Function at 0x40ad30
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
mov eax, 0x1918
call fcn.0040cd60
push ebx
push ebp
mov ebp, dword [esp + 0x1924]
push esi
push edi
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
mov dword [esp + 0x24], ecx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
cmp esi, 1
jl 0x40b42a
cmp esi, 0x104
jg 0x40b42a
xor edi, edi
test esi, esi
jle 0x40ad96
lea eax, [esp + 0xc4]
sub ebp, eax
lea ebx, [esp + edi + 0xc4]
movsx ecx, byte [ebx + ebp]
push ecx
call fcn.0040d47b
add esp, 4
inc edi
cmp edi, esi
mov byte [ebx], al
jl 0x40ad7b
mov byte [esp + esi + 0xc4], 0
mov esi, str.__KILL_BY_PID__
lea eax, [esp + 0xc4]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40add2
test cl, cl
je 0x40adce
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40add2
add eax, 2
add esi, 2
test cl, cl
jne 0x40adaa
xor eax, eax
jmp 0x40add7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ae13
push 0x1f3
lea eax, [esp + 0xc8]
push 0x41b85c
push eax
call fcn.0040c880
mov ecx, dword [esp + 0x193c]
add esp, 0xc
lea edx, [esp + 0x4a8]
push ecx
push 0x4188cc
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40ae3a
pop edi
pop esi
pop ebp
mov eax, 0x25e
pop ebx
add esp, 0x1918
ret
mov eax, dword [esp + 0x40]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, 2
je 0x40ae62
cmp eax, 1
je 0x40b08b
pop edi
pop esi
pop ebp
mov eax, 0x25f
pop ebx
add esp, 0x1918
ret
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
jne 0x40ae87
pop edi
pop esi
pop ebp
mov eax, 0x25d
pop ebx
add esp, 0x1918
ret
push str.EnumProcesses
push edi
call ebx
push str.EnumProcessModules
push edi
mov esi, eax
call ebx
mov ebp, eax
push str.GetModuleBaseNameA
push edi
mov dword [esp + 0x24], ebp
call ebx
test esi, esi
mov dword [esp + 0x18], eax
je 0x40b0fd
test ebp, ebp
je 0x40b0fd
test eax, eax
je 0x40b0fd
lea ecx, [esp + 0x28]
lea edx, [esp + 0x988]
push ecx
push 0x3e8
push edx
call esi
test eax, eax
jne 0x40aef2
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bd
pop ebx
add esp, 0x1918
ret
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], 0
shr eax, 2
mov dword [esp + 0x20], eax
je 0x40b080
lea ebp, [esp + 0x988]
push 0x1f3
lea eax, [esp + 0x798]
push str.Unknown
push eax
call fcn.0040c880
mov ecx, dword [ebp]
add esp, 0xc
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40af6f
lea edx, [esp + 0x28]
lea eax, [esp + 0x2c]
push edx
push 4
push eax
push esi
call dword [esp + 0x2c]
test eax, eax
je 0x40af6f
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x794]
push 0x104
push ecx
push edx
push esi
call dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40afa3
mov eax, dword [ebp]
lea ecx, [esp + 0x3e0]
push eax
push 0x4188cc
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40affa
lea edx, [esp + 0x794]
lea esi, [esp + 0xc4]
push edx
call fcn.0040d3dd
add esp, 4
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40aff1
test cl, cl
je 0x40afed
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40aff1
add eax, 2
add esi, 2
test cl, cl
jne 0x40afcd
xor eax, eax
jmp 0x40aff6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40b048
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40b064
lea esi, [esp + 0x4a8]
lea eax, [esp + 0x3e0]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40b03f
test cl, cl
je 0x40b03b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40b03f
add eax, 2
add esi, 2
test cl, cl
jne 0x40b01b
xor eax, eax
jmp 0x40b044
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40b064
mov eax, dword [ebp]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40b0b0
mov dword [esp + 0x24], 0x25c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
inc eax
add ebp, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x40af12
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x40], 1
jne 0x40b3fe
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
jne 0x40b114
pop edi
pop esi
pop ebp
mov eax, 0x2be
pop ebx
add esp, 0x1918
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push esi
je 0x40b0dc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1918
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25a
pop ebx
add esp, 0x1918
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bc
pop ebx
add esp, 0x1918
ret
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Process32First
push edi
mov dword [esp + 0x20], eax
call ebx
push str.Process32Next
push edi
mov esi, eax
call ebx
mov ebp, eax
push str.Module32First
push edi
mov dword [esp + 0x28], ebp
call ebx
push str.Module32Next
push edi
mov dword [esp + 0x24], eax
call ebx
test ebp, ebp
mov ebx, eax
je 0x40b3e7
test esi, esi
je 0x40b3e7
test ebx, ebx
je 0x40b3e7
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40b3e7
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40b3e7
push 0
push 2
call eax
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x10], ebp
jne 0x40b1a6
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2c0
pop ebx
add esp, 0x1918
ret
lea eax, [esp + 0x2b8]
mov dword [esp + 0x2b8], 0x128
push eax
push ebp
call esi
test eax, eax
je 0x40b356
mov ecx, dword [esp + 0x2c0]
push ecx
push 8
call dword [esp + 0x20]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40b362
lea edx, [esp + 0x570]
mov dword [esp + 0x570], 0x224
push edx
push ebp
call dword [esp + 0x24]
mov esi, eax
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40b228
mov eax, dword [esp + 0x2c0]
lea ecx, [esp + 0x3e0]
push eax
push 0x4188cc
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
test esi, esi
je 0x40b323
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40b27e
lea esi, [esp + 0xc4]
lea eax, [esp + 0x590]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40b275
test cl, cl
je 0x40b271
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40b275
add eax, 2
add esi, 2
test cl, cl
jne 0x40b251
xor eax, eax
jmp 0x40b27a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40b2cc
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40b305
lea esi, [esp + 0x4a8]
lea eax, [esp + 0x3e0]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40b2c3
test cl, cl
je 0x40b2bf
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40b2c3
add eax, 2
add esi, 2
test cl, cl
jne 0x40b29f
xor eax, eax
jmp 0x40b2c8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40b305
mov eax, dword [esp + 0x2c0]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40b388
lea ecx, [esp + 0x570]
mov dword [esp + 0x24], 0x25c
mov dword [esp + 0x570], 0x224
push ecx
jmp 0x40b318
lea edx, [esp + 0x570]
mov dword [esp + 0x570], 0x224
push edx
push ebp
call ebx
test eax, eax
jne 0x40b230
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x2b8]
push eax
push ecx
mov dword [esp + 0x2c0], 0x128
call dword [esp + 0x28]
test eax, eax
jne 0x40b1c4
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b3fe
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2c0
pop ebx
add esp, 0x1918
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
test eax, eax
je 0x40b3c0
call edi
mov ecx, dword [esp + 0x10]
push ecx
call edi
push esi
call edi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1918
ret
call edi
mov eax, dword [esp + 0x10]
push eax
call edi
push esi
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25a
pop ebx
add esp, 0x1918
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bf
pop ebx
add esp, 0x1918
ret
xor eax, eax
push edi
test eax, eax
jne 0x40b3ad
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esp + 0x24]
xor eax, eax
cmp edx, 0x25c
pop edi
sete al
pop esi
pop ebp
add eax, 0x25b
pop ebx
add esp, 0x1918
ret
pop edi
pop esi
pop ebp
mov eax, 0x278
pop ebx
add esp, 0x1918
ret