Function at 0x402ce0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x148
mov eax, dword [0x425ed0]
xor eax, esp
mov dword [esp + 0x144], eax
fldz
xor eax, eax
mov word [esp], ax
xor ecx, ecx
mov word [esp + 4], cx
fstp qword [esp + 0xc]
fldz
push ebp
push esi
fstp dword [esp + 0x1c]
push 0x104
mov dword [esp + 0x14], eax
call fcn.0040b271
add esp, 4
push 0
mov esi, eax
push 2
mov dword [esp + 0x28], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
test ebp, ebp
je 0x402f2a
lea edx, [esp + 0x24]
push edx
push ebp
mov dword [esp + 0x2c], 0x128
call sub.KERNEL32.dll_Process32First
mov ecx, 0x3625
mov word [0x4231f0], cx
test eax, eax
je 0x402f23
push ebx
mov ebx, esi
lea edx, [esp + 0x4c]
push edi
sub ebx, edx
mov edi, 1
nop
lea eax, [esp + 0x50]
mov cl, byte [eax]
mov byte [ebx + eax], cl
add eax, edi
test cl, cl
jne 0x402d74
push esi
call fcn.0041e351
fld dword [esp + 0x28]
fmul qword [0x41f4e8]
mov ecx, dword [esp + 0x160]
add esp, 4
mov eax, esi
fstp dword [esp + 0x24]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402dc0
test dl, dl
je 0x402dbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402dc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x402da0
xor eax, eax
jmp 0x402dc5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402e88
cmp dword [esp + 0x160], 0
mov eax, 0xfffffde5
mov word [0x423190], ax
je 0x402f03
mov ecx, dword [esp + 0x34]
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov edx, 0xffffd59a
mov word [0x423190], dx
test esi, esi
je 0x402e84
dec dword [esp + 0x10]
mov ax, word [esp + 0x10]
movsx ecx, ax
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
fsub qword [0x423128]
mov dx, word [esp + 0x14]
movsx eax, dx
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fmulp st(1)
call fcn.0040b030
add dword [esp + 0x18], edi
mov word [esp + 0x14], ax
fld qword [0x423128]
fsub qword [0x41f370]
fstp qword [0x423128]
mov cx, word [esp + 0x10]
movsx edx, cx
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
fadd dword [esp + 0x24]
call fcn.0040b030
push 0xffffffffffffffff
push esi
mov word [esp + 0x18], ax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x28]
movzx eax, word [0x424ef8]
imul eax, eax, 0x7533b46d
lea ecx, [esp + 0x2c]
push ecx
mov word [0x424ef8], ax
push ebp
mov dword [esp + 0x34], 0x128
call sub.KERNEL32.dll_Process32Next
mov dx, word [esp + 0x14]
mov cx, word [esp + 0x10]
add dword [esp + 0x14], edi
cmp cx, dx
jg 0x402ef9
movzx edx, word [0x4231f4]
movsx ecx, dx
movzx edx, word [esp + 0x10]
movsx edx, dx
sub edx, ecx
add edx, dword [0x4258d4]
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
fmul dword [0x423380]
fstp dword [0x423380]
dec dword [0x4258d4]
add dword [esp + 0x10], edi
test eax, eax
jne 0x402d70
jmp 0x402f21
mov ax, word [esp + 0x14]
add dword [esp + 0x18], edi
movsx ecx, ax
add ecx, 0x299c2b24
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
fstp qword [esp + 0x1c]
pop edi
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040b194
mov ecx, dword [esp + 0x150]
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebp
xor ecx, esp
call fcn.0040b6a5
add esp, 0x148
ret