Function at 0x4329c2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c214f
mov eax, dword fs:[0]
push eax
mov eax, 0x4a8c
call fcn.004aa250
mov eax, dword [0x4eec64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebp - 0x4a94]
mov dword [ebp - 4], 3
call fcn.0047d8b0
mov byte [ebp - 4], 4
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [ebp - 0x4a68], edi
mov dword [ebp - 0x4a50], edi
cmp dword [eax - 0xc], edi
je 0x432a42
push edi
push ecx
mov eax, esp
mov dword [ebp - 0x4a54], esp
push dword [ebp + 8]
push str.StoppingApp:AppID_s
push eax
call fcn.00462190
add esp, 0xc
call fcn.00425d7f
pop ecx
pop ecx
push edi
call fcn.00422dcc
pop ecx
test eax, eax
je 0x432a69
push ecx
mov eax, esp
mov dword [ebp - 0x4a54], esp
push str.ScmDirectStopServices_Stop__failed
push eax
call fcn.00462190
pop ecx
pop ecx
call fcn.004307da
pop ecx
mov dword [ebp - 0x4a5c], edi
jmp 0x432c22
push ecx
mov eax, esp
mov dword [ebp - 0x4a4c], esp
push dword [ebp + 8]
lea ecx, [ebp - 0x210]
push ecx
push str.ActiveApp.AppID_x__AppID_x
push eax
call fcn.00462190
add esp, 0x10
call fcn.004307da
pop ecx
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.004a48d2
pop ecx
pop ecx
test eax, eax
jne 0x432c22
mov dword [ebp - 0x4a4c], edi
cmp dword [ebp - 0x4214], edi
jbe 0x432c22
mov ebx, dword [ebp - 0x4a4c]
lea ebx, [ebp + ebx*8 - 0x4210]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x432c0a
mov eax, dword [ebp - 0x4a4c]
test byte [ebp + eax*8 - 0x420c], 3
je 0x432b45
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x4a5c], esp
mov ecx, esp
push eax
call fcn.00423af1
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x4a60], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 5
call fcn.00423af1
mov ebx, dword [ebx]
mov byte [ebp - 4], 4
call fcn.00432884
pop ecx
pop ecx
mov dword [ebp - 0x4a5c], 1
cmp eax, edi
je 0x432c0a
mov dword [ebp - 0x4a50], eax
jmp 0x432c0a
push esi
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x432b62
mov dword [ebp - 0x4a50], 1
push 0x4cc12c
lea ecx, [ebp - 0x4a64]
call fcn.00423456
mov byte [ebp - 4], 6
push dword [ebx]
lea esi, [ebp - 0x4a64]
call fcn.00460530
pop ecx
push 0x5c
push ecx
mov eax, esi
mov dword [ebp - 0x4a60], esp
mov ecx, esp
push eax
call fcn.00423af1
lea eax, [ebp - 0x4a54]
push eax
call fcn.004626a0
add esp, 8
mov ecx, esp
mov dword [ebp - 0x4a60], esp
mov byte [ebp - 4], 7
push dword [eax]
push dword [ebx]
push str.__Terminating_PID__d:__s
push ecx
call fcn.00462190
add esp, 0x10
call fcn.004307da
pop ecx
mov ecx, dword [ebp - 0x4a54]
add ecx, 0xfffffff0
call fcn.0042101a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x432bef
mov dword [ebp - 0x4a50], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4a64]
add ecx, 0xfffffff0
call fcn.0042101a
xor edi, edi
inc dword [ebp - 0x4a4c]
mov eax, dword [ebp - 0x4a4c]
cmp eax, dword [ebp - 0x4214]
jb 0x432ac6
lea eax, [ebp - 0x4a48]
push eax
lea esi, [ebp - 0x4a68]
lea ebx, [ebp - 0x4a94]
call fcn.0047d370
test eax, eax
jne 0x432a74
mov eax, dword [ebp + 0x10]
cmp dword [eax - 0xc], edi
je 0x432d84
lea eax, [ebp - 0x4a84]
push eax
call fcn.00425631
mov byte [ebp - 4], 8
push edi
push dword [ebp + 0x10]
lea ecx, [ebp - 0x4a84]
call fcn.004600b0
pop ecx
pop ecx
test eax, eax
je 0x432d74
mov esi, dword [ebp - 0x4a78]
cmp esi, dword [ebp - 0x4a74]
jbe 0x432c8a
call fcn.004a4c91
mov eax, dword [ebp - 0x4a84]
mov dword [ebp - 0x4a58], eax
mov dword [ebp - 0x4a54], esi
mov esi, dword [ebp - 0x4a74]
cmp dword [ebp - 0x4a78], esi
jbe 0x432caf
call fcn.004a4c91
mov eax, dword [ebp - 0x4a58]
cmp eax, edi
je 0x432cc1
cmp eax, dword [ebp - 0x4a84]
je 0x432cc6
call fcn.004a4c91
cmp dword [ebp - 0x4a54], esi
je 0x432d74
lea esi, [ebp - 0x4a58]
call fcn.00423902
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x432d5c
lea esi, [ebp - 0x4a58]
call fcn.00423902
push dword [eax]
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, edi
jne 0x432d12
mov dword [ebp - 0x4a50], 1
lea esi, [ebp - 0x4a58]
call fcn.00423902
push ecx
mov ecx, esp
mov dword [ebp - 0x4a60], esp
push dword [ebp + 0x10]
push dword [eax]
push str.__Terminating_PID__d:__s
push ecx
call fcn.00462190
add esp, 0x10
call fcn.004307da
pop ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x432d55
mov dword [ebp - 0x4a50], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebp - 0x4a6c]
lea esi, [ebp - 0x4a58]
call fcn.00425669
xor edi, edi
jmp 0x432c9c
lea eax, [ebp - 0x4a84]
push eax
mov byte [ebp - 4], 4
call fcn.004358ac
cmp dword [ebp - 0x4a5c], edi
je 0x432d9a
push edi
push edi
push edi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [ebp - 0x4a94]
call fcn.0047d8d0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp - 0x4a50]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4220
leave
ret