Function at 0x403d60
Capabilities:
Access peb ldr_data
Encode data using xor
Get disk size
Get graphical window text
Get memory capacity
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x15c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push edi
push 0
push str.ProcessHacker
call esi
test eax, eax
jne 0x403f0a
push eax
push str.Window
call esi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.VCRUNTIME140.dll_strstr]
test eax, eax
je 0x403dc2
push 0x100
lea ecx, [esp + 0x6c]
push ecx
push eax
call edi
lea eax, [esp + 0x68]
push str.Cheat_Engine
push eax
call ebx
add esp, 8
test eax, eax
jne 0x403f0a
push 0
push str.Qt5QWindowIcon
call esi
test eax, eax
je 0x403df5
push 0x100
lea ecx, [esp + 0x6c]
push ecx
push eax
call edi
cmp byte [esp + 0x68], 0x49
jne 0x403df5
cmp byte [esp + 0x69], 0x44
jne 0x403df5
cmp byte [esp + 0x6a], 0x41
je 0x403f0a
push 0
push str.OllyDbg
call esi
test eax, eax
jne 0x403f0a
push eax
push str.Qt5QWindowIcon
call esi
test eax, eax
je 0x403e36
push 0x100
lea ecx, [esp + 0x6c]
push ecx
push eax
call edi
lea eax, [esp + 0x68]
push str.Wireshark
push eax
call ebx
add esp, 8
test eax, eax
jne 0x403f0a
push 0
push str.TStdHttpAnalyzerForm
call esi
test eax, eax
jne 0x403f0a
push eax
push str.Qt5QWindowIcon
call esi
test eax, eax
je 0x403e80
push 0x100
lea ecx, [esp + 0x6c]
push ecx
push eax
call edi
cmp byte [esp + 0x68], 0x78
jne 0x403e80
cmp byte [esp + 0x6b], 0x64
jne 0x403e80
cmp byte [esp + 0x6c], 0x62
jne 0x403e80
cmp byte [esp + 0x6d], 0x67
je 0x403f0a
push 0
push str.PROCEXPL
call esi
test eax, eax
jne 0x403f0a
call fcn.00402890
test al, al
jne 0x403f0a
call fcn.00402f00
test al, al
jne 0x403f0a
push 0x40
lea eax, [esp + 0x2c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x28], 0x40
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [esp + 0x34], 0
ja 0x403ed4
cmp dword [esp + 0x30], 0xfb800000
jb 0x403f0a
push 0
lea eax, [esp + 0x24]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x403f03
cmp dword [esp + 0x24], 0x1b
ja 0x403efc
jb 0x403f0a
cmp dword [esp + 0x20], 0x40000000
jb 0x403f0a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0x403efc
call fcn.00402850
push str.RtlAdjustPrivilege
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.NtRaiseHardError
push str.ntdll.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov esi, eax
lea eax, [esp + 0x13]
push eax
push 0
push 1
push 0x13
call edi
lea eax, [esp + 0x20]
push eax
push 6
push 0
push 0
push 0
push 0xc00002b4
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword fs:[0x30]
mov dword [esp + 0x14], eax
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
nop word [eax + eax]
mov esi, dword [ecx + 0x18]
mov dword [esp + 0x1c], esi
mov edx, dword [esi + 0x3c]
mov eax, dword [edx + esi + 0x78]
add eax, esi
mov dword [esp + 0x18], eax
cmp eax, esi
je 0x403fe4
mov edi, dword [eax + 0x18]
test edi, edi
je 0x403fe4
mov eax, dword [eax + 0x20]
lea ebx, [eax + edi*4]
add ebx, esi
mov eax, dword [ebx - 4]
lea ebx, [ebx - 4]
add eax, esi
dec edi
mov esi, 0x811c9dc5
mov dl, byte [eax]
inc eax
test dl, dl
je 0x403fdd
nop dword [eax]
movsx edx, dl
lea eax, [eax + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [eax - 1]
test dl, dl
jne 0x403fc0
cmp esi, 0x4105fc56
je 0x403fe8
mov esi, dword [ecx + 0x18]
test edi, edi
jne 0x403fa7
mov ecx, dword [ecx]
jmp 0x403f80
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push dword [esp + 0x14]
mov eax, dword [esi + 0x24]
push 0
push 0x401
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, 0x5f5e109
push 4
call edi
add esp, 4
sub esi, 1
jne 0x404026
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3