Function at 0x42f6dc
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x51c
mov eax, 0x52a4e6
call fcn.004e27d2
mov bl, dl
mov byte [ebp - 0x4d5], bl
mov byte [ebp - 0x4d6], cl
xor edi, edi
mov dword [ebp - 0x4dc], edi
mov esi, 0x559cf0
mov dword [ebp - 4], edi
push esi
call fcn.00401963
pop ecx
push eax
push ecx
push esi
lea ecx, [ebp + 8]
call fcn.0042681d
push 0xffffffffffffffff
inc eax
lea ecx, [ebp + 8]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00402170
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x260]
cmp dword [ebp - 0x24c], 8
lea edx, [ebp - 0x260]
mov eax, dword [ebp - 0x250]
cmovae ecx, dword [ebp - 0x260]
cmovae edx, dword [ebp - 0x260]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x260]
cmovae ecx, dword [ebp - 0x260]
push eax
push ecx
lea ecx, [ebp - 0x4e4]
call fcn.004278de
add esp, 0xc
push 4
pop esi
test bl, bl
je 0x42f7c6
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x260]
add eax, 0xfffffffd
push eax
push edi
lea eax, [ebp - 0x2a8]
push eax
call fcn.00402170
push 0x55ec78
push eax
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0x4dc], 1
call fcn.00427751
add esp, 0xc
push 3
pop ebx
jmp 0x42f7d8
push 0x554928
lea ecx, [ebp - 0x248]
call fcn.004099b0
mov ebx, esi
push eax
lea ecx, [ebp - 0x290]
call fcn.0040f2ce
mov dword [ebp - 4], esi
test bl, 4
je 0x42f7fd
push edi
push 1
lea ecx, [ebp - 0x248]
and ebx, 0xfffffffb
call fcn.00402226
test bl, 2
je 0x42f813
push edi
push 1
lea ecx, [ebp - 0x230]
and ebx, 0xfffffffd
call fcn.00402226
mov byte [ebp - 4], 6
test bl, 1
je 0x42f82a
push edi
push 1
lea ecx, [ebp - 0x2a8]
call fcn.00402226
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x278]
call fcn.004021fe
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x278]
cmp dword [ebp - 0x264], 8
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 0x268]
cmovae ecx, dword [ebp - 0x278]
cmovae edx, dword [ebp - 0x278]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x278]
cmovae ecx, dword [ebp - 0x278]
push eax
push ecx
lea ecx, [ebp - 0x4dc]
call fcn.004278de
add esp, 0xc
or esi, 0xffffffff
mov dword [ebp - 0x4e0], esi
call sub.KERNEL32.DLL_GetCurrentProcessId
push edi
mov ebx, eax
push 2
mov dword [ebp - 0x4e4], ebx
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x4d4], 0x22c
lea eax, [ebp - 0x4d4]
mov dword [ebp - 0x4dc], edi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x42fd24
lea eax, [ebp - 0x4d4]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
je 0x42fd27
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x248]
call fcn.004099b0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 0x238]
cmovae ecx, dword [ebp - 0x248]
cmovae edx, dword [ebp - 0x248]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x248]
cmovae ecx, dword [ebp - 0x248]
push eax
push ecx
lea ecx, [ebp - 0x4ec]
call fcn.004278de
add esp, 0xc
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x260]
call fcn.004279aa
test al, al
jne 0x42f97a
cmp byte [ebp - 0x4d5], al
je 0x42fccc
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x290]
call fcn.004279aa
test al, al
je 0x42fccc
push ecx
push ecx
push str.int___cdecl_FuntionImpl::FindProcessByFullPath_class_std::basic_string_wchar_t_struct_std::char_traits_wchar_t__class_std::allocator_wchar_t____bool_bool_
push 0x6b8
push str........._srcFuntionImpl.cpp
push 0x80
lea ecx, [ebp - 0x528]
call fcn.004064f1
push str.default
push 1
push eax
mov byte [ebp - 4], 9
call fcn.00406584
mov esi, eax
add esp, 0xc
cmp byte [esi + 0x1c], 0
je 0x42f9d8
push str._Find_proc:
lea ecx, [esi + 0x20]
call fcn.00406419
cmp byte [esi + 0x1c], 0
je 0x42f9d8
push dword [ebp - 0x4cc]
lea ecx, [esi + 0x20]
call fcn.00406388
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x528]
mov dword [ebp - method.el::base::Writer.virtual_0], vtable.el::base::Writer.0
call fcn.004067e3
lea ecx, [ebp - 0x4fc]
call fcn.00409846
mov byte [ebp - 4], 8
cmp ebx, dword [ebp - 0x4cc]
je 0x42fccc
push dword [ebp - 0x4cc]
xor edx, edx
push edx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42fcc6
push 0x208
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004fb430
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push edi
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov dword [ebp - 0x4e8], eax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x218]
push eax
call fcn.004099b0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
lea edx, [ebp - 0x230]
mov eax, dword [ebp - 0x220]
cmovae ecx, dword [ebp - 0x230]
cmovae edx, dword [ebp - 0x230]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
push eax
push ecx
lea ecx, [ebp - 0x4f0]
call fcn.004278de
lea edi, [ebp - 0x218]
add esp, 0xc
lea ecx, [edi + 2]
xor edx, edx
mov ax, word [edi]
add edi, 2
cmp ax, dx
jne 0x42fac5
push ecx
push ecx
push str.int___cdecl_FuntionImpl::FindProcessByFullPath_class_std::basic_string_wchar_t_struct_std::char_traits_wchar_t__class_std::allocator_wchar_t____bool_bool_
push 0x6c2
push str........._srcFuntionImpl.cpp
sub edi, ecx
lea ecx, [ebp - 0x528]
push 0x80
sar edi, 1
call fcn.004064f1
push str.default
push 1
push eax
mov byte [ebp - 4], 0xc
call fcn.00406584
mov esi, eax
add esp, 0xc
cmp byte [esi + 0x1c], 0
je 0x42fb54
push str._Get_proc_info:
lea ecx, [esi + 0x20]
call fcn.00406419
cmp byte [esi + 0x1c], 0
je 0x42fb54
push dword [ebp - 0x4e8]
lea ecx, [esi + 0x20]
call fcn.00406388
cmp byte [esi + 0x1c], 0
je 0x42fb54
push 0x557e44
lea ecx, [esi + 0x20]
call fcn.00406419
cmp byte [esi + 0x1c], 0
je 0x42fb54
push edi
lea ecx, [esi + 0x20]
call fcn.00406388
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x528]
mov dword [ebp - method.el::base::Writer.virtual_0], vtable.el::base::Writer.0
call fcn.004067e3
lea ecx, [ebp - 0x4fc]
call fcn.00409846
cmp dword [ebp - 0x4e8], 0
mov byte [ebp - 4], 0xb
je 0x42fcb0
lea edx, [ebp - 0x278]
lea ecx, [ebp - 0x230]
call fcn.004279aa
test al, al
jne 0x42fbd1
cmp byte [ebp - 0x4d5], al
je 0x42fcb0
mov esi, str..tmp
push esi
call fcn.00401963
pop ecx
push eax
xor edi, edi
lea ecx, [ebp - 0x230]
push edi
push esi
call fcn.0040227d
cmp eax, 0xffffffff
je 0x42fcb0
jmp 0x42fbd3
xor edi, edi
cmp byte [ebp - 0x4d6], 0
mov esi, dword [ebp - 0x4cc]
mov dword [ebp - 0x4e0], esi
je 0x42fca7
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push ecx
push ecx
push str.int___cdecl_FuntionImpl::FindProcessByFullPath_class_std::basic_string_wchar_t_struct_std::char_traits_wchar_t__class_std::allocator_wchar_t____bool_bool_
push 0x6cc
push str........._srcFuntionImpl.cpp
push 0x80
lea ecx, [ebp - 0x528]
mov ebx, eax
call fcn.004064f1
push str.default
push 1
push eax
mov byte [ebp - 4], 0xe
call fcn.00406584
mov esi, eax
add esp, 0xc
cmp byte [esi + 0x1c], 0
je 0x42fc79
push str._Kill_proc:
lea ecx, [esi + 0x20]
call fcn.00406419
cmp byte [esi + 0x1c], 0
je 0x42fc79
push edi
lea ecx, [esi + 0x20]
call fcn.0040633d
cmp byte [esi + 0x1c], 0
je 0x42fc79
push 0x557e44
lea ecx, [esi + 0x20]
call fcn.00406419
cmp byte [esi + 0x1c], 0
je 0x42fc79
push ebx
lea ecx, [esi + 0x20]
call fcn.00406388
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x528]
mov dword [ebp - method.el::base::Writer.virtual_0], vtable.el::base::Writer.0
call fcn.004067e3
lea ecx, [ebp - 0x4fc]
call fcn.00409846
mov esi, dword [ebp - 0x4e0]
mov byte [ebp - 4], 0xb
cmp byte [ebp - 0x4d5], 0
je 0x42fcfe
xor eax, eax
lea ecx, [ebp - 0x230]
push eax
push 1
call fcn.00402226
mov edi, dword [ebp - 0x4dc]
mov ebx, dword [ebp - 0x4e4]
xor eax, eax
mov byte [ebp - 4], 7
push eax
push 1
lea ecx, [ebp - 0x248]
call fcn.00402226
lea eax, [ebp - 0x4d4]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x42f8e2
mov esi, dword [ebp - 0x4e0]
jmp 0x42fd27
xor ebx, ebx
lea ecx, [ebp - 0x230]
push ebx
push 1
call fcn.00402226
push ebx
push 1
lea ecx, [ebp - 0x248]
call fcn.00402226
mov edi, dword [ebp - 0x4dc]
jmp 0x42fd27
push 0xfffffffffffffffe
pop esi
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edi, edi
lea ecx, [ebp - 0x278]
push edi
push 1
call fcn.00402226
push edi
push 1
lea ecx, [ebp - 0x290]
call fcn.00402226
push edi
push 1
lea ecx, [ebp - 0x260]
call fcn.00402226
push edi
push 1
lea ecx, [ebp + 8]
call fcn.00402226
mov eax, esi
call fcn.004e277c
ret