call fcn.00416340
mov byte [ebp - 4], 0x31
push str.app.
push dword [0x608004]
push 1
push eax
call fcn.0048d730
add esp, 0xc
mov ecx, eax
call fcn.00425140
mov esi, eax
cmp byte [esi + 0x20], 0
je 0x418f12
push edi
lea ecx, [esi + 0x24]
call fcn.0040e8b0
push str.closing_process
push 0x59aef0
mov ecx, esi
call fcn.00425140
mov ecx, eax
call fcn.00425140
mov esi, eax
cmp byte [esi + 0x20], 0
je 0x418f3b
push ebx
lea ecx, [esi + 0x24]
call fcn.0040e8b0
lea eax, [ebp - 0x460]
mov ecx, esi
push eax
push str.__result:
lea eax, [ebp - 0x42c]
push eax
push str.__with_process_id
call fcn.00425140
mov ecx, eax
call fcn.00413a30
mov ecx, eax
call fcn.00425140
mov ecx, eax
call fcn.004139e0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x4cc]
call fcn.0040e200
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x208]
call fcn.00406cc0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1c0]
call fcn.00406cc0
push dword [ebp - 0x458]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x418fb2
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x488]
call fcn.004073b0
mov ebx, dword [ebp - 0x440]
lea eax, [ebp - 0x434]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x4185b3
push ebx
call esi
mov bl, 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x474]
call fcn.004073b0
mov dword [ebp - 4], 0x33
lea ecx, [ebp - 0x43c]
mov eax, dword [ebp - 0x43c]
push eax
push dword [eax]
lea eax, [ebp - 0x440]
push eax
call fcn.00421d80
mov dword [ebp - 4], 0xffffffff
push 0x2c
push 1
push dword [ebp - 0x43c]
call fcn.00420090
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052b33d
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c0]
mov ecx, ebx
push eax
call fcn.00408540
mov edi, eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x4cc]
push 0
push 2
push str.bool___thiscall_AppUpdateManager::AskClose_void_
push 0x72
push str.D:jenkinsworkspacemicroclient_buildlauncherAppUpdateManager.cpp
push 0x80
call fcn.00416340
mov byte [ebp - 4], 0x2e
push str.app.
push dword [0x608004]
push 1
push eax
call fcn.0048d730
add esp, 0xc
mov ecx, eax
call fcn.00425140
mov esi, eax
cmp byte [esi + 0x20], 0
je 0x4190b0
push edi
lea ecx, [esi + 0x24]
call fcn.0040e8b0
push str.user_choose_not_to_quit
push 0x59aef0
mov ecx, esi
call fcn.00425140
mov ecx, eax
call fcn.00425140
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x4cc]
call fcn.0040e200
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x1c0]
call fcn.00406cc0
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x190]
call fcn.00406d40
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1a8]
call fcn.00406d40
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x488]
call fcn.004073b0
xor bl, bl
jmp 0x418fe2