Function at 0x472200
Capabilities:
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca11c
mov eax, dword fs:[0]
push eax
sub esp, 0x67c
mov eax, dword [0x4ff080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x678], ecx
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 0x641], 0
push 0
push eax
call fcn.004abe70
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x664], eax
xor edi, edi
mov dword [ebp - 0x660], ebx
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x658], edi
mov dword [ebp - 0x65c], edi
mov dword [ebp - 4], edi
sub esp, 8
lea ecx, [ebp - 0x670]
call fcn.0047a700
push edi
push 2
mov eax, dword [eax + 8]
call eax
mov esi, eax
mov dword [ebp - 0x650], esi
cmp esi, 0xffffffff
je 0x472347
lea eax, [ebp - 0x444]
mov dword [ebp - 0x444], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x472340
cmp ebx, edi
je 0x4722fd
mov edi, ebx
lea esi, [ebp - 0x444]
mov ecx, 0x8b
add ebx, 0x22c
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x650]
mov dword [ebp - 0x660], ebx
mov edi, dword [ebp - 0x658]
jmp 0x472322
lea eax, [ebp - 0x444]
push eax
push ebx
lea ecx, [ebp - 0x664]
call fcn.0047c940
mov edi, dword [ebp - 0x65c]
mov ebx, dword [ebp - 0x660]
mov dword [ebp - 0x658], edi
lea eax, [ebp - 0x444]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4722d0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x654], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x654]
mov eax, 0x75ded953
sub ebx, esi
mov dword [ebp - 0x650], 0
imul ebx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x67c], eax
je 0x472631
add esi, 8
mov dword [ebp - 0x64c], esi
nop
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x472606
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x670], ebx
xor eax, eax
mov dword [ebp - 0x66c], edi
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 1
sub esp, 8
mov esi, dword [esi]
lea ecx, [ebp - 0x688]
call fcn.0047a700
push esi
push 8
mov eax, dword [eax + 8]
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x47241d
lea eax, [ebp - 0x640]
mov dword [ebp - 0x640], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x472416
lea eax, [ebp - 0x640]
push eax
push edi
lea ecx, [ebp - 0x670]
call fcn.0047c730
mov eax, dword [ebp - 0x668]
mov edi, dword [ebp - 0x66c]
mov ebx, dword [ebp - 0x670]
mov dword [ebp - 0x674], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub edi, ebx
mov eax, 0xf6603d99
imul edi
add edx, edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x472591
lea esi, [ebx + 0x220]
call fcn.00456f30
mov ecx, eax
test ecx, ecx
je 0x4726ce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x648], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x648]
push esi
call fcn.00460f10
test al, al
jne 0x47249c
test esi, esi
jne 0x472477
xor ecx, ecx
jmp 0x47248f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x472480
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x648]
call fcn.00461270
mov byte [ebp - 4], 3
lea eax, [ebp - 0x218]
push eax
push 0x4ea84c
lea ecx, [ebp - 0x648]
call fcn.00460570
push 0x4e88e8
push str.___
lea ecx, [ebp - 0x648]
call fcn.00460570
mov esi, dword [ebp - 0x648]
mov edi, dword [esi - 0xc]
test edi, edi
js 0x4726c4
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x472500
push edi
lea ecx, [ebp - 0x648]
call fcn.004613a0
mov esi, dword [ebp - 0x648]
lea eax, [edi + 1]
push eax
push esi
call fcn.004b387e
add esp, 8
cmp edi, dword [esi - 8]
jg 0x4726c4
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
mov eax, dword [ebp - 0x678]
test eax, eax
je 0x4726ce
push eax
push esi
call fcn.004b31bb
add esp, 8
test eax, eax
jne 0x472575
mov eax, dword [ebp - 0x64c]
push dword [eax]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x472575
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x641], 1
mov byte [ebp - 4], 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x472591
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
test ebx, ebx
je 0x472600
mov ecx, dword [ebp - 0x674]
mov eax, 0xf6603d99
sub ecx, ebx
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
imul ecx, eax, 0x428
mov eax, ebx
cmp ecx, 0x1000
jb 0x4725d8
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4726bf
push ecx
push ebx
call fcn.004aa25b
add esp, 8
mov dword [ebp - 0x670], 0
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x668], 0
mov esi, dword [ebp - 0x64c]
mov eax, dword [ebp - 0x650]
add esi, 0x22c
inc eax
mov dword [ebp - 0x64c], esi
mov dword [ebp - 0x650], eax
cmp eax, dword [ebp - 0x67c]
jb 0x472380
mov esi, dword [ebp - 0x654]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x47269d
mov ecx, dword [ebp - 0x658]
mov eax, 0x75ded953
sub ecx, esi
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
imul ecx, eax, 0x22c
mov eax, esi
cmp ecx, 0x1000
jb 0x472675
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4726bf
push ecx
push esi
call fcn.004aa25b
add esp, 8
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 0
mov al, byte [ebp - 0x641]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a9b96
mov esp, ebp
pop ebp
ret
call fcn.004b35c4
push 0x80070057
call fcn.00456c80
push 0x80004005
call fcn.00456c80
int3