Function at 0x41dba0
Capabilities:
Create process on windows
Enumerate processes
Execute command
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c255b
mov eax, dword fs:[0]
push eax
sub esp, 0x2ec
mov eax, dword [0x4f840c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x2f4]
push eax
push edi
mov dword [ebp - 0x2f8], edi
mov dword [ebp - 0x2f4], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x41dc25
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push ebx
lea ecx, [ebp - 0x2d0]
push ecx
call esi
test eax, eax
je 0x41dc4a
lea edx, [ebp - 0x2f4]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41dc05
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00485d44
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2ec]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x41dc69
push str.OpenProcess_SUCCESS__
jmp 0x41dc6e
push str.OpenProcess_failed__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
test esi, esi
je 0x41dc90
push str.KILL_SUCCESS__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x41dcd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
push 0x7e
push ecx
lea edx, [ebp - 0x8e]
push edx
mov edi, eax
mov word [ebp - 0x90], cx
call sub.MSVCR100.dll_memset
push edi
lea eax, [ebp - 0x90]
push str.kill_fail__d
push eax
call fcn.00401000
add esp, 0x18
lea ecx, [ebp - 0x90]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, dword [ebp - 0x2f8]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x41ddc4
mov edi, dword [sym.imp.MSVCR100.dll_wcslen]
xor edx, edx
push str.taskkill__F__T__IM
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x9c], esi
mov word [ebp - 0xac], dx
call edi
add esp, 4
mov ecx, str.taskkill__F__T__IM
lea esi, [ebp - 0xac]
call fcn.0040885a
push ebx
mov dword [ebp - 4], 0
call edi
add esp, 4
mov edi, eax
push ebx
mov eax, esi
call fcn.004087a1
mov eax, dword [ebp - 0xac]
mov ebx, 8
cmp dword [ebp - 0x98], ebx
jae 0x41dd4c
mov eax, esi
push eax
lea eax, [ebp - 0xc8]
push eax
call sym.Uninstall.exe_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_KpBase::ws2s_wchar_t_const__
mov edi, 0x10
add esp, 8
cmp dword [eax + 0x14], edi
jb 0x41dd68
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [ebp - 0xb4], edi
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov esi, eax
jb 0x41dd8d
mov ecx, dword [ebp - 0xc8]
push ecx
call edi
add esp, 4
cmp esi, 0x20
jge 0x41ddb0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x98], ebx
jae 0x41dda6
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.MSVCR100.dll__wsystem]
add esp, 4
cmp dword [ebp - 0x98], ebx
jb 0x41ddc4
mov edx, dword [ebp - 0xac]
push edx
call edi
add esp, 4
mov eax, esi
jmp 0x41dc2e