Function at 0x48e890
Capabilities:
Enumerate processes
Get disk information
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c80e1
mov eax, dword fs:[0]
push eax
sub esp, 0x668
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x678]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
push 0x206
mov edi, ecx
lea ecx, [esp + 0x262]
push esi
push ecx
mov dword [esp + 0x34], eax
mov word [esp + 0x268], si
call fcn.004a1d00
push 0x228
lea edx, [esp + 0x40]
push esi
push edx
mov dword [esp + 0x44], esi
call fcn.004a1d00
add esp, 0x18
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call fcn.00417ee0
mov dword [esp + 0x680], esi
call fcn.0048c720
call fcn.0048cb40
test eax, eax
je 0x48ea34
lea ecx, [esp + 0x20]
call fcn.00417ee0
push 0x206
lea eax, [esp + 0x46a]
push esi
mov byte [esp + 0x688], 1
push eax
mov word [esp + 0x470], si
call fcn.004a1d00
movzx ecx, word [edi]
push ecx
lea edx, [esp + 0x30]
push 0x4e2504
push edx
call fcn.0041b3f0
add esp, 0x18
push 0x104
lea eax, [esp + 0x468]
push eax
lea ecx, [esp + 0x28]
call fcn.004636c0
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea ecx, [esp + 0x464]
push ecx
lea ecx, [esp + 0x18]
call fcn.00403080
push 1
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x1c]
call fcn.0043ac40
push 0x4e1d00
mov ecx, eax
mov byte [esp + 0x684], 2
call fcn.0043ceb0
test eax, eax
lea ecx, [esp + 0x24]
setne bl
mov byte [esp + 0x680], 1
call fcn.00403050
test bl, bl
je 0x48e9f3
push 0x4e1d00
lea ecx, [esp + 0x18]
call fcn.004030b0
mov eax, edi
lea edx, [eax + 2]
jmp 0x48ea00
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48ea00
sub eax, edx
sar eax, 1
cmp eax, 3
jbe 0x48ea21
add edi, 6
push edi
lea ecx, [esp + 0x18]
call fcn.004030b0
lea ecx, [esp + 0x20]
mov byte [esp + 0x680], 0
call fcn.00403050
jmp 0x48ea3e
push edi
lea ecx, [esp + 0x18]
call fcn.00403080
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x20], edi
je 0x48ebd1
lea eax, [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x34], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x48ebca
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
cmp eax, dword [esp + 0x24]
je 0x48ebac
test eax, eax
je 0x48ebac
cmp eax, 4
je 0x48ebac
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x48ebac
call fcn.0048cb40
test eax, eax
je 0x48ead6
mov eax, dword [0x4f8888]
test eax, eax
je 0x48ead6
push 0x104
lea ecx, [esp + 0x260]
push ecx
push esi
call eax
jmp 0x48eaf5
mov eax, dword [0x4f8884]
test eax, eax
je 0x48eb9f
push 0x104
lea edx, [esp + 0x260]
push edx
push 0
push esi
call eax
mov edi, eax
test edi, edi
je 0x48eb9f
lea ecx, [esp + 0x14]
call fcn.00418070
cmp dword [ebp + 0xc], 0
je 0x48eb3c
cmp edi, eax
jbe 0x48eb9f
lea ecx, [esp + 0x14]
call fcn.00418070
push eax
lea eax, [esp + 0x260]
push eax
lea ecx, [esp + 0x1c]
call fcn.004636c0
push eax
call fcn.004a701d
add esp, 0xc
jmp 0x48eb5a
cmp edi, eax
jne 0x48eb9f
lea eax, [esp + 0x25c]
push eax
lea ecx, [esp + 0x18]
call fcn.004636c0
push eax
call fcn.004a35b4
add esp, 8
test eax, eax
jne 0x48eb9f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x25c]
push ecx
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Terminate_Process_return:_d__error:_d__pid:_d__path:_ws
mov ebx, 0x4f8948
call fcn.0048a740
add esp, 0x14
test edi, edi
jne 0x48eb9a
add dword [esp + 0x1c], 1
jmp 0x48eb9f
add dword [esp + 0x18], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x20]
xor esi, esi
lea eax, [esp + 0x2c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x48ea7b
test esi, esi
je 0x48ebca
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x48ebdf
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ecx, [esp + 0x14]
call fcn.00403050
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x678]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.004a1723
mov esp, ebp
pop ebp
ret