Function at 0x40350c
Capabilities:
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
mov ecx, 0x4a
push eax
add esp, 0xfffffc2c
push ebx
push esi
push edi
lea edi, [ebp - 0x23c]
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x44d9e8
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.004034a4
pop ecx
test eax, eax
je 0x403548
push ebx
call fcn.004034ec
pop ecx
mov dword [ebp - 0x2d0], 0x94
lea eax, [ebp - 0x2d0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x2c0], 1
jne 0x403586
push ebx
call fcn.00403380
pop ecx
test eax, eax
jne 0x40357d
push ebx
call fcn.004033b8
pop ecx
test eax, eax
je 0x4035a3
push ebx
call fcn.004034ec
pop ecx
jmp 0x4035a3
push ebx
call fcn.004034cc
pop ecx
test eax, eax
jne 0x40359c
push ebx
call fcn.00403470
pop ecx
test eax, eax
je 0x4035a3
push ebx
call fcn.004034ec
pop ecx
mov dword [ebp - 0x23c], 0x128
call sub.KERNEL32.DLL_GetCurrentProcessId
mov edi, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x40360f
jmp 0x4035fe
push str.explorer.exe
lea edx, [ebp - 0x218]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4035f0
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 4], ecx
cmp edi, dword [ebp - 0x234]
jne 0x4035fe
mov esi, dword [ebp - 0x224]
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4035d2
cmp esi, dword [ebp - 4]
je 0x403634
cmp dword [ebp - 4], 0
je 0x403634
push esi
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x403767
cmp dword [ebp - 0x2c0], 1
je 0x403767
push str.psapi.dll
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403767
push str.EnumProcessModules
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x450e40], eax
push str.GetModuleFileNameExA
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x450e3c], eax
xor eax, eax
lea edx, [ebp - 0x114]
mov dword [ebp - 0x10], eax
push 0x105
push edx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x44dbbf
lea ecx, [ebp - 0x114]
push ecx
call sub.KERNEL32.DLL_lstrcatA
push str.EXPLORER.EXE
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.DLL_lstrcatA
push esi
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x403767
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x12d0]
push eax
push 0x1000
push edx
push edi
call dword [0x450e40]
test eax, eax
je 0x40373a
xor esi, esi
lea ebx, [ebp - 0x12d0]
jmp 0x403730
push 0x104
lea eax, [ebp - 0x13d4]
push eax
mov edx, dword [ebx]
push edx
push edi
call dword [0x450e3c]
test eax, eax
je 0x40372c
lea ecx, [ebp - 0x13d4]
push ecx
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40372c
mov dword [ebp - 0x10], 1
jmp 0x40373a
inc esi
add ebx, 4
mov edx, dword [ebp - 0xc]
shr edx, 2
cmp esi, edx
jb 0x4036f2
push edi
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.DLL_FreeLibrary
cmp dword [ebp - 0x10], 0
jne 0x403767
mov eax, dword [ebp - 4]
push eax
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret