Function at 0x41b4f4
Capabilities:
Enumerate gui resources
Enumerate processes
Terminate process

Disassembly:
push 0x2d4
mov eax, 0x4952f8
call fcn.0047a393
mov ebx, ecx
mov dword [ebp - 0x2cc], ebx
xor esi, esi
mov dword [ebp - 0x2e0], esi
mov dword [ebp - 0x2dc], esi
mov dword [ebp - 0x2d8], esi
push 0x4ae3dc
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.00414daf
push esi
push 2
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c8], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
or esi, 0xffffffff
cmp edi, esi
je 0x41b7df
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x41b57a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffe
pop esi
jmp 0x41b7df
lea eax, [ebp - 0x2a0]
push eax
call fcn.00413cf3
pop ecx
push eax
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004152c1
push ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x60]
call fcn.0041f605
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.0041fba5
add eax, 0x18
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
cmp ecx, eax
je 0x41b5cd
push esi
push 0
push eax
call fcn.00414fa2
lea ecx, [ebp - 0x94]
call fcn.0041f857
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.0041f857
push ebx
call fcn.00413cf3
pop ecx
push eax
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0041cedc
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, esi
je 0x41b68e
push dword [ebp - 0x2bc]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x41b67c
push eax
call ebx
mov eax, dword [ebp - 0x2bc]
and dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2d4], eax
lea eax, [ebp - 0x2d4]
push eax
push 0x41b4bd
call dword [sym.imp.USER32.dll_EnumWindows]
push dword [ebp - 0x2bc]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2c8], eax
test eax, eax
je 0x41b670
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x2c8]
push eax
call ebx
xor eax, eax
inc eax
mov dword [ebp - 0x2c8], eax
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.00414e76
lea eax, [ebp - 0x2a0]
push eax
call fcn.00413cf3
pop ecx
push eax
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004152c1
push ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041f605
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.0041fba5
add eax, 0x18
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
cmp ecx, eax
je 0x41b6e1
push esi
push 0
push eax
call fcn.00414fa2
lea ecx, [ebp - 0x60]
call fcn.0041f857
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.0041f857
push dword [ebp - 0x2cc]
call fcn.00413cf3
pop ecx
push eax
push 0
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0x2c]
call fcn.0041cedc
cmp eax, esi
je 0x41b7b8
push dword [ebp - 0x2bc]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x41b7a6
push eax
call ebx
mov eax, dword [ebp - 0x2bc]
and dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2d4], eax
lea eax, [ebp - 0x2d4]
push eax
push 0x41b4bd
call dword [sym.imp.USER32.dll_EnumWindows]
push dword [ebp - 0x2bc]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2c8], eax
test eax, eax
je 0x41b799
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [ebp - 0x2c8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x2c8]
push eax
call ebx
mov dword [ebp - 0x2c8], 1
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.00414e76
lea eax, [ebp - 0x2c4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41b68e
push edi
call ebx
mov esi, dword [ebp - 0x2c8]
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffffd
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00415035
lea ecx, [ebp - 0x2e0]
call fcn.00414f38
mov eax, esi
call fcn.0047a342
ret