Function at 0x402030
Capabilities:
Enumerate processes
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x33c
mov ecx, dword [eax + 4]
mov dword [ebp - 0x308], eax
test ecx, ecx
je 0x402968
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov dword [esp], 0
mov dword [ebp - 0x318], eax
call eax
mov esi, dword [sym.imp.user32.dll_LoadStringW]
sub esp, 4
mov ebx, eax
lea eax, [ebp - 0x298]
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0x66
mov dword [esp], ebx
mov dword [ebp - 0x314], esi
call esi
lea eax, [ebp - 0x258]
sub esp, 0x10
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0x67
mov dword [esp], ebx
call esi
lea eax, [ebp - 0x218]
sub esp, 0x10
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0x68
mov dword [esp], ebx
call esi
lea eax, [ebp - 0x1d8]
sub esp, 0x10
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0x69
mov dword [esp], ebx
call esi
lea eax, [ebp - 0x198]
sub esp, 0x10
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0x6a
mov dword [esp], ebx
call esi
mov eax, dword [ebp - 0x308]
sub esp, 0x10
cmp dword [eax + 4], 2
je 0x402979
mov eax, dword [ebp - 0x308]
mov edx, dword [eax]
test edx, edx
jne 0x40214c
mov eax, dword [eax + 4]
test eax, eax
je 0x4029f2
cmp eax, 1
je 0x402a35
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov esi, eax
cmp eax, 0xffffffff
je 0x402680
mov dword [esp], 0x11600
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x2f4], eax
test eax, eax
je 0x402add
mov eax, dword [ebp - 0x2f4]
mov ebx, pe_nt_image_headers32
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._Process32FirstW_8
mov edi, dword [sym.imp.ucrtbase.dll_realloc]
mov dword [ebp - 0x300], 1
sub esp, 8
test eax, eax
je 0x402aac
mov dword [ebp - 0x2f8], esi
mov esi, 1
lea esi, [esi]
imul eax, esi, 0x22c
add eax, dword [ebp - 0x2f4]
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2f8]
mov dword [esp], eax
call sym._Process32NextW_8
sub esp, 8
test eax, eax
je 0x402230
inc esi
cmp esi, ebx
jne 0x4021d0
imul eax, esi, 0x458
lea ebx, [esi + esi]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2f4]
mov dword [esp], eax
call edi
test eax, eax
je 0x402af7
mov dword [ebp - 0x2f4], eax
jmp 0x4021d0
mov dword [ebp - 0x300], esi
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [ebp - 0x2f8]
mov dword [ebp - 0x30c], eax
mov dword [esp], esi
call eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
sub esp, 4
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x300]
test eax, eax
je 0x402695
mov dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f4]
add eax, 0x24
mov dword [ebp - 0x2fc], eax
jmp 0x4022b7
test byte [0x404020], 1
jne 0x402610
inc dword [ebp - 0x2f8]
mov eax, dword [ebp - 0x2f8]
add dword [ebp - 0x2fc], 0x22c
cmp eax, dword [ebp - 0x300]
je 0x402695
xor eax, eax
mov ecx, 0x53
lea edi, [ebp - 0x158]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2fc]
lea ecx, [ebp - 0x2f0]
mov dword [esp + 4], ecx
mov ebx, eax
mov eax, dword [eax - 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ProcessIdToSessionId]
sub esp, 8
test eax, eax
je 0x402288
mov eax, dword [ebp - 0x2fc]
mov eax, dword [eax - 0x1c]
mov dword [esp + 4], 0
mov dword [esp], 0x410
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenProcess]
mov esi, eax
mov eax, dword [sym.imp.ucrtbase.dll_wcscpy]
sub esp, 0xc
mov dword [ebp - 0x304], eax
test esi, esi
je 0x402354
lea eax, [ebp - 0x2cc]
mov dword [esp + 8], 0x28
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._K32GetProcessMemoryInfo_12
sub esp, 0xc
test eax, eax
jne 0x402738
mov dword [esp], esi
mov eax, dword [ebp - 0x30c]
call eax
sub esp, 4
cmp word [ebp - 0x4c], 0
je 0x402650
mov eax, dword [ebp - 0x2fc]
lea ecx, [ebp - 0x10e]
mov esi, dword [eax - 0x1c]
mov eax, dword [ebp - 0x2c0]
shr eax, 0xa
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x14c]
lea esi, [esi]
movzx edx, word [ebx]
test dx, dx
je 0x4023ae
add eax, 2
add ebx, 2
mov word [eax - 2], dx
cmp eax, ecx
jne 0x402398
