Function at 0x402550
Capabilities:
Accept command line arguments
Get hostname
Terminate process

Disassembly:
sub esp, 0x110
push esi
push str._nPsSuspend_v1.05___local_and_remote_process_suspender_resumer_n
call fcn.00402a5b
push str.Copyright__C__2001_2003_Mark_Russinovich_n
call fcn.00402a5b
push str.Sysinternals___www.sysinternals.com_n_n
call fcn.00402a5b
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jb 0x40259d
push str.PsSuspend_requires_Windows_NT_or_higher._n_n
call fcn.00402a5b
add esp, 4
or eax, 0xffffffff
pop esi
add esp, 0x110
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x14], 0x22
jne 0x4025e8
lea edi, [esp + 0x15]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x15]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0x15], al
lea ecx, [esp + 0xc]
push ecx
push 0x40db80
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [esp + 0xc]
pop edi
test eax, eax
je 0x40260a
mov byte [eax], 0
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
push edx
push eax
call fcn.00402220
add esp, 8
test al, al
jne 0x40262d
push 0xffffffffffffffff
call fcn.0040321c
mov al, byte [0x40d668]
test al, al
je 0x402684
mov al, byte [0x40d770]
test al, al
jne 0x402684
push str.Password:
call fcn.00402a5b
push 0x40acc0
call fcn.00402f1e
add esp, 8
xor esi, esi
call fcn.00402d8d
cmp al, 0xd
je 0x402670
mov byte [esi + 0x40d940], al
inc esi
cmp esi, 0x103
jb 0x402658
push 0x40a3bc
mov byte [esi + 0x40d940], 0
call fcn.00402a5b
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x104
push ecx
push 0x40da60
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov al, byte [0x40d564]
test al, al
je 0x402786
push 0x40da60
push 0x40d564
call fcn.00405c40
add esp, 8
test eax, eax
je 0x402786
lea edx, [esp + 4]
push edx
call fcn.00401ed0
add esp, 4
test eax, eax
jne 0x4026df
or eax, 0xffffffff
pop esi
add esp, 0x110
ret
mov ecx, dword [0x40d774]
test ecx, ecx
je 0x402750
mov edx, dword [esp + 4]
mov al, byte [0x40a3cc]
cmp edx, 1
jbe 0x402724
test al, al
mov eax, str.suspended
jne 0x402705
mov eax, str.resumed
push 0x40d564
push ecx
push eax
push edx
push str._r_d_processes_named__s__s_on__s._n_n
call fcn.00402a5b
add esp, 0x14
xor eax, eax
pop esi
add esp, 0x110
ret
test al, al
mov eax, str.suspended
jne 0x402732
mov eax, str.resumed
push 0x40d564
push eax
push ecx
push str._rProcess__s__s_on__s._n_n
call fcn.00402a5b
add esp, 0x10
xor eax, eax
pop esi
add esp, 0x110
ret
mov al, byte [0x40a3cc]
test al, al
mov eax, str.suspended
jne 0x402763
mov eax, str.resumed
push 0x40d564
push eax
mov eax, dword [0x40dc84]
push eax
push str._rProcess__d_on__s__s._n_n
call fcn.00402a5b
add esp, 0x10
xor eax, eax
pop esi
add esp, 0x110
ret
mov edx, dword [0x40dc84]
mov eax, dword [0x40d774]
lea ecx, [esp + 4]
push ecx
mov cl, byte [0x40a3cc]
push edx
push eax
push ecx
call fcn.00401300
mov esi, eax
add esp, 0x10
test esi, esi
je 0x402827
mov ecx, dword [0x40d774]
mov al, byte [0x40a3cc]
test ecx, ecx
je 0x4027d3
test al, al
mov eax, str.suspend
jne 0x4027ca
mov eax, str.resume
push ecx
push eax
push str.Unable_to__s_process__s:_n
jmp 0x4027ee
test al, al
mov eax, str.suspend
jne 0x4027e1
mov eax, str.resume
mov edx, dword [0x40dc84]
push edx
push eax
push str.Unable_to__s_process__d:_n
call fcn.00402a5b
add esp, 0xc
cmp esi, 0x57
jne 0x402813
push str.Process_does_not_exist._n
call fcn.00402a5b
add esp, 4
or eax, 0xffffffff
pop esi
add esp, 0x110
ret
push esi
call fcn.00401820
add esp, 4
or eax, 0xffffffff
pop esi
add esp, 0x110
ret
mov ecx, dword [esp + 4]
cmp ecx, 1
jbe 0x402862
mov al, byte [0x40a3cc]
test al, al
mov eax, str.suspended
jne 0x402843
mov eax, str.resumed
push eax
mov eax, dword [0x40d774]
push eax
push ecx
push str._d_processes_named__s__s._n_n
call fcn.00402a5b
add esp, 0x10
xor eax, eax
pop esi
add esp, 0x110
ret
mov ecx, dword [0x40d774]
mov al, byte [0x40a3cc]
test ecx, ecx
je 0x402898
test al, al
mov eax, str.suspended
jne 0x40287f
mov eax, str.resumed
push eax
push ecx
push str.Process__s__s._n_n
call fcn.00402a5b
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x110
ret
test al, al
mov eax, str.suspended
jne 0x4028a6
mov eax, str.resumed
mov ecx, dword [0x40dc84]
push eax
push ecx
push str.Process__d__s._n_n
call fcn.00402a5b
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x110
ret