Function at 0x4a84b0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5446f0
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x583f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x280], edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x27c]
push eax
push ebx
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x27c], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4a851b
xor al, al
jmp 0x4a8788
lea eax, [ebp - 0x27c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x4a8786
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x50]
call fcn.004b1660
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.004a8430
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x18]
mov edi, dword [edi + 0x14]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
mov ebx, eax
test eax, eax
je 0x4a8588
test esi, esi
jne 0x4a8588
push 0x86a
push str.D:Program_Files__x86_Microsoft_Visual_Studio_11.0VCincludexstring
push str.invalid_null_pointer
call fcn.0053d770
add esp, 0xc
mov ecx, dword [ebp - 0x280]
cmp dword [ecx + 0x14], edi
cmovb edi, dword [ecx + 0x14]
cmp dword [ecx + 0x18], 0x10
jb 0x4a85a0
mov edx, dword [ecx + 4]
jmp 0x4a85a3
lea edx, [ecx + 4]
cmp edi, ebx
mov ecx, ebx
cmovb ecx, edi
test ecx, ecx
je 0x4a8603
sub ecx, 4
jb 0x4a85c4
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4a85c9
add edx, 4
add esi, 4
sub ecx, 4
jae 0x4a85b3
cmp ecx, 0xfffffffc
je 0x4a85fd
mov al, byte [edx]
cmp al, byte [esi]
jne 0x4a85f6
cmp ecx, 0xfffffffd
je 0x4a85fd
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x4a85f6
cmp ecx, 0xfffffffe
je 0x4a85fd
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x4a85f6
cmp ecx, 0xffffffff
je 0x4a85fd
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x4a85fd
sbb eax, eax
or eax, 1
jmp 0x4a85ff
xor eax, eax
test eax, eax
jne 0x4a8615
cmp edi, ebx
jae 0x4a860c
or eax, 0xffffffff
jmp 0x4a8613
xor eax, eax
cmp edi, ebx
setne al
test eax, eax
sete al
test al, al
je 0x4a863e
push dword [ebp - 0x274]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [ebp - 0x18], 0
je 0x4a866a
test eax, eax
jne 0x4a866a
push 0x86a
push str.D:Program_Files__x86_Microsoft_Visual_Studio_11.0VCincludexstring
push str.invalid_null_pointer
call fcn.0053d770
add esp, 0xc
mov byte [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
jb 0x4a867f
push dword [ebp - 0x28]
call fcn.004fea80
add esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
test eax, eax
je 0x4a86db
push 3
lea ecx, [ebp - 0x34]
call fcn.0053dac0
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx + 4], 0
je 0x4a86c9
jmp 0x4a86b0
mov eax, dword [ecx + 4]
mov dword [eax], 0
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
test eax, eax
jne 0x4a86b0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 4], 0
lea ecx, [ebp - 0x34]
call fcn.0053db60
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004fea80
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x38], 8
mov dword [ebp - 0x2c], 0
jb 0x4a8703
push dword [ebp - 0x4c]
call fcn.004fea80
add esp, 4
xor eax, eax
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], 0
test eax, eax
je 0x4a875c
push 3
lea ecx, [ebp - 0x30]
call fcn.0053dac0
mov ecx, dword [ebp - 0x50]
cmp dword [ecx + 4], 0
je 0x4a874a
mov eax, dword [ecx + 4]
mov dword [eax], 0
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
test eax, eax
jne 0x4a8731
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 4], 0
lea ecx, [ebp - 0x30]
call fcn.0053db60
mov eax, dword [ebp - 0x50]
push eax
call fcn.004fea80
add esp, 4
lea eax, [ebp - 0x27c]
push eax
push dword [ebp - 0x284]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov edi, dword [ebp - 0x280]
test eax, eax
jne 0x4a8531
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fcf30
mov esp, ebp
pop ebp
ret