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x10c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x405020
mov dword [esp + 4], 0x20
mov dword [esp], eax
call sym._swprintf.constprop.0
mov ecx, dword [ebp - 0x2f0]
mov edx, str.Console
mov eax, str.Services
test ecx, ecx
cmovne eax, edx
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
mov eax, dword [ebp - 0x304]
call eax
mov eax, dword [ebp - 0x2f0]
mov dword [esp + 8], 0x405020
mov dword [esp + 4], 0x20
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x8c]
mov dword [esp], eax
call sym._swprintf.constprop.0
mov eax, dword [ebp - 0x308]
mov edi, dword [eax + 8]
test edi, edi
je 0x4024c6
mov esi, dword [sym.imp.ucrtbase.dll__wcsicmp]
mov eax, dword [edi]
cmp eax, 1
je 0x402560
cmp eax, 4
je 0x402590
mov ebx, dword [ebp - 0x158]
cmp eax, 2
je 0x402477
mov ebx, dword [ebp - 0x150]
cmp eax, 3
je 0x402477
cmp eax, 5
mov ebx, 0
cmove ebx, dword [ebp - 0x154]
lea eax, [ebp - 0x2cc]
mov dword [esp + 4], 0x405018
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], eax
call sym._swscanf.constprop.0
cmp eax, 1
jne 0x4026f0
mov eax, dword [edi + 4]
test eax, eax
jne 0x4025a0
xor eax, eax
cmp dword [ebp - 0x2cc], ebx
sete al
test eax, eax
je 0x402295
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x40243e
mov eax, dword [ebp - 0x308]
mov eax, dword [eax + 4]
test eax, eax
je 0x4026b0
cmp eax, 1
je 0x402928
cmp eax, 2
jne 0x402295
lea eax, [ebp - 0x4c]
mov dword [esp], str._n__13.13s__s_n__13.13s__s_n__13.13s__s_n__13.13s__s_n__13.13s__s_n
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x198]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x1d8]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0xcc]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x218]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x258]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x14c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x298]
mov dword [esp + 4], eax
call sym._wprintf
jmp 0x402295
lea eax, [ebp - 0x14c]
mov edx, dword [edi + 8]
mov dword [esp], eax
mov dword [esp + 4], edx
call esi
mov ebx, dword [edi + 4]
test ebx, ebx
jne 0x4024b3
test eax, eax
sete al
movzx eax, al
jmp 0x4024b3
lea eax, [ebp - 0xcc]
jmp 0x402566
cmp eax, 1
je 0x4025d8
cmp eax, 2
je 0x4025f0
cmp eax, 3
je 0x402600
cmp eax, 4
je 0x402670
cmp eax, 5
jne 0x402295
xor eax, eax
cmp ebx, dword [ebp - 0x2cc]
setbe al
jmp 0x4024b3
xor eax, eax
cmp dword [ebp - 0x2cc], ebx
setne al
jmp 0x4024b3
xor eax, eax
cmp ebx, dword [ebp - 0x2cc]
seta al
jmp 0x4024b3
xor eax, eax
cmp ebx, dword [ebp - 0x2cc]
setb al
jmp 0x4024b3
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_get_process_session_id___lu._n
mov dword [esp + 8], str.tasklist_get_process_info
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x404020
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x402295
lea eax, [ebp - 0x4c]
mov dword [esp + 4], 0x4051a4
mov dword [esp], eax
mov eax, dword [ebp - 0x304]
call eax
jmp 0x40235f
xor eax, eax
cmp ebx, dword [ebp - 0x2cc]
setae al
jmp 0x4024b3
mov dword [ebp - 0x2f4], 0
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x2f4]
mov dword [esp], eax
mov eax, dword [ebp - 0x310]
call eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x4c]
mov dword [esp], str.__25.25s__8.8s___16.16s__11.11s__12s_n
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xcc]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
call sym._wprintf
jmp 0x402295
test byte [0x404020], 2
je 0x402295
mov eax, dword [edi + 8]
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0xc], str.Invalid_filter_operand__s._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.tasklist_check_filters
mov dword [esp + 4], 0x404020
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x402295
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 8], 0x405020
mov dword [esp + 4], 0x10
shr eax, 0xa
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2ec]
mov dword [esp], eax
call sym._swprintf.constprop.0
mov edi, dword [0x404078]
test edi, edi
je 0x40281f
lea eax, [ebp - 0x2ec]
lea edi, [ebp - 0x4c]
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x40404c
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x400
call dword [sym.imp.kernel32.dll_GetNumberFormatW]
sub esp, 0x18
test eax, eax
je 0x402346
mov eax, dword [ebp - 0x318]
mov dword [esp], 0
call eax
lea ecx, [ebp - 0x2ec]
sub esp, 4
mov dword [esp + 8], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x314]
mov dword [esp + 0xc], 0x10
mov dword [esp + 4], 0x6b
call eax
mov edx, dword [sym.imp.ucrtbase.dll_wcscat]
sub esp, 0x10
mov dword [ebp - 0x31c], edx
mov dword [esp + 4], 0x4051a0
mov dword [esp], edi
call edx
lea eax, [ebp - 0x2ec]
mov dword [esp], edi
mov edx, dword [ebp - 0x31c]
mov dword [esp + 4], eax
call edx
jmp 0x402346
mov dword [esp + 0xc], 2
mov edi, dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov dword [esp + 8], 0x404050
mov dword [esp + 4], 0x20000012
mov dword [esp], 0x400
call edi
sub esp, 0x10
test eax, eax
jne 0x402857
mov dword [0x404050], 0
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x404070
mov dword [esp + 4], 0x10
mov dword [esp], 0x400
call edi
sub esp, 0x10
test eax, eax
je 0x4029e3
cmp word [0x404074], 0x32
mov eax, 0x20
je 0x40289c
movzx eax, word [0x404070]
sub eax, 0x30
mov dword [0x404054], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x404044
mov dword [esp + 4], 0xe
mov dword [esp], 0x400
call edi
mov ecx, dword [sym.imp.ucrtbase.dll_wcscpy]
sub esp, 0x10
mov dword [ebp - 0x304], ecx
test eax, eax
je 0x402a94
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x404120
mov dword [esp + 4], 0xf
mov dword [esp], 0x400
call edi
sub esp, 0x10
test eax, eax
je 0x402a78
mov dword [0x404058], 0x404044
mov dword [0x40405c], 0x404120
mov dword [0x404078], 1
jmp 0x402771
lea eax, [ebp - 0x4c]
mov dword [esp], str.__s____s____s____s____s__n
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xcc]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
call sym._wprintf
jmp 0x402295
mov dword [esp], 0x405048
call sym._wprintf
jmp 0x40204d
lea eax, [ebp - 0x298]
mov ebx, dword [sym.imp.ucrtbase.dll_wcscat]
mov dword [esp + 4], 0x40504c
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x258]
mov dword [esp + 4], 0x40504c
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x218]
mov dword [esp + 4], 0x40504c
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x1d8]
mov dword [esp + 4], 0x40504c
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x198]
mov dword [esp + 4], 0x40504c
mov dword [esp], eax
call ebx
jmp 0x40212c
mov dword [0x404054], 3
jmp 0x4028a1
lea eax, [ebp - 0x198]
mov dword [esp], 0x405050
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1d8]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x218]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x258]
mov dword [esp + 8], eax
lea eax, [ebp - 0x298]
mov dword [esp + 4], eax
call sym._wprintf
jmp 0x40214c
lea eax, [ebp - 0x198]
mov dword [esp], str.__s____s____s____s____s__n
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1d8]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x218]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x258]
mov dword [esp + 8], eax
lea eax, [ebp - 0x298]
mov dword [esp + 4], eax
call sym._wprintf
jmp 0x40214c
mov dword [esp + 4], 0x40519c
mov eax, dword [ebp - 0x304]
mov dword [esp], 0x404120
call eax
jmp 0x402905
mov dword [esp + 4], 0x405198
mov eax, ecx
mov dword [esp], 0x404044
call eax
jmp 0x4028d9
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x2f4]
sub esp, 4
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x310], eax
call eax
mov dword [ebp - 0x2f4], 0
jmp 0x402695
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x310], eax
jmp 0x402695
mov dword [ebp - 0x300], esi
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [ebp - 0x2f8]
mov dword [ebp - 0x30c], eax
mov dword [esp], esi
call eax
mov eax, dword [ebp - 0x2f4]
sub esp, 4
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x310], eax
call eax
mov dword [ebp - 0x2f4], 0
jmp 0x40225a