Function at 0x473f40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x240], str.ollyDbg
push edi
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x23c], 0x4fd6ec
mov dword [ebp - 0x238], str.x64dbg
mov dword [ebp - 0x234], str.x32dbg
mov dword [ebp - 0x230], str.WindDbg
mov dword [ebp - 0x22c], str.Soft_Ice
mov dword [ebp - 0x228], 0x4fd714
mov dword [ebp - 0x224], str.x32Dbg
mov dword [ebp - 0x220], str.x64Dbg
mov dword [ebp - 0x21c], str.x32_x64Dbg_Launcher
mov dword [ebp - 0x218], str.IDA_native_Windows__deprecated_
mov dword [ebp - 0x214], str.IDA_console
mov dword [ebp - 0x210], str.IDA_Qt
mov dword [ebp - 0x20c], str.WinDbg
mov dword [ebp - 0x208], str.OllyDbg_Fork__Immunity_Debugger_
mov dword [ebp - 0x204], str.dnSpy_.Net_Debugger
mov dword [ebp - 0x200], 0x4fd7b4
mov dword [ebp - 0x1fc], str.OllyDumpEx_x32_Edition
mov dword [ebp - 0x1f8], str.OllyDumpEx_x64_Edition
mov dword [ebp - 0x1f4], str.Scylla_x32_Edition
mov dword [ebp - 0x1f0], str.Scylla_x64_Edition
mov dword [ebp - 0x1ec], str.32770
mov dword [ebp - 0x1e8], 0x4fb004
mov dword [ebp - 0x1e4], str.Process_Monitor
mov dword [ebp - 0x1e0], str.File_Monitor___deprecated__now_Process_Monitor_
mov dword [ebp - 0x1dc], str.Registry_Monitor__deprecated__now_Process_Monitor_
mov dword [ebp - 0x1d8], str.Process_Explorer
mov dword [ebp - 0x1d4], str.Process_Explorer__x64_
mov dword [ebp - 0x1d0], str.TCP_View
mov dword [ebp - 0x1cc], str.Wireshark__up_tp_v2_
mov dword [ebp - 0x1c8], str.Wireshark__v2_
mov dword [ebp - 0x1c4], str.SmartSniffer
mov dword [ebp - 0x1c0], str.FakeNet
mov dword [ebp - 0x1bc], str.API_Monitor__x64_
mov dword [ebp - 0x1b8], str.API_Monitor__x86_
mov dword [ebp - 0x1b4], str.Autoruns___Autoruns
mov dword [ebp - 0x1b0], str.Microsoft_Network_Monitor
mov dword [ebp - 0x1ac], str.Regshot__ANSI__x64
mov dword [ebp - 0x1a8], str.Regshot__Unicode__x64
mov dword [ebp - 0x1a4], str.Regshot__ANSI__x86
mov dword [ebp - 0x1a0], str.Regshot__Unicode__x64
mov dword [ebp - 0x19c], str.PEiD
mov dword [ebp - 0x198], str.Lord_PE
mov dword [ebp - 0x194], str.PE_Bear
mov dword [ebp - 0x190], str.Professional_PE_Explorer
mov dword [ebp - 0x18c], str.Detect_It_Easy
mov dword [ebp - 0x188], str.Detect_It_Easy_Light_Edition
mov dword [ebp - 0x184], str.PE_Explorer
mov dword [ebp - 0x180], str.Dependency_Walker
mov dword [ebp - 0x17c], str.Resource_Hacker
mov dword [ebp - 0x178], str.File_Alyzer_2
mov dword [ebp - 0x174], str.Process_Hacker__
mov dword [ebp - 0x170], str.ProcessHacker
mov dword [ebp - 0x16c], str.Detect_It_Easy
mov dword [ebp - 0x168], 0x4fda5c
mov dword [ebp - 0x164], 0x4fda60
mov dword [ebp - 0x160], str.TCPViewClass
mov dword [ebp - 0x15c], str.icu_dbg
mov dword [ebp - 0x158], str.WinDbgFrameClass
mov dword [ebp - 0x154], str.OLLYDBG
mov dword [ebp - 0x150], str.pe_diy
mov dword [ebp - 0x14c], str.antidbg
mov dword [ebp - 0x148], str.ObsidianGUI
mov dword [ebp - 0x144], str.Rock_Debugger
mov dword [ebp - 0x140], str.SunAwtFrame
mov dword [ebp - 0x13c], str.Qt5QWindowIcon
mov dword [ebp - 0x138], str.Zeta_Debugger
mov dword [ebp - 0x134], str.GBDYLLO
mov dword [ebp - 0x130], str.pediy06
mov dword [ebp - 0x12c], str.File_Monitor___Sysinternals:_www.sysinternals.com
mov dword [ebp - 0x128], str.FilemonClass
mov dword [ebp - 0x124], str.Process_Monitor___Sysinternals:_www.sysinternals.com
mov dword [ebp - 0x120], str.RegmonClass
mov dword [ebp - 0x11c], str.Registry_Monitor___Sysinternals:_www.sysinternals.com
mov dword [ebp - 0x118], str.18467_41
mov dword [ebp - 0x114], str.UST_2bg
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
xor esi, esi
mov dword [ebp - 0x110], str.EZViewer
mov dword [ebp - 0x10c], str.KsDumper
mov dword [ebp - 0x108], str.KsDumper11
