Function at 0x43236d
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x670
mov eax, 0x4b30f9
call fcn.0047a6c1
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x66c]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x67c], ebx
mov dword [ebp - 0x678], eax
call fcn.00431f9b
and dword [ebp - 4], 0
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop edi
mov edx, str._s_s
mov ecx, 0x4b9c68
cmp di, word [esi + eax*2 - 2]
lea eax, [ebp - 0x66c]
cmove ecx, edx
push ecx
push eax
call fcn.00432274
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x660]
push 0x228
push 0
push eax
mov dword [ebp - 0x674], esi
call fcn.0047bc10
add esp, 0xc
mov dword [ebp - 0x664], 0x22c
lea eax, [ebp - 0x664]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
lea ecx, [ebp - 0x66c]
mov esi, eax
call fcn.00432664
lea ecx, [ebp - 0x66c]
call fcn.004326c8
mov edi, dword [ebp - 0x66c]
test esi, esi
je 0x4325f8
lea eax, [ebp - 0x640]
push eax
lea ecx, [ebp - 0x670]
call fcn.00430da3
lea ecx, [ebp - 0x668]
call fcn.00431f9b
mov byte [ebp - 4], 2
test ebx, ebx
je 0x432612
push ebx
push dword [ebp - 0x670]
call fcn.00489d2e
pop ecx
pop ecx
test eax, eax
jne 0x432570
push 0x424
push eax
lea eax, [ebp - 0x434]
push eax
call fcn.0047bc10
add esp, 0xc
push dword [ebp - 0x65c]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x438], 0x428
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x218]
push eax
call fcn.0047f9b4
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x668]
call fcn.00411c22
lea ecx, [ebp - 0x668]
call fcn.00432664
lea ecx, [ebp - 0x668]
call fcn.004326c8
mov esi, dword [ebp - 0x668]
test esi, esi
je 0x432612
push esi
push edi
call fcn.00489d2e
pop ecx
pop ecx
test eax, eax
jne 0x4325bb
push dword [ebp - 0x678]
push dword [ebp - 0x65c]
call fcn.00432070
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x432540
push 0
push 0
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push dword [ebp + 0x14]
push str.Post_msg__d_to__d_for_quit._n
call fcn.004336ac
add esp, 0xc
push dword [ebp - 0x65c]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4325bb
push 0x1f4
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4325bb
push str.yyassistant.exe
push dword [ebp - 0x670]
call fcn.00489d2e
pop ecx
pop ecx
test eax, eax
jne 0x4325b5
push dword [ebp - 0x65c]
push eax
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [ebp - 0x65c]
mov esi, eax
push str.YYAssistant:_terminate_process:_d.
call fcn.004336ac
pop ecx
pop ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [ebp - 0x668]
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x674]
call sub.KERNEL32.dll_Process32NextW
lea ecx, [esi - 0x10]
mov ebx, eax
call fcn.00411bc2
mov ecx, dword [ebp - 0x670]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00411bc2
test ebx, ebx
je 0x4325f8
mov ebx, dword [ebp - 0x67c]
jmp 0x432432
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [edi - 0x10]
call fcn.00411bc2
call fcn.0047a67f
ret
push 0x80004005
call fcn.0041131e
int3