Function at 0x40a230
Capabilities:
Enumerate threads
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4d7200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
mov ebx, ecx
push 0
push 0
push 0
push 0
call edi
mov esi, eax
test esi, esi
je 0x40a297
nop dword [eax + eax]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x40a288
cmp dword [ebp - 8], ebx
jne 0x40a288
push 0
push 0
push 2
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push esi
push 0
call edi
mov esi, eax
test esi, esi
jne 0x40a260
mov ecx, dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp ebx, 5
jae 0x40a2aa
cmp ebx, 4
sete al
jmp 0x40a2e9
push ebx
push 0
push 0x100000
call ecx
mov esi, eax
test esi, esi
je 0x40a58d
cmp esi, 0xffffffff
je 0x40a58d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
push esi
sete byte [ebp - 0x25]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x25]
mov ecx, dword [sym.imp.KERNEL32.dll_OpenProcess]
test al, al
je 0x40a58d
push ebx
or edi, 0xffffffff
push 0
push 1
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x2c], edi
call ecx
mov dword [ebp - 0x30], 0
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x40a3a7
cmp esi, 0xffffffff
je 0x40a3ad
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0x14
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov dword [ebp - 0x38], esi
cmp ebx, 5
jae 0x40a34b
cmp ebx, 4
sete al
jmp 0x40a383
push ebx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x40a3a3
cmp eax, 0xffffffff
je 0x40a3a3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x34]
cmp eax, 0x102
sete byte [ebp - 0x25]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x25]
test al, al
je 0x40a3a3
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x1e
jge 0x40a3ad
push ebx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x40a308
mov bl, 1
jmp 0x40a3c6
or esi, 0xffffffff
mov dword [ebp - 0x38], esi
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x40a409
mov dword [ebp - 0x2c], 0xffffffff
xor bl, bl
mov eax, dword [ebp - 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x40a3db
test eax, eax
je 0x40a3db
push eax
call edi
mov eax, dword [ebp - 0x3c]
cmp eax, 0xffffffff
je 0x40a3ea
test eax, eax
je 0x40a3ea
push eax
call edi
cmp esi, 0xffffffff
je 0x40a3f6
test esi, esi
je 0x40a3f6
push esi
call edi
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f05
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x40a3c4
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xc], 0
xorps xmm0, xmm0
mov dword [ebp - 0x2c], eax
push ecx
push eax
movups xmmword [ebp - 0x24], xmm0
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x40a496
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x2c], esi
nop dword [eax]
cmp dword [ebp - 0x18], ebx
jne 0x40a481
push dword [ebp - 0x1c]
push 0
push 3
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x34], eax
cmp edi, 0xffffffff
je 0x40a468
test edi, edi
je 0x40a468
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x34]
mov edi, eax
test eax, eax
jne 0x40a473
or edi, 0xffffffff
jmp 0x40a481
cmp edi, 0xffffffff
je 0x40a481
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x40a440
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edi
cmp ebx, 5
jae 0x40a4a3
cmp ebx, 4
sete al
jmp 0x40a4e0
push ebx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40a3a3
cmp edi, 0xffffffff
je 0x40a3a3
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
push edi
sete byte [ebp - 0x25]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x25]
test al, al
je 0x40a3a3
mov dword [ebp - 0x30], 0
nop
push ebx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp esi, 0xffffffff
je 0x40a50d
test esi, esi
je 0x40a50d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40a539
mov esi, edi
cmp edi, 0xffffffff
je 0x40a53c
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0x14
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x1e
jge 0x40a53c
jmp 0x40a4f0
or esi, 0xffffffff
cmp ebx, 5
jae 0x40a54c
cmp ebx, 4
setne bl
jmp 0x40a3c6
push ebx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40a3a3
cmp edi, 0xffffffff
je 0x40a3a3
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x102
setne bl
jmp 0x40a3c6
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f05
mov esp, ebp
pop ebp
ret