Function at 0x404914
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
sub esp, 0x128
lea ebp, [esp - 4]
mov eax, dword [0x480150]
xor eax, ebp
mov dword [ebp + 0x128], eax
push 0x3c
mov eax, 0x45e67a
call fcn.00441f36
push ecx
mov edi, ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
mov esi, str.lock.temp
push esi
call fcn.00404097
call fcn.004046fb
xor ebx, ebx
pop ecx
cmp al, bl
je 0x40495e
xor eax, eax
jmp 0x404b87
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.installing
call fcn.00404097
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
mov dword [ebp - 4], ebx
call fcn.00404097
or dword [ebp - 4], 0xffffffff
call fcn.00404837
pop ecx
pop ecx
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [ebp - 0x18], eax
call fcn.0041ff68
mov eax, dword [eax + 4]
push dword [eax + 0x60]
lea ecx, [ebp - 0x14]
call fcn.00404097
push str..exe
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
call fcn.00403dbf
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x124
lea eax, [ebp + 4]
push ebx
push eax
mov dword [ebp - 0x1c], ebx
call fcn.00441880
add esp, 0xc
lea eax, [ebp]
push eax
push esi
mov dword [ebp], 0x128
call sub.KERNEL32.dll_Process32First
call fcn.004200d6
push eax
lea ecx, [ebp - 0x10]
call fcn.00414256
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00403dbf
push 0x465bdc
lea ecx, [ebp - 0x10]
call fcn.00403dbf
mov eax, dword [ebp - 0x14]
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
push eax
call fcn.00403b8d
push dword [ebp - 0x14]
lea eax, [ebp + 0x24]
push eax
call fcn.0044fa44
pop ecx
pop ecx
test eax, eax
jne 0x404a41
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x18]
jne 0x404a60
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.0040127b
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4049ed
jmp 0x404a8f
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040127b
push 0xc
call fcn.0041df60
pop ecx
cmp eax, ebx
je 0x404ab7
push 0x60
pop ecx
mov byte [eax], bl
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
jmp 0x404ab9
xor eax, eax
push 3
pop esi
mov dword [0x4815d0], eax
cmp dword [0x48f9b8], esi
jne 0x404b00
mov eax, dword [0x48f9bc]
push dword [eax + 4]
mov ecx, 0x4815fc
call fcn.00403cdf
mov eax, dword [0x48f9bc]
push dword [eax + 8]
call fcn.00444b71
mov dword [0x4815d4], eax
mov eax, dword [0x48f9bc]
pop ecx
push dword [eax + 4]
mov ecx, 0x481600
call fcn.00403cdf
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
lea ecx, [ebp - 0x48]
call fcn.0041f174
mov dword [ebp - 0x48], 0x4659c8
lea eax, [ebp - 0x48]
push eax
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0041e65e
mov ecx, edi
call fcn.0041eb07
push ebx
call fcn.00424ce1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.DhEVCAwUDAgPEhUADQ0EEw
call fcn.004023c9
lea eax, [ebp - 0x10]
push eax
call fcn.00404002
add esp, 0x20
push dword [eax]
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00424132
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.0040127b
mov ecx, edi
mov byte [edi + 0xa4], 1
call fcn.004033b8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0041f1b8
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x128]
xor ecx, ebp
call fcn.00441f27
add ebp, 0x12c
leave
ret