Function at 0x401410
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x49c
mov eax, dword [0x405040]
xor eax, esp
mov dword [esp + 0x498], eax
push ebx
push esi
push edi
mov eax, dword [0x40548c]
mov esi, dword [0x405488]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
mov byte [esp + 0xf], 0
mov dword [esp + 0x10], eax
cmp esi, eax
je 0x401599
nop
push 0
push 2
mov dword [esp + 0x278], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x401570
lea eax, [esp + 0x270]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40148f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401570
lea eax, [esp + 0x270]
push eax
push edi
call ebx
test eax, eax
je 0x401483
nop
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x4014aa
mov eax, dword [esi]
push eax
lea eax, [esp + 0x298]
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
add esp, 8
test eax, eax
jne 0x4014db
lea eax, [esp + 0x270]
push eax
push edi
call ebx
test eax, eax
jne 0x4014a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401570
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40156a
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x401567
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x401567
nop dword [eax]
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x40152a
mov eax, dword [esi]
push eax
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
add esp, 8
test eax, eax
je 0x401551
push dword [esp + 0x38]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4015c7
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401520
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
mov al, byte [esp + 0xf]
add esi, 0x18
cmp esi, dword [esp + 0x10]
jne 0x401450
test al, al
je 0x401599
push 0x30
push str.Cheat_Detected
push str.Detected_and_terminated_cheating_process.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x28]
call fcn.004012f0
mov esi, dword [esp + 0x2c]
cmp esi, 0x7ffffffd
jg 0x4015ea
mov ebx, dword [esp + 0x28]
jl 0x4015bc
cmp ebx, 0xabf41bff
jae 0x4015ea
add ebx, 0x540be400
adc esi, 2
jmp 0x4015f2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push ebx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
mov al, 1
mov byte [esp + 0xf], al
jmp 0x401574
or ebx, 0xffffffff
mov esi, 0x7fffffff
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
nop word [eax + eax]
lea ecx, [esp + 0x18]
call fcn.004012f0
cmp dword [esp + 0x1c], esi
jg 0x40142d
jl 0x40161f
cmp dword [esp + 0x18], ebx
jae 0x40142d
call dword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
push 0
push 0x64
push edx
push eax
call fcn.00402b20
sub ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x14]
mov edi, edx
sbb eax, dword [esp + 0x1c]
mov ecx, ebx
mov edx, eax
mov dword [esp + 0x24], eax
call fcn.00402b60
comisd xmm0, xmmword [0x403288]
jbe 0x401665
add esi, 0xad160000
adc edi, 0x311cd
jmp 0x40166b
add esi, ebx
adc edi, dword [esp + 0x24]
push 0
push 0x3b9aca00
push edi
push esi
call fcn.00402990
mov dword [esp + 0x260], eax
imul eax, eax, 0x3b9aca00
mov dword [esp + 0x264], edx
sub esi, eax
lea eax, [esp + 0x260]
push eax
mov dword [esp + 0x26c], esi
call dword [sym.imp.MSVCP140.dll__Thrd_sleep]
mov ebx, dword [esp + 0x14]
add esp, 4
mov esi, dword [esp + 0x14]
jmp 0x401600