mov dword [ebp - 0x104], str.BinText
mov dword [ebp - 0x100], str.AnalogX_TextScan__www.analogx.com_
mov dword [ebp - 0xfc], str.AnalogX_TextScan
mov dword [ebp - 0xf8], str.BlueScreenView
mov dword [ebp - 0xf4], str.Wireshark
mov dword [ebp - 0xf0], str.Exe2Aut___Autoit3_Decompiler
mov dword [ebp - 0xec], str.Exe2Aut
mov dword [ebp - 0xe8], str.myAut2Exe
mov dword [ebp - 0xe4], str.Cutter
mov dword [ebp - 0xe0], str.Ghidra
mov dword [ebp - 0xdc], str.dnSpyEx
mov dword [ebp - 0xd8], str.ExtremeDumper
mov dword [ebp - 0xd4], str.ILSpy
mov dword [ebp - 0xd0], str.Fhex
mov dword [ebp - 0xcc], str.ImHex
mov dword [ebp - 0xc8], str.Reverse_Engineers
mov dword [ebp - 0xc4], str.Exeinfo
mov dword [ebp - 0xc0], str.PE_bear
mov dword [ebp - 0xbc], str.pestudio
mov dword [ebp - 0xb8], str.API_Monitor
mov dword [ebp - 0xb4], str.FileGrab
mov dword [ebp - 0xb0], str.QuickUnpack
mov dword [ebp - 0xac], str.XVolkolak
mov dword [ebp - 0xa8], str.XVolkolak_0.22
mov dword [ebp - 0xa4], str.DeDe
mov dword [ebp - 0xa0], str.ExtremeDumper
mov dword [ebp - 0x9c], str.HDasm
mov dword [ebp - 0x98], str.P32Dasm
mov dword [ebp - 0x94], str.kWdsm
mov dword [ebp - 0x90], str.SND_RT
mov dword [ebp - 0x8c], str.CFF_Explorer
mov dword [ebp - 0x88], str.WinHex
mov dword [ebp - 0x84], str.WindowHack
mov dword [ebp - 0x80], str.APIMonitor
mov dword [ebp - 0x7c], str.Filemon
mov dword [ebp - 0x78], str.Regmon
mov dword [ebp - 0x74], str.Regshot
mov dword [ebp - 0x70], str.WinSpy
mov dword [ebp - 0x6c], str.exeinfope
mov dword [ebp - 0x68], str.AT4RE_FastScanner
mov dword [ebp - 0x64], str.PEiD
mov dword [ebp - 0x60], str.Protection_ID
mov dword [ebp - 0x5c], str.xpeviewer
mov dword [ebp - 0x58], str.IceSword
mov dword [ebp - 0x54], str.Kernel_Detective
mov dword [ebp - 0x50], str.eXeScope
mov dword [ebp - 0x4c], str.pexplorer
mov dword [ebp - 0x48], str.ResHacker
mov dword [ebp - 0x44], str.LordPE
mov dword [ebp - 0x40], str.PETools
mov dword [ebp - 0x3c], str.Pepper
mov dword [ebp - 0x38], str.de4dot
mov dword [ebp - 0x34], str.dnSpy
mov dword [ebp - 0x30], str.PYG_DLL_Patcher
mov dword [ebp - 0x2c], str.Fiddler
mov dword [ebp - 0x28], str.fiddler
mov dword [ebp - 0x24], str.wireshark
mov dword [ebp - 0x20], str.Wireshark
mov dword [ebp - 0x1c], str.CheatEngine
mov dword [ebp - 0x18], 0x4fde2c
mov dword [ebp - 0x14], str.Cheat_Engine
mov dword [ebp - 0x10], str.LunarEngine
mov dword [ebp - 0xc], 0x4fde58
mov dword [ebp - 8], str.Lunar_Engine
push dword [ebp + esi*4 - 0x240]
push 0
call edi
test eax, eax
je 0x4744ef
lea ecx, [ebp - 0x25c]
call fcn.004605e0
mov ecx, dword [ebp - 0x248]
or ebx, 3
and ebx, 0xfffffffe
cmp ecx, 0xf
jbe 0x4744ef
mov edx, dword [ebp - 0x25c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4744e5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x474585
push ecx
push edx
call fcn.00487522
add esp, 8
inc esi
cmp esi, 0x8f
jl 0x474495
push 0
push str.WinDbgFrameClass
call edi
test eax, eax
jne 0x47457d
push eax
push str.OLLYDBG
call edi
test eax, eax
jne 0x47457d
push eax
push 0x4fb004
call edi
test eax, eax
jne 0x47457d
push eax
push str.Zeta_Debugger
call edi
test eax, eax
jne 0x47457d
push eax
push str.Rock_Debugger
call edi
test eax, eax
jne 0x47457d
push eax
push str.ObsidianGUI
call edi
test eax, eax
jne 0x47457d
push eax
push str.PROCMON_WINDOW_CLASS
call edi
test eax, eax
jne 0x47457d
push eax
push str.OllyDbg
call edi
test eax, eax
jne 0x47457d
push eax
push str.icu_dbg
call edi
test eax, eax
jne 0x47457d
push eax
push str.TIdaWindow
call edi
test eax, eax
jne 0x47457d
push eax
push str.Process_Monitor___Sysinternals:_www.sysinternals.com
call edi
test eax, eax
je 0x47458b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret