Function at 0x4522e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x56d380]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 2
mov dword [ebp - 0x670], ecx
mov dword [ebp - 0x668], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x660], eax
cmp eax, 0xffffffff
jne 0x45232e
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00500397
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x56c260]
mov edx, dword [eax + 0xc]
mov ecx, 0x56c260
mov dword [ebp - 0x658], 0x22c
mov dword [ebp - 0x42c], 0x428
call edx
lea esi, [eax + 0x10]
push 0x556338
push edi
mov dword [ebp - 0x65c], esi
call fcn.004fe4a9
mov ecx, dword [ebp - 0x670]
add esp, 8
neg eax
sbb ebx, ebx
neg ebx
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x66c], 1
call fcn.0044e610
mov ecx, dword [ebp - 0x660]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x658]
push eax
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x452596
mov edi, edi
test edi, edi
jne 0x4523da
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x452533
cmp dword [ebp - 0x650], eax
jne 0x452533
mov dword [ebp - 0x664], 1
jmp 0x45253c
test ebx, ebx
je 0x4524c4
cmp dword [ebp - 0x678], 2
jne 0x452490
mov edx, dword [ebp - 0x650]
push edx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x452553
lea eax, [ebp - 0x42c]
push eax
push edi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x45247e
mov edx, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub edx, 0x104
or ecx, edx
jge 0x452444
push 0x104
lea ecx, [ebp - 0x65c]
call fcn.00403d60
mov esi, dword [ebp - 0x65c]
push 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.005025f8
add esp, 8
test eax, eax
js 0x452576
cmp eax, dword [esi - 8]
jg 0x452576
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x668]
jmp 0x452519
lea eax, [ebp - 0x634]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4524a0
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x634]
push edx
lea ecx, [ebp - 0x65c]
call fcn.00403ee0
jmp 0x452513
push ecx
lea eax, [ebp - 0x634]
mov ecx, esp
push eax
call fcn.0042ad10
lea ecx, [ebp - 0x674]
push ecx
mov ecx, dword [ebp - 0x670]
call fcn.0044fdd0
push eax
lea ecx, [ebp - 0x65c]
call fcn.00423fc0
mov eax, dword [ebp - 0x674]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x452513
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x65c]
push edi
push esi
call fcn.004fe94a
add esp, 8
test eax, eax
jne 0x452533
mov dword [ebp - 0x664], 1
jmp 0x45253c
cmp dword [ebp - 0x664], 0
je 0x452559
mov ecx, dword [ebp - 0x650]
push ecx
push 0
push 0x11
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x452580
mov edi, dword [ebp - 0x668]
mov eax, dword [ebp - 0x660]
lea edx, [ebp - 0x658]
push edx
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4523b0
jmp 0x452596
push 0x80070057
call fcn.00404190
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov dword [ebp - 0x66c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x660]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4525bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x66c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00500397
mov esp, ebp
pop ebp
ret 8