Function at 0x47ffa0
Capabilities:
Enumerate processes
Get disk information
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a7471
mov eax, dword fs:[0]
push eax
sub esp, 0x668
mov eax, dword [0x4cd290]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
push edi
mov eax, dword [0x4cd290]
xor eax, esp
push eax
lea eax, [esp + 0x678]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
push 0x206
mov edi, ecx
lea ecx, [esp + 0x262]
push esi
push ecx
mov dword [esp + 0x34], eax
mov word [esp + 0x268], si
call fcn.004863a0
push 0x228
lea edx, [esp + 0x40]
push esi
push edx
mov dword [esp + 0x44], esi
call fcn.004863a0
add esp, 0x18
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call fcn.0040f1d0
mov dword [esp + 0x680], esi
call fcn.0047e1f0
cmp dword [0x4cff38], 0xffffffff
jne 0x480153
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x48007a
push 0x4cff38
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
jne 0x480153
mov dword [0x4cff38], 0
push edi
lea ecx, [esp + 0x18]
call fcn.0040f480
lea ecx, [esp + 0x14]
call fcn.0040f0f0
push eax
push str.KillProcessByPath_path:_ws
mov ecx, 0x4d1508
call fcn.00481c20
add esp, 8
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x20], edi
je 0x480352
lea eax, [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x34], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x48034b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
cmp eax, dword [esp + 0x24]
je 0x48032d
test eax, eax
je 0x48032d
cmp eax, 4
je 0x48032d
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x48032d
call fcn.0047e350
test eax, eax
je 0x48025b
mov eax, dword [0x4d1460]
test eax, eax
je 0x48025b
push 0x104
lea ecx, [esp + 0x260]
push ecx
push esi
call eax
jmp 0x48027a
cmp dword [0x4cff38], 0
je 0x480084
lea ecx, [esp + 0x20]
call fcn.0040f1d0
push 0x206
lea eax, [esp + 0x46a]
push 0
mov byte [esp + 0x688], 1
push eax
mov word [esp + 0x470], 0
call fcn.004863a0
movzx ecx, word [edi]
push ecx
lea edx, [esp + 0x30]
push 0x4bf9ac
push edx
call fcn.00413ba0
add esp, 0x18
push 0x104
lea eax, [esp + 0x468]
push eax
lea ecx, [esp + 0x28]
call fcn.0040f0f0
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea ecx, [esp + 0x464]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040f480
push 1
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x1c]
call fcn.0041f800
push 0x4bed2c
mov ecx, eax
mov byte [esp + 0x684], 2
call fcn.00421e10
test eax, eax
lea ecx, [esp + 0x24]
setne bl
mov byte [esp + 0x680], 1
call fcn.0040f420
test bl, bl
je 0x48021f
push 0x4bed2c
lea ecx, [esp + 0x18]
call fcn.0041f410
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x480224
sub eax, edx
sar eax, 1
cmp eax, 3
jbe 0x480245
add edi, 6
push edi
lea ecx, [esp + 0x18]
call fcn.0041f410
lea ecx, [esp + 0x20]
mov byte [esp + 0x680], 0
call fcn.0040f420
jmp 0x48008e
mov eax, dword [0x4d145c]
test eax, eax
je 0x480320
push 0x104
lea edx, [esp + 0x260]
push edx
push 0
push esi
call eax
mov edi, eax
test edi, edi
je 0x480320
lea ecx, [esp + 0x14]
call fcn.0040f660
cmp dword [ebp + 0xc], 0
je 0x4802c1
cmp edi, eax
jbe 0x480320
lea ecx, [esp + 0x14]
call fcn.0040f660
push eax
lea eax, [esp + 0x260]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040f0f0
push eax
call fcn.0048b127
add esp, 0xc
jmp 0x4802df
cmp edi, eax
jne 0x480320
lea eax, [esp + 0x25c]
push eax
lea ecx, [esp + 0x18]
call fcn.0040f0f0
push eax
call fcn.00486a9c
add esp, 8
test eax, eax
jne 0x480320
push eax
push esi
call ebx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x25c]
push ecx
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Terminate_Process_return:_d__error:_d__pid:_d__path:_ws
mov ecx, 0x4d1508
call fcn.00481c20
add esp, 0x14
test edi, edi
jne 0x48031b
add dword [esp + 0x1c], 1
jmp 0x480320
add dword [esp + 0x18], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x20]
xor esi, esi
lea eax, [esp + 0x2c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4800ed
test esi, esi
je 0x48034b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x480360
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ecx, [esp + 0x14]
call fcn.0040f420
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x678]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.004851ae
mov esp, ebp
pop ebp
ret