Function at 0x42f0ca
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x51c
mov eax, 0x52bd8b
call fcn.004e41bf
mov bl, dl
mov byte [ebp - 0x4d5], bl
mov byte [ebp - 0x4d6], cl
xor edi, edi
mov dword [ebp - 0x4dc], edi
mov esi, 0x55bd28
mov dword [ebp - 4], edi
push esi
call fcn.00401903
pop ecx
push eax
push ecx
push esi
lea ecx, [ebp + 8]
call fcn.0042625d
push 0xffffffffffffffff
inc eax
lea ecx, [ebp + 8]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00402110
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x260]
cmp dword [ebp - 0x24c], 8
lea edx, [ebp - 0x260]
mov eax, dword [ebp - 0x250]
cmovae ecx, dword [ebp - 0x260]
cmovae edx, dword [ebp - 0x260]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x260]
cmovae ecx, dword [ebp - 0x260]
push eax
push ecx
lea ecx, [ebp - 0x4e4]
call fcn.0042732a
add esp, 0xc
push 4
pop esi
test bl, bl
je 0x42f1b2
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x260]
add eax, 0xfffffffd
push eax
push edi
lea eax, [ebp - 0x2a8]
push eax
call fcn.00402110
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x230]
push 0x560b38
mov edx, eax
mov dword [ebp - 0x4dc], 1
call fcn.00427191
pop ecx
push 3
pop ebx
jmp 0x42f1c4
push 0x55695c
lea ecx, [ebp - 0x248]
call fcn.0040996a
mov ebx, esi
push eax
lea ecx, [ebp - 0x290]
call fcn.0040f26d
mov dword [ebp - 4], esi
test bl, 4
je 0x42f1e9
push edi
push 1
lea ecx, [ebp - 0x248]
and ebx, 0xfffffffb
call fcn.004021c6
test bl, 2
je 0x42f1ff
push edi
push 1
lea ecx, [ebp - 0x230]
and ebx, 0xfffffffd
call fcn.004021c6
mov byte [ebp - 4], 6
test bl, 1
je 0x42f216
push edi
push 1
lea ecx, [ebp - 0x2a8]
call fcn.004021c6
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x278]
call fcn.0040219e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x278]
cmp dword [ebp - 0x264], 8
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 0x268]
cmovae ecx, dword [ebp - 0x278]
cmovae edx, dword [ebp - 0x278]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x278]
cmovae ecx, dword [ebp - 0x278]
push eax
push ecx
lea ecx, [ebp - 0x4dc]
call fcn.0042732a
add esp, 0xc
or esi, 0xffffffff
mov dword [ebp - 0x4e0], esi
call sub.KERNEL32.DLL_GetCurrentProcessId
push edi
mov ebx, eax
push 2
mov dword [ebp - 0x4e4], ebx
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x4d4], 0x22c
lea eax, [ebp - 0x4d4]
mov dword [ebp - 0x4dc], edi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x42f710
lea eax, [ebp - 0x4d4]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
je 0x42f713
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040996a
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 0x238]
cmovae ecx, dword [ebp - 0x248]
cmovae edx, dword [ebp - 0x248]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x248]
cmovae ecx, dword [ebp - 0x248]
push eax
push ecx
lea ecx, [ebp - 0x4ec]
call fcn.0042732a
add esp, 0xc
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x260]
call fcn.004273f5
test al, al
jne 0x42f366
cmp byte [ebp - 0x4d5], al
je 0x42f6b8
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x290]
call fcn.004273f5
test al, al
je 0x42f6b8
push ecx
push ecx
push str.int___cdecl_FuntionImpl::FindProcessByFullPath_class_std::basic_string_wchar_t_struct_std::char_traits_wchar_t__class_std::allocator_wchar_t____bool_bool_
push 0x6bc
push str........._srcFuntionImpl.cpp
push 0x80
lea ecx, [ebp - 0x528]
call fcn.004064ae
push str.default
push 1
push eax
mov byte [ebp - 4], 9
call fcn.00406541
mov esi, eax
add esp, 0xc
cmp byte [esi + 0x1c], 0
je 0x42f3c4
push str._Find_proc:
lea ecx, [esi + 0x20]
call fcn.004063d6
cmp byte [esi + 0x1c], 0
je 0x42f3c4
push dword [ebp - 0x4cc]
lea ecx, [esi + 0x20]
call fcn.00406345
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x528]
mov dword [ebp - method.el::base::Writer.virtual_0], vtable.el::base::Writer.0
call fcn.004067a0
lea ecx, [ebp - 0x4fc]
call fcn.00409800
mov byte [ebp - 4], 8
cmp ebx, dword [ebp - 0x4cc]
je 0x42f6b8
push dword [ebp - 0x4cc]
xor edx, edx
push edx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42f6b2
push 0x208
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004fce20
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push edi
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov dword [ebp - 0x4e8], eax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x218]
push eax
call fcn.0040996a
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
lea edx, [ebp - 0x230]
mov eax, dword [ebp - 0x220]
cmovae ecx, dword [ebp - 0x230]
cmovae edx, dword [ebp - 0x230]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
push eax
push ecx
lea ecx, [ebp - 0x4f0]
call fcn.0042732a
lea edi, [ebp - 0x218]
add esp, 0xc
lea ecx, [edi + 2]
xor edx, edx
mov ax, word [edi]
add edi, 2
cmp ax, dx
jne 0x42f4b1
push ecx
push ecx
push str.int___cdecl_FuntionImpl::FindProcessByFullPath_class_std::basic_string_wchar_t_struct_std::char_traits_wchar_t__class_std::allocator_wchar_t____bool_bool_
push 0x6c6
push str........._srcFuntionImpl.cpp
sub edi, ecx
lea ecx, [ebp - 0x528]
push 0x80
sar edi, 1
call fcn.004064ae
push str.default
push 1
push eax
mov byte [ebp - 4], 0xc
call fcn.00406541
mov esi, eax
add esp, 0xc
cmp byte [esi + 0x1c], 0
je 0x42f540
push str._Get_proc_info:
lea ecx, [esi + 0x20]
call fcn.004063d6
cmp byte [esi + 0x1c], 0
je 0x42f540
push dword [ebp - 0x4e8]
lea ecx, [esi + 0x20]
call fcn.00406345
cmp byte [esi + 0x1c], 0
je 0x42f540
push 0x559e7c
lea ecx, [esi + 0x20]
call fcn.004063d6
cmp byte [esi + 0x1c], 0
je 0x42f540
push edi
lea ecx, [esi + 0x20]
call fcn.00406345
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x528]
mov dword [ebp - method.el::base::Writer.virtual_0], vtable.el::base::Writer.0
call fcn.004067a0
lea ecx, [ebp - 0x4fc]
call fcn.00409800
cmp dword [ebp - 0x4e8], 0
mov byte [ebp - 4], 0xb
je 0x42f69c
lea edx, [ebp - 0x278]
lea ecx, [ebp - 0x230]
call fcn.004273f5
test al, al
jne 0x42f5bd
cmp byte [ebp - 0x4d5], al
je 0x42f69c
mov esi, str..tmp
push esi
call fcn.00401903
pop ecx
push eax
xor edi, edi
lea ecx, [ebp - 0x230]
push edi
push esi
call fcn.0040221d
cmp eax, 0xffffffff
je 0x42f69c
jmp 0x42f5bf
xor edi, edi
cmp byte [ebp - 0x4d6], 0
mov esi, dword [ebp - 0x4cc]
mov dword [ebp - 0x4e0], esi
je 0x42f693
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push ecx
push ecx
push str.int___cdecl_FuntionImpl::FindProcessByFullPath_class_std::basic_string_wchar_t_struct_std::char_traits_wchar_t__class_std::allocator_wchar_t____bool_bool_
push 0x6d0
push str........._srcFuntionImpl.cpp
push 0x80
lea ecx, [ebp - 0x528]
mov ebx, eax
call fcn.004064ae
push str.default
push 1
push eax
mov byte [ebp - 4], 0xe
call fcn.00406541
mov esi, eax
add esp, 0xc
cmp byte [esi + 0x1c], 0
je 0x42f665
push str._Kill_proc:
lea ecx, [esi + 0x20]
call fcn.004063d6
cmp byte [esi + 0x1c], 0
je 0x42f665
push edi
lea ecx, [esi + 0x20]
call fcn.004062fa
cmp byte [esi + 0x1c], 0
je 0x42f665
push 0x559e7c
lea ecx, [esi + 0x20]
call fcn.004063d6
cmp byte [esi + 0x1c], 0
je 0x42f665
push ebx
lea ecx, [esi + 0x20]
call fcn.00406345
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x528]
mov dword [ebp - method.el::base::Writer.virtual_0], vtable.el::base::Writer.0
call fcn.004067a0
lea ecx, [ebp - 0x4fc]
call fcn.00409800
mov esi, dword [ebp - 0x4e0]
mov byte [ebp - 4], 0xb
cmp byte [ebp - 0x4d5], 0
je 0x42f6ea
xor eax, eax
lea ecx, [ebp - 0x230]
push eax
push 1
call fcn.004021c6
mov edi, dword [ebp - 0x4dc]
mov ebx, dword [ebp - 0x4e4]
xor eax, eax
mov byte [ebp - 4], 7
push eax
push 1
lea ecx, [ebp - 0x248]
call fcn.004021c6
lea eax, [ebp - 0x4d4]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x42f2ce
mov esi, dword [ebp - 0x4e0]
jmp 0x42f713
xor ebx, ebx
lea ecx, [ebp - 0x230]
push ebx
push 1
call fcn.004021c6
push ebx
push 1
lea ecx, [ebp - 0x248]
call fcn.004021c6
mov edi, dword [ebp - 0x4dc]
jmp 0x42f713
push 0xfffffffffffffffe
pop esi
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edi, edi
lea ecx, [ebp - 0x278]
push edi
push 1
call fcn.004021c6
push edi
push 1
lea ecx, [ebp - 0x290]
call fcn.004021c6
push edi
push 1
lea ecx, [ebp - 0x260]
call fcn.004021c6
push edi
push 1
lea ecx, [ebp + 8]
call fcn.004021c6
mov eax, esi
call fcn.004e4169
ret