Function at 0x4038b8
Capabilities:
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
mov ecx, 0x4a
push eax
add esp, 0xfffffc2c
push ebx
push esi
push edi
lea edi, [ebp - 0x23c]
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x44f9d0
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.00403850
pop ecx
test eax, eax
je 0x4038f4
push ebx
call fcn.00403898
pop ecx
mov dword [ebp - 0x2d0], 0x94
lea eax, [ebp - 0x2d0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x2c0], 1
jne 0x403932
push ebx
call fcn.0040372c
pop ecx
test eax, eax
jne 0x403929
push ebx
call fcn.00403764
pop ecx
test eax, eax
je 0x40394f
push ebx
call fcn.00403898
pop ecx
jmp 0x40394f
push ebx
call fcn.00403878
pop ecx
test eax, eax
jne 0x403948
push ebx
call fcn.0040381c
pop ecx
test eax, eax
je 0x40394f
push ebx
call fcn.00403898
pop ecx
mov dword [ebp - 0x23c], 0x128
call sub.KERNEL32.DLL_GetCurrentProcessId
mov edi, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4039bb
jmp 0x4039aa
push str.explorer.exe
lea edx, [ebp - 0x218]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40399c
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 4], ecx
cmp edi, dword [ebp - 0x234]
jne 0x4039aa
mov esi, dword [ebp - 0x224]
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x40397e
cmp esi, dword [ebp - 4]
je 0x4039e0
cmp dword [ebp - 4], 0
je 0x4039e0
push esi
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x403b13
cmp dword [ebp - 0x2c0], 1
je 0x403b13
push str.psapi.dll
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403b13
push str.EnumProcessModules
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4536c8], eax
push str.GetModuleFileNameExA
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4536c4], eax
xor eax, eax
lea edx, [ebp - 0x114]
mov dword [ebp - 0x10], eax
push 0x105
push edx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x44fba7
lea ecx, [ebp - 0x114]
push ecx
call sub.KERNEL32.DLL_lstrcatA
push str.EXPLORER.EXE
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.DLL_lstrcatA
push esi
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x403b13
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x12d0]
push eax
push 0x1000
push edx
push edi
call dword [0x4536c8]
test eax, eax
je 0x403ae6
xor esi, esi
lea ebx, [ebp - 0x12d0]
jmp 0x403adc
push 0x104
lea eax, [ebp - 0x13d4]
push eax
mov edx, dword [ebx]
push edx
push edi
call dword [0x4536c4]
test eax, eax
je 0x403ad8
lea ecx, [ebp - 0x13d4]
push ecx
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x403ad8
mov dword [ebp - 0x10], 1
jmp 0x403ae6
inc esi
add ebx, 4
mov edx, dword [ebp - 0xc]
shr edx, 2
cmp esi, edx
jb 0x403a9e
push edi
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.DLL_FreeLibrary
cmp dword [ebp - 0x10], 0
jne 0x403b13
mov eax, dword [ebp - 4]
push eax
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret