Function at 0x10048eb0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085a9e
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x23c], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x10048f2c
cmp dword [ebp + 0x1c], 8
jb 0x10048f25
mov ecx, dword [ebp + 8]
push ecx
call fcn.10066b10
add esp, 4
xor eax, eax
jmp 0x100490f6
lea edx, [ebp - 0x23c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x100490df
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x10048f8d
lea ebx, [eax + eax]
mov eax, ebx
call fcn.1006b0f0
mov edi, esp
test edi, edi
je 0x10048f8d
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x218]
push ecx
push 0
push 3
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, edi
mov ebx, eax
jmp 0x10048f8f
xor ebx, ebx
mov edx, dword [0x100a57c4]
mov eax, dword [edx + 0xc]
mov ecx, 0x100a57c4
call eax
add eax, 0x10
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 1
test ebx, ebx
je 0x10048fd4
test ebx, 0xffff0000
jne 0x10048fd4
movzx edi, bx
call fcn.1000b0c0
test eax, eax
je 0x10048fdf
push eax
mov eax, edi
lea edi, [ebp - 0x240]
call fcn.1000b3a0
jmp 0x10048fdf
lea eax, [ebp - 0x240]
call fcn.1000a160
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x240]
cmp dword [eax - 4], 1
jle 0x10048fff
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [ebp - 0x240]
push edx
call fcn.1000b1a0
mov esi, dword [ebp - 0x240]
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10049010
mov ebx, dword [ebp + 0x18]
sub eax, edx
sar eax, 1
mov edi, ebx
cmp ebx, eax
jb 0x1004902a
mov edi, eax
cmp dword [ebp + 0x1c], 8
mov edx, dword [ebp + 8]
jae 0x10049036
lea edx, [ebp + 8]
mov ecx, esi
test edi, edi
je 0x1004905b
lea esp, [esp]
mov si, word [edx]
cmp si, word [ecx]
jne 0x10049053
add edx, 2
add ecx, 2
dec edi
jne 0x10049040
jmp 0x1004905b
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jne 0x1004906b
cmp ebx, eax
jae 0x10049064
or ecx, 0xffffffff
jmp 0x1004906b
xor ecx, ecx
cmp ebx, eax
setne cl
test ecx, ecx
sete al
test al, al
je 0x1004909d
mov eax, dword [ebp - 0x234]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x240]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100490c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x244]
lea ecx, [ebp - 0x23c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10048f42
cmp dword [ebp + 0x1c], 8
jb 0x100490f1
mov eax, dword [ebp + 8]
push eax
call fcn.10066b10
add esp, 4
mov eax, 1
lea esp, [ebp - 0x254]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret