Function at 0x4a5a03
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x560d7b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x145c
call fcn.005482e0
mov eax, dword [0x5afee0]
xor eax, esp
mov dword [esp + 0x1458], eax
push ebx
push esi
push edi
mov eax, dword [0x5afee0]
xor eax, esp
push eax
lea eax, [esp + 0x1470]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x24], eax
cmp esi, ebx
je 0x4a5c92
cmp word [esi], bx
je 0x4a5c92
cmp eax, ebx
je 0x4a5c92
xor eax, eax
push 0x206
mov word [esp + 0x1260], ax
lea eax, [esp + 0x1262]
push ebx
push eax
call fcn.00537010
add esp, 0xc
push 0x5850c8
push esi
lea eax, [esp + 0x1264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
or dword [esp + 0x20], 0xffffffff
lea eax, [esp + 0x28]
push eax
push 0x1000
lea eax, [esp + 0x54]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x4a5c92
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x30]
push eax
shr edi, 2
call fcn.004b213d
xor eax, eax
mov dword [esp + 0x1478], ebx
push 0x208
mov word [esp + 0x1050], ax
lea eax, [esp + 0x1052]
push ebx
push eax
call fcn.00537010
add esp, 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp edi, ebx
jbe 0x4a5be4
mov eax, dword [esp + 0x14]
mov esi, dword [esp + eax*4 + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x4a5bd6
push esi
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, ebx
je 0x4a5bd6
lea eax, [esp + 0x48]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4a5bcf
push 0x104
lea eax, [esp + 0x1050]
push eax
push dword [esp + 0x20]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [esp + 0x125c]
push eax
lea eax, [esp + 0x1050]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x4a5bcf
lea eax, [esp + 0x104c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [esp + 0x2c], eax
xor esi, esi
mov eax, dword [esp + 0x24]
push dword [eax + esi*4]
push dword [esp + 0x30]
call fcn.005320ad
pop ecx
pop ecx
test eax, eax
je 0x4a5bb3
inc esi
cmp esi, 1
jl 0x4a5b95
jmp 0x4a5bd6
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ebx, [esp + 0x1c]
lea esi, [esp + 0x30]
call fcn.004a5cb9
xor ebx, ebx
jmp 0x4a5bd6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jb 0x4a5b09
mov esi, dword [esp + 0x40]
sub esi, dword [esp + 0x3c]
sar esi, 2
cmp esi, ebx
jbe 0x4a5c83
xor ecx, ecx
push 4
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0052f69b
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4a5c57
xor edi, edi
test esi, esi
jbe 0x4a5c3d
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x3c]
sar eax, 2
cmp edi, eax
jb 0x4a5c2e
call fcn.00530cad
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + edi*4]
mov dword [ebx + edi*4], eax
inc edi
cmp edi, esi
jb 0x4a5c1a
push 0x1388
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push ebx
mov dword [esp + 0x24], eax
call fcn.00530cbd
pop ecx
xor edi, edi
test esi, esi
jbe 0x4a5c83
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x3c]
sar eax, 2
cmp edi, eax
jb 0x4a5c71
call fcn.00530cad
mov eax, dword [esp + 0x3c]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, esi
jb 0x4a5c5d
lea esi, [esp + 0x30]
call fcn.00472ee9
mov eax, dword [esp + 0x20]
jmp 0x4a5c95
or eax, 0xffffffff
mov ecx, dword [esp + 0x1470]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1458]
xor ecx, esp
call fcn.0052f7d0
mov esp, ebp
pop ebp
ret