Function at 0x402890
Capabilities:
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ccba
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x457078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1a8], ecx
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 4], 0
call fcn.0040ab80
mov byte [ebp - 4], 1
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4028eb
push 0x80004003
call fcn.0043bc30
mov eax, dword [esi]
lea ecx, [ebp - 0x19c]
push ecx
push esi
mov dword [ebp - 0x19c], 0
call dword [eax + 0x20]
test eax, eax
jns 0x402912
push 0x449024
push esi
push eax
call fcn.0043bc50
movsx eax, word [ebp - 0x19c]
push eax
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.0040ac90
push ecx
call fcn.0040acb0
call fcn.0040ad00
mov edi, eax
xor ebx, ebx
test edi, edi
jle 0x402ca9
lea ecx, [ecx]
mov esi, dword [ebp + 8]
test esi, esi
je 0x4028e1
mov eax, dword [esi]
lea ecx, [ebp - 0x19c]
push ecx
push esi
mov dword [ebp - 0x19c], 0
call dword [eax + 0x20]
test eax, eax
jns 0x40296e
push 0x449024
push esi
push eax
call fcn.0043bc50
push ebx
lea ecx, [ebp - 0x1bc]
call fcn.0040ad50
movsx ecx, word [ebp - 0x19c]
cmp eax, ecx
jne 0x4029c6
push 0x104
lea eax, [ebp - 0x178]
mov word [ebp - 0x178], 0
push eax
push ebx
lea ecx, [ebp - 0x1bc]
call fcn.0040ad20
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, 2
jle 0x4029c6
cmp byte [ebp + eax - 0x17a], 0x40
jne 0x4029c6
cmp byte [ebp + eax - 0x179], 0x40
je 0x4029d4
inc ebx
cmp ebx, edi
jl 0x402940
jmp 0x402ca9
push str.void___cdecl_RunQBForVersion_class__com_ptr_t_class__com_IIID_struct_IInstalledInstanceInfo_struct___s_GUID_const__GUID_6fba4aed_1e0f_42c8_b564_dc42e218d976____enum_QS_QBSKUMatch__
push str.RunQBForVersion
push 0x185
push str.srcQbwExe.cpp
push 6
push 0
call fcn.00411990
push eax
lea ecx, [ebp - 0x198]
call fcn.004112d0
push str.qbwexe.cpp:_Found_a_background_instance_QB
push eax
mov byte [ebp - 4], 2
call fcn.00411690
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18c]
call fcn.00413b50
push 0
push 0
push 0x4bd
push ebx
lea ecx, [ebp - 0x1bc]
call fcn.0040ad20
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
and eax, 0x3f
lea ecx, [ebp - 0x19c]
push 0x448f8e
mov dword [ebp - 0x1c0], eax
call fcn.00409a40
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x402a68
push 0x80004003
call fcn.0043bc30
mov eax, dword [ecx]
lea edx, [ebp - 0x1ac]
push edx
push ecx
call dword [eax + 0x1c]
test eax, eax
js 0x402adc
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1a4]
call fcn.0040a840
mov byte [ebp - 4], 4
mov edi, dword [ebp - 0x19c]
mov esi, dword [ebp - 0x1a4]
cmp edi, esi
je 0x402abf
lea ecx, [ebp - 0x19c]
call fcn.0040aa60
test esi, esi
je 0x402ab7
test byte [esi - 0xe], 8
jne 0x402ab7
inc word [esi - 0x10]
mov edi, esi
mov dword [ebp - 0x19c], edi
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 3
call fcn.0040aa60
push dword [ebp - 0x1ac]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x402ae2
mov edi, dword [ebp - 0x19c]
lea eax, [ebp - 0x74]
push edi
push eax
call dword [sym.imp.MSVCR120.dll_strcpy]
add esp, 8
lea eax, [ebp - 0x74]
lea ecx, [ebp - 0x190]
xor edi, edi
push eax
call fcn.00408ea0
mov esi, dword [0x45b8bc]
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x1a4]
mov ecx, 0x45b8bc
push eax
call fcn.00408e00
cmp dword [eax], esi
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
setne al
cmp dword [ebp - 0x17c], 0x10
mov byte [ebp - 0x19d], al
jb 0x402b4a
push dword [ebp - 0x190]
call esi
mov al, byte [ebp - 0x19d]
add esp, 4
test al, al
je 0x402b8c
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x190]
call fcn.00408ea0
lea eax, [ebp - 0x190]
mov byte [ebp - 4], 5
push eax
mov ecx, 0x45b8bc
call fcn.00408d50
mov edi, dword [eax]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x17c], 0x10
jb 0x402b8c
push dword [ebp - 0x190]
call esi
add esp, 4
cmp dword [ebp - 0x1c0], edi
jne 0x402bc2
mov eax, dword [0x45b8a8]
lea ecx, [ebp - 0x1bc]
push ebx
mov esi, dword [eax + 8]
call fcn.0040ad20
mov edx, esi
mov ecx, eax
call fcn.004027b0
mov eax, dword [ebp - 0x1a8]
mov dword [eax], 0
jmp 0x402c9a
push str.void___cdecl_RunQBForVersion_class__com_ptr_t_class__com_IIID_struct_IInstalledInstanceInfo_struct___s_GUID_const__GUID_6fba4aed_1e0f_42c8_b564_dc42e218d976____enum_QS_QBSKUMatch__
push str.RunQBForVersion
push 0x1af
push str.srcQbwExe.cpp
push 6
push 0
call fcn.00411990
push eax
lea ecx, [ebp - 0x198]
call fcn.004112d0
push str.qbwexe.cpp:_Terminating_the_background_QB
push eax
mov byte [ebp - 4], 6
call fcn.00411690
add esp, 8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18c]
call fcn.00413b50
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x1a4], 0
push eax
push ebx
lea ecx, [ebp - 0x1bc]
call fcn.0040ad20
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x1a4]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push 0
push 0x4be
push ebx
lea ecx, [ebp - 0x1bc]
mov esi, eax
call fcn.0040ad20
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x2710
push esi
call edi
cmp eax, 0x102
jne 0x402c87
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1a8]
mov dword [eax], 1
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 1
call fcn.0040aa60
lea ecx, [ebp - 0x1bc]
call fcn.0040abc0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
test eax, eax
je 0x402cc8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bfe6
mov esp, ebp
pop ebp
ret