Function at 0x40f696
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x431f1d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x145c
call fcn.0042d800
mov eax, dword [0x43e030]
xor eax, esp
mov dword [esp + 0x1458], eax
push ebx
push esi
push edi
mov eax, dword [0x43e030]
xor eax, esp
push eax
lea eax, [esp + 0x1470]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x24], eax
cmp esi, ebx
je 0x40f926
cmp word [esi], bx
je 0x40f926
cmp dword [ebp + 8], ebx
je 0x40f926
cmp eax, ebx
je 0x40f926
xor eax, eax
push 0x206
mov word [esp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [esp + 0x1262]
push ebx
push eax
call fcn.00421bc0
add esp, 0xc
push 0x437bd8
push esi
lea eax, [esp + 0x1264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
or dword [esp + 0x20], 0xffffffff
lea eax, [esp + 0x28]
push eax
push reloc.KERNEL32.dll_WaitForMultipleObjects
lea eax, [esp + 0x54]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x40f926
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x30]
push eax
shr edi, 2
call fcn.0040b9f1
xor eax, eax
mov dword [esp + 0x1478], ebx
push 0x208
mov word [esp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [esp + 0x1052]
push ebx
push eax
call fcn.00421bc0
add esp, 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp edi, ebx
jbe 0x40f87a
mov eax, dword [esp + 0x14]
push dword [esp + eax*4 + 0x4c]
push ebx
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, ebx
je 0x40f86c
lea eax, [esp + 0x48]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40f865
push 0x104
lea eax, [esp + 0x1050]
push eax
push dword [esp + 0x20]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [esp + 0x125c]
push eax
lea eax, [esp + 0x1050]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x40f865
lea eax, [esp + 0x104c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor esi, esi
cmp dword [ebp + 0x10], ebx
mov dword [esp + 0x2c], eax
jle 0x40f86c
mov eax, dword [esp + 0x24]
push dword [eax + esi*4]
push dword [esp + 0x30]
call fcn.0041faf6
pop ecx
pop ecx
test eax, eax
je 0x40f849
inc esi
cmp esi, dword [ebp + 0x10]
jl 0x40f82b
jmp 0x40f86c
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ebx, [esp + 0x1c]
lea esi, [esp + 0x30]
call fcn.00417ee4
xor ebx, ebx
jmp 0x40f86c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jb 0x40f7a5
mov esi, dword [esp + 0x40]
sub esi, dword [esp + 0x3c]
sar esi, 2
cmp esi, ebx
jbe 0x40f917
xor ecx, ecx
push 4
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041edea
mov edi, eax
pop ecx
cmp edi, ebx
je 0x40f8eb
test esi, esi
jbe 0x40f8d1
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x3c]
sar eax, 2
cmp ebx, eax
jb 0x40f8c2
call fcn.004203c7
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + ebx*4]
mov dword [edi + ebx*4], eax
inc ebx
cmp ebx, esi
jb 0x40f8ae
push dword [ebp + 8]
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push edi
mov dword [esp + 0x24], eax
call fcn.0041f319
pop ecx
xor ebx, ebx
xor edi, edi
cmp esi, ebx
jbe 0x40f917
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x3c]
sar eax, 2
cmp edi, eax
jb 0x40f905
call fcn.004203c7
mov eax, dword [esp + 0x3c]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, esi
jb 0x40f8f1
lea esi, [esp + 0x30]
call fcn.00417ec1
mov eax, dword [esp + 0x20]
jmp 0x40f929
or eax, 0xffffffff
mov ecx, dword [esp + 0x1470]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1458]
xor ecx, esp
call fcn.0041f23c
mov esp, ebp
pop ebp
ret