Function at 0x47183c
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x468
mov eax, 0x4e20e4
call fcn.004b5257
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
je 0x471aa3
jge 0x47186a
push 0x80070057
call fcn.0040b600
movzx eax, word [eax]
cmp ax, di
je 0x471aa3
push 0x228
lea eax, [ebp - 0x444]
push edi
push eax
mov dword [ebp - 0x448], edi
call fcn.004b4620
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x44c], eax
cmp eax, 0xffffffff
je 0x471aa3
lea ecx, [ebp - 0x46c]
call fcn.00456104
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 0x44c]
mov esi, 0x22c
mov dword [ebp - 0x448], esi
call sub.KERNEL32.dll_Process32FirstW
mov ebx, eax
xor eax, eax
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.004b4620
add esp, 0xc
cmp ebx, edi
je 0x4719f5
mov eax, dword [ebp - 0x440]
cmp dword [ebp - 0x454], eax
je 0x4719b2
push eax
push edi
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x450], ebx
cmp ebx, edi
je 0x4719b2
push 0x104
lea eax, [ebp - 0x21c]
push eax
push edi
push ebx
call sub.PSAPI.DLL_GetModuleFileNameExW
cmp eax, edi
je 0x4719ab
cmp eax, 0x104
ja 0x4719ab
push ecx
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x470], esp
push eax
call fcn.0044bc85
mov byte [ebp - 4], 2
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x474], esp
push eax
call fcn.004420c1
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
call fcn.0046fcea
pop ecx
pop ecx
test al, al
je 0x4719ab
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x46c]
call fcn.0045932c
jmp 0x4719b2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea eax, [ebp - 0x448]
push edi
push eax
call fcn.004b4620
push 0x20a
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.004b4620
add esp, 0x18
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 0x44c]
mov dword [ebp - 0x448], esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, edi
jne 0x471908
push dword [ebp - 0x44c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x45c]
sub esi, dword [ebp - 0x460]
sar esi, 2
cmp esi, edi
jbe 0x471a84
push 0x541444
xor ecx, ecx
push 4
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b60d0
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
je 0x471a67
test esi, esi
jbe 0x471a51
push edi
lea ecx, [ebp - 0x46c]
call fcn.0047e29b
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
inc edi
cmp edi, esi
jb 0x471a3b
push dword [ebp + 0xc]
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push ebx
call fcn.004b5d21
pop ecx
xor edi, edi
cmp esi, edi
jbe 0x471a84
push edi
lea ecx, [ebp - 0x46c]
call fcn.0047e29b
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, esi
jb 0x471a6b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x46c]
call fcn.00444c5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040d610
xor eax, eax
jmp 0x471ab2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040d610
or eax, 0xffffffff
call fcn.004b52da
ret