Function at 0x407680
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
mov eax, 0x15a4
call fcn.0040a6f0
push ebx
push ebp
mov ebp, dword [esp + 0x15b0]
push esi
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 1
jl 0x407c18
cmp ebx, 0x104
jg 0x407c18
xor esi, esi
test ebx, ebx
jle 0x4076e2
lea eax, [esp + 0xc0]
sub ebp, eax
lea edi, [esp + esi + 0xc0]
movsx ecx, byte [edi + ebp]
push ecx
call fcn.0040a7bd
add esp, 4
inc esi
cmp esi, ebx
mov byte [edi], al
jl 0x4076c7
lea edx, [esp + 0x2c]
mov byte [esp + ebx + 0xc0], 0
push edx
mov dword [esp + 0x30], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
jne 0x407711
pop edi
pop esi
pop ebp
mov eax, 0x25e
pop ebx
add esp, 0x15a4
ret
mov eax, dword [esp + 0x3c]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, 2
je 0x407739
cmp eax, 1
je 0x40790a
pop edi
pop esi
pop ebp
mov eax, 0x25f
pop ebx
add esp, 0x15a4
ret
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
jne 0x40775e
pop edi
pop esi
pop ebp
mov eax, 0x25d
pop ebx
add esp, 0x15a4
ret
push str.EnumProcesses
push edi
call ebp
push str.EnumProcessModules
push edi
mov esi, eax
call ebp
mov ebx, eax
push str.GetModuleBaseNameA
push edi
mov dword [esp + 0x20], ebx
call ebp
test esi, esi
mov dword [esp + 0x20], eax
je 0x4079b7
test ebx, ebx
je 0x4079b7
test eax, eax
je 0x4079b7
lea eax, [esp + 0x24]
lea ecx, [esp + 0x614]
push eax
push 0x3e8
push ecx
call esi
test eax, eax
jne 0x4077c9
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bd
pop ebx
add esp, 0x15a4
ret
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], 0
shr eax, 2
mov dword [esp + 0x1c], eax
je 0x4078ff
lea ebx, [esp + 0x614]
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2ec]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x407854
lea edx, [esp + 0x24]
lea eax, [esp + 0x28]
push edx
push 4
push eax
push esi
call dword [esp + 0x28]
test eax, eax
je 0x407854
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2ec]
push 0x104
push ecx
push edx
push esi
call dword [esp + 0x30]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [esp + 0x2ec]
lea esi, [esp + 0xc0]
push eax
call fcn.0040a71f
add esp, 4
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x407896
test cl, cl
je 0x407892
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x407896
add eax, 2
add esi, 2
test cl, cl
jne 0x407872
xor eax, eax
jmp 0x40789b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4078e3
lea eax, [esp + 0x2ec]
lea esi, [esp + 0xc0]
push eax
call fcn.0040a71f
add esp, 4
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4078da
test cl, cl
je 0x4078d6
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4078da
add eax, 2
add esi, 2
test cl, cl
jne 0x4078b6
xor eax, eax
jmp 0x4078df
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407933
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x4077e9
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x3c], 1
jne 0x407b42
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
jne 0x4079ce
pop edi
pop esi
pop ebp
mov eax, 0x2be
pop ebx
add esp, 0x15a4
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x614]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x40799c
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
push esi
je 0x40797b
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x15a4
ret
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25a
pop ebx
add esp, 0x15a4
ret
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25c
pop ebx
add esp, 0x15a4
ret
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bc
pop ebx
add esp, 0x15a4
ret
push str.CreateToolhelp32Snapshot
push ebx
call ebp
push str.Process32First
push ebx
mov dword [esp + 0x18], eax
call ebp
push str.Process32Next
push ebx
mov esi, eax
call ebp
mov edi, eax
push str.Module32First
push ebx
mov dword [esp + 0x28], edi
call ebp
push str.Module32Next
push ebx
mov dword [esp + 0x20], eax
call ebp
test edi, edi
mov dword [esp + 0x1c], eax
je 0x407c01
test esi, esi
je 0x407c01
test eax, eax
je 0x407c01
mov eax, dword [esp + 0x18]
test eax, eax
je 0x407c01
mov edi, dword [esp + 0x10]
test edi, edi
je 0x407c01
push 0
push 2
call edi
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x407a5e
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2c0
pop ebx
add esp, 0x15a4
ret
lea edx, [esp + 0x1c4]
mov dword [esp + 0x1c4], 0x128
push edx
push ebp
call esi
test eax, eax
je 0x407b37
jmp 0x407a82
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x1cc]
push eax
push 8
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x407b59
lea ecx, [esp + 0x3f0]
mov dword [esp + 0x3f0], 0x224
push ecx
push edi
call dword [esp + 0x20]
test eax, eax
je 0x407b10
lea esi, [esp + 0xc0]
lea eax, [esp + 0x410]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x407ae7
test cl, cl
je 0x407ae3
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x407ae7
add eax, 2
add esi, 2
test cl, cl
jne 0x407ac3
xor eax, eax
jmp 0x407aec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407b77
lea eax, [esp + 0x3f0]
mov dword [esp + 0x3f0], 0x224
push eax
push edi
call dword [esp + 0x24]
test eax, eax
jne 0x407ab5
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [esp + 0x1c4]
mov dword [esp + 0x1c4], 0x128
push ecx
push ebp
call dword [esp + 0x28]
test eax, eax
jne 0x407a7e
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25b
pop ebx
add esp, 0x15a4
ret
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2c0
pop ebx
add esp, 0x15a4
ret
mov edx, dword [esp + 0x1cc]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x407bde
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x407bbf
call edi
push ebp
call edi
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x15a4
ret
call edi
push ebp
call edi
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25a
pop ebx
add esp, 0x15a4
ret
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call esi
push ebp
call esi
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25c
pop ebx
add esp, 0x15a4
ret
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bf
pop ebx
add esp, 0x15a4
ret
pop edi
pop esi
pop ebp
mov eax, 0x278
pop ebx
add esp, 0x15a4
ret