Function at 0x401d40
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x380
call dword [0x41959c]
mov dword [esp + 4], 0x418000
mov dword [esp], eax
call dword [0x4195a8]
lea eax, [ebp - 0x214]
shr eax, 0x10
sub esp, 8
mov dword [ebp - 0x374], eax
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0x36c], eax
test eax, eax
je 0x402080
lea ebx, [ebp - 0x238]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [ebp - 0x238], 0x22c
call sym._Process32FirstW_8
sub esp, 8
test eax, eax
je 0x4020e0
mov dword [ebp - 0x370], 0
jmp 0x401e39
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernelbase.dll_OpenProcess]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x401e1c
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_TerminateProcess]
sub esp, 8
cmp eax, 1
sbb dword [ebp - 0x370], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x36c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._Process32NextW_8
sub esp, 8
test eax, eax
je 0x402060
mov eax, dword [ebp - 0x230]
mov edx, dword fs:[0x18]
cmp dword [edx + 0x20], eax
je 0x401e1c
cmp eax, dword [section..bss]
je 0x401e1c
test byte [global___dbch.0], 8
je 0x401dd0
mov eax, dword [ebp - 0x374]
test eax, eax
je 0x4020a0
lea eax, [ebp - 0x214]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edi, eax
sub esp, 8
mov eax, 0x40c00d
test edi, edi
jne 0x401f52
cmp word [ebp - 0x214], 0
je 0x401eac
add edi, 1
cmp word [ebx + edi*2 + 0x24], 0
jne 0x401ea1
mov eax, 0x224c
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x362]
mov word [ebp - 0x364], ax
lea esi, [edi - 1]
mov dword [ebp - 0x368], ecx
test edi, edi
jle 0x401f27
lea eax, [ebp - 0x242]
cmp edx, eax
ja 0x401f27
add dword [ebp - 0x368], 2
mov eax, dword [ebp - 0x368]
movzx eax, word [eax - 2]
cmp ax, 0xd
je 0x401fb3
ja 0x401f90
cmp ax, 9
je 0x402030
cmp ax, 0xa
jne 0x401fd0
mov eax, 0x6e5c
add edx, 2
mov edi, esi
mov word [edx - 2], ax
nop
lea esi, [edi - 1]
test edi, edi
jg 0x401ed1
mov byte [edx], 0x22
lea eax, [edx + 1]
test esi, esi
jle 0x401f41
mov esi, 0x2e2e
mov byte [edx + 3], 0x2e
lea eax, [edx + 4]
mov word [edx + 1], si
mov byte [eax], 0
lea eax, [ebp - 0x364]
mov dword [esp], eax
call dbg.__wine_dbg_strdup
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x230]
mov dword [esp + 0xc], str.killing_process__04lx__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], global___func__.6
mov dword [esp + 4], global___dbch.0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.7
mov eax, dword [ebp - 0x230]
jmp 0x401dd0
cmp ax, 0x22
je 0x402043
cmp ax, 0x5c
jne 0x401fd0
mov edi, 0x5c5c
add edx, 2
mov word [edx - 2], di
mov edi, esi
jmp 0x401f20
mov eax, 0x725c
add edx, 2
mov edi, esi
mov word [edx - 2], ax
jmp 0x401f20
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x4020d0
mov edi, eax
mov byte [edx], 0x5c
add edx, 5
shr di, 0xc
movzx edi, di
movzx ecx, byte [edi + str.0123456789abcdefshutdown_one_desktop]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [edx - 4], cl
movzx ecx, byte [edi + str.0123456789abcdefshutdown_one_desktop]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdefshutdown_one_desktop]
and edi, 0xf
mov byte [edx - 3], cl
movzx ecx, byte [edi + str.0123456789abcdefshutdown_one_desktop]
mov byte [edx - 1], al
mov edi, esi
mov byte [edx - 2], cl
jmp 0x401f20
mov eax, 0x745c
add edx, 2
mov edi, esi
mov word [edx - 2], ax
jmp 0x401f20
mov eax, 0x225c
add edx, 2
mov edi, esi
mov word [edx - 2], ax
jmp 0x401f20
mov eax, dword [ebp - 0x36c]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_CloseHandle]
mov ecx, dword [ebp - 0x370]
sub esp, 4
test ecx, ecx
jne 0x401d75
mov eax, dword [section..bss]
test eax, eax
je 0x402090
mov edx, dword [ebp + 8]
test edx, edx
jne 0x4020f4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x214]
mov dword [esp], section..rdata
mov dword [ebp - 0x368], eax
movzx eax, word [ebp - 0x368]
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.4
jmp 0x401f52
mov byte [edx], al
mov edi, esi
add edx, 1
jmp 0x401f20
mov eax, dword [ebp - 0x36c]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
jmp 0x402080
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernelbase.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x402090
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_TerminateProcess]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
jmp 0x402090