Function at 0x403998
Capabilities:
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
mov ecx, 0x4a
push eax
add esp, 0xfffffc2c
push ebx
push esi
push edi
lea edi, [ebp - 0x23c]
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x44f9e4
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.00403930
pop ecx
test eax, eax
je 0x4039d4
push ebx
call fcn.00403978
pop ecx
mov dword [ebp - 0x2d0], 0x94
lea eax, [ebp - 0x2d0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x2c0], 1
jne 0x403a12
push ebx
call fcn.0040380c
pop ecx
test eax, eax
jne 0x403a09
push ebx
call fcn.00403844
pop ecx
test eax, eax
je 0x403a2f
push ebx
call fcn.00403978
pop ecx
jmp 0x403a2f
push ebx
call fcn.00403958
pop ecx
test eax, eax
jne 0x403a28
push ebx
call fcn.004038fc
pop ecx
test eax, eax
je 0x403a2f
push ebx
call fcn.00403978
pop ecx
mov dword [ebp - 0x23c], 0x128
call sub.KERNEL32.DLL_GetCurrentProcessId
mov edi, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x403a9b
jmp 0x403a8a
push str.explorer.exe
lea edx, [ebp - 0x218]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x403a7c
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 4], ecx
cmp edi, dword [ebp - 0x234]
jne 0x403a8a
mov esi, dword [ebp - 0x224]
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x403a5e
cmp esi, dword [ebp - 4]
je 0x403ac0
cmp dword [ebp - 4], 0
je 0x403ac0
push esi
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x403bf3
cmp dword [ebp - 0x2c0], 1
je 0x403bf3
push str.psapi.dll
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403bf3
push str.EnumProcessModules
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4536dc], eax
push str.GetModuleFileNameExA
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4536d8], eax
xor eax, eax
lea edx, [ebp - 0x114]
mov dword [ebp - 0x10], eax
push 0x105
push edx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x44fbbb
lea ecx, [ebp - 0x114]
push ecx
call sub.KERNEL32.DLL_lstrcatA
push str.EXPLORER.EXE
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.DLL_lstrcatA
push esi
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x403bf3
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x12d0]
push eax
push 0x1000
push edx
push edi
call dword [0x4536dc]
test eax, eax
je 0x403bc6
xor esi, esi
lea ebx, [ebp - 0x12d0]
jmp 0x403bbc
push 0x104
lea eax, [ebp - 0x13d4]
push eax
mov edx, dword [ebx]
push edx
push edi
call dword [0x4536d8]
test eax, eax
je 0x403bb8
lea ecx, [ebp - 0x13d4]
push ecx
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x403bb8
mov dword [ebp - 0x10], 1
jmp 0x403bc6
inc esi
add ebx, 4
mov edx, dword [ebp - 0xc]
shr edx, 2
cmp esi, edx
jb 0x403b7e
push edi
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.DLL_FreeLibrary
cmp dword [ebp - 0x10], 0
jne 0x403bf3
mov eax, dword [ebp - 4]
push eax
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret