Function at 0x4011a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov eax, 0x1478
call fcn.004021b0
mov eax, dword [str.PPLiveU.exe]
mov ecx, dword [0x40a260]
mov edx, dword [0x40a264]
push ebx
push esi
push edi
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], ecx
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x144]
mov dword [esp + 0x140], edx
mov dl, byte [0x40a258]
rep stosd dword es:[edi], eax
mov eax, dword [str.ppap.exe]
mov ecx, dword [0x40a254]
mov dword [esp + 0x23c], eax
mov dword [esp + 0x240], ecx
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x245]
mov byte [esp + 0x244], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x40a248]
mov dx, word [0x40a24c]
stosb byte es:[edi], al
mov eax, dword [str.pplive.exe]
mov dword [esp + 0x344], ecx
mov dword [esp + 0x340], eax
mov al, byte [0x40a24e]
mov byte [esp + 0x34a], al
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x34b]
mov word [esp + 0x348], dx
mov edx, dword [0x40a238]
rep stosd dword es:[edi], eax
mov ecx, dword [str.ppliveva.exe]
stosb byte es:[edi], al
mov eax, dword [0x40a23c]
mov dword [esp + 0x444], ecx
mov cl, byte [0x40a240]
mov dword [esp + 0x44c], eax
mov byte [esp + 0x450], cl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x451]
mov dword [esp + 0x448], edx
mov edx, dword [str.PPStream.exe]
rep stosd dword es:[edi], eax
mov ecx, dword [0x40a22c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x40a228]
mov dword [esp + 0x548], edx
mov dl, byte [0x40a230]
mov dword [esp + 0x54c], eax
mov dword [esp + 0x550], ecx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x555]
mov byte [esp + 0x554], dl
mov dx, word [0x40a220]
rep stosd dword es:[edi], eax
mov ecx, dword [0x40a21c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.PPSAP.exe]
mov dword [esp + 0x650], ecx
mov dword [esp + 0x64c], eax
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x656]
mov word [esp + 0x654], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.Thunder.exe]
mov dword [esp + 0x750], eax
mov ecx, dword [0x40a210]
mov edx, dword [0x40a214]
mov dword [esp + 0x754], ecx
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x75c]
mov dword [esp + 0x758], edx
mov edx, dword [0x40a200]
rep stosd dword es:[edi], eax
mov eax, dword [str.ThunderService.exe]
mov ecx, dword [0x40a1fc]
mov dword [esp + 0x854], eax
mov eax, dword [0x40a204]
mov dword [esp + 0x858], ecx
mov cx, word [0x40a208]
mov dword [esp + 0x85c], edx
mov dl, byte [0x40a20a]
mov dword [esp + 0x860], eax
mov word [esp + 0x864], cx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x867]
mov byte [esp + 0x866], dl
rep stosd dword es:[edi], eax
mov ecx, dword [0x40a1f4]
mov edx, dword [str.dianlei.exe]
stosb byte es:[edi], al
mov eax, dword [str.xmp.exe]
mov dword [esp + 0x95c], ecx
mov dword [esp + 0x958], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x960]
rep stosd dword es:[edi], eax
mov eax, dword [0x40a1e8]
mov ecx, dword [0x40a1ec]
mov dword [esp + 0xa60], eax
mov dword [esp + 0xa64], ecx
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0xa68]
mov dword [esp + 0xa5c], edx
mov edx, dword [str.DUTool.exe]
rep stosd dword es:[edi], eax
mov eax, dword [0x40a1dc]
mov cx, word [0x40a1e0]
mov dword [esp + 0xb60], edx
mov dl, byte [0x40a1e2]
mov dword [esp + 0xb64], eax
mov word [esp + 0xb68], cx
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0xb6b]
mov byte [esp + 0xb6a], dl
rep stosd dword es:[edi], eax
mov ecx, dword [0x40a1cc]
mov edx, dword [0x40a1d0]
stosb byte es:[edi], al
mov eax, dword [str.flashget.exe]
mov dword [esp + 0xc68], ecx
mov dword [esp + 0xc64], eax
mov al, byte [0x40a1d4]
mov byte [esp + 0xc70], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0xc71]
mov dword [esp + 0xc6c], edx
mov edx, dword [0x40a1bc]
rep stosd dword es:[edi], eax
mov ecx, dword [str.QQDownload.exe]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x40a1c0]
mov dword [esp + 0xd68], ecx
mov cx, word [0x40a1c4]
mov dword [esp + 0xd6c], edx
mov dl, byte [0x40a1c6]
mov word [esp + 0xd74], cx
mov dword [esp + 0xd70], eax
mov byte [esp + 0xd76], dl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0xd77]
rep stosd dword es:[edi], eax
mov ecx, dword [0x40a1b0]
mov dx, word [0x40a1b4]
stosb byte es:[edi], al
mov eax, dword [str.emule.exe]
mov dword [esp + 0xe70], ecx
mov dword [esp + 0xe6c], eax
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0xe76]
mov word [esp + 0xe74], dx
mov edx, dword [0x40a1a4]
rep stosd dword es:[edi], eax
mov ecx, dword [0x40a1a0]
stosw word es:[edi], ax
mov eax, dword [str.BitComet.exe]
mov dword [esp + 0xf74], ecx
mov dword [esp + 0xf70], eax
mov al, byte [0x40a1a8]
mov byte [esp + 0xf7c], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0xf7d]
mov dword [esp + 0xf78], edx
mov edx, dword [0x40a190]
rep stosd dword es:[edi], eax
mov ecx, dword [str.BitSpirit.exe]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x40a194]
mov dword [esp + 0x1074], ecx
mov cx, word [0x40a198]
mov dword [esp + 0x107c], eax
mov word [esp + 0x1080], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1082]
mov dword [esp + 0x1078], edx
mov edx, dword [str.vagaa.exe]
rep stosd dword es:[edi], eax
mov cx, word [0x40a188]
stosw word es:[edi], ax
mov eax, dword [0x40a184]
mov word [esp + 0x1180], cx
mov dword [esp + 0x117c], eax
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x1182]
mov dword [esp + 0x1178], edx
mov edx, dword [str.Tuotu.exe]
rep stosd dword es:[edi], eax
mov cx, word [0x40a17c]
stosw word es:[edi], ax
mov eax, dword [0x40a178]
mov word [esp + 0x1284], cx
mov dword [esp + 0x1280], eax
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x1286]
mov dword [esp + 0x127c], edx
mov edx, dword [str.BitTorrent.exe]
rep stosd dword es:[edi], eax
mov ecx, dword [0x40a16c]
stosw word es:[edi], ax
mov eax, dword [0x40a168]
mov dword [esp + 0x1380], edx
mov dx, word [0x40a170]
mov dword [esp + 0x1384], eax
mov al, byte [0x40a172]
mov dword [esp + 0x1388], ecx
mov byte [esp + 0x138e], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x138f]
mov word [esp + 0x138c], dx
xor ebx, ebx
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0xc], esi
je 0x401756
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x14]
push ebp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x128
push ecx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40174e
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
xor esi, esi
lea edi, [esp + 0x13c]
lea edx, [esp + 0x38]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4016f4
inc esi
add edi, 0x104
cmp esi, 0x13
jb 0x4016d6
jmp 0x401737
test ebx, ebx
jne 0x40170e
push 4
push 0x40a15c
push 0x40a130
push ebx
call ebp
mov ebx, eax
cmp ebx, 7
je 0x40174a
cmp ebx, 6
jne 0x401737
mov eax, dword [esp + 0x1c]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4016cd
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1478
ret