Function at 0x45d020
Capabilities:
Enumerate processes
Get disk information
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a2091
mov eax, dword fs:[0]
push eax
sub esp, 0x668
mov eax, dword [0x4c6280]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
push edi
mov eax, dword [0x4c6280]
xor eax, esp
push eax
lea eax, [esp + 0x678]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
push 0x206
mov edi, ecx
lea ecx, [esp + 0x262]
push esi
push ecx
mov dword [esp + 0x34], eax
mov word [esp + 0x268], si
call fcn.004806d0
push 0x228
lea edx, [esp + 0x40]
push esi
push edx
mov dword [esp + 0x44], esi
call fcn.004806d0
add esp, 0x18
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call fcn.0040fcf0
mov dword [esp + 0x680], esi
call fcn.0045b1f0
cmp dword [0x4c89d4], 0xffffffff
jne 0x45d1b7
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x45d0fa
push 0x4c89d4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
jne 0x45d1b7
mov dword [0x4c89d4], 0
push edi
lea ecx, [esp + 0x18]
call fcn.0040ffd0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x20], edi
je 0x45d3be
lea eax, [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x34], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x45d3b7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
cmp eax, dword [esp + 0x24]
je 0x45d399
test eax, eax
je 0x45d399
cmp eax, 4
je 0x45d399
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45d399
call fcn.0045b360
test eax, eax
je 0x45d2c7
mov eax, dword [0x4ca1b0]
test eax, eax
je 0x45d2c7
push 0x104
lea ecx, [esp + 0x260]
push ecx
push esi
call eax
jmp 0x45d2e6
cmp dword [0x4c89d4], 0
je 0x45d104
lea ecx, [esp + 0x20]
call fcn.0040fcf0
push 0x206
lea eax, [esp + 0x46a]
push 0
mov byte [esp + 0x688], 1
push eax
mov word [esp + 0x470], 0
call fcn.004806d0
movzx ecx, word [edi]
push ecx
lea edx, [esp + 0x30]
push 0x4b86c4
push edx
call fcn.004147a0
add esp, 0x18
push 0x104
lea eax, [esp + 0x468]
push eax
lea ecx, [esp + 0x28]
call fcn.00410760
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea ecx, [esp + 0x464]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040ffd0
push 1
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x1c]
call fcn.00420e80
push 0x4b8618
mov ecx, eax
mov byte [esp + 0x684], 2
call fcn.00423420
test eax, eax
lea ecx, [esp + 0x24]
setne bl
mov byte [esp + 0x680], 1
call fcn.0040fde0
test bl, bl
je 0x45d283
push 0x4b8618
lea ecx, [esp + 0x18]
call fcn.00420a90
mov eax, edi
lea edx, [eax + 2]
jmp 0x45d290
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45d290
sub eax, edx
sar eax, 1
cmp eax, 3
jbe 0x45d2b1
add edi, 6
push edi
lea ecx, [esp + 0x18]
call fcn.00420a90
lea ecx, [esp + 0x20]
mov byte [esp + 0x680], 0
call fcn.0040fde0
jmp 0x45d10e
mov eax, dword [0x4ca1ac]
test eax, eax
je 0x45d38c
push 0x104
lea edx, [esp + 0x260]
push edx
push 0
push esi
call eax
mov edi, eax
test edi, edi
je 0x45d38c
lea ecx, [esp + 0x14]
call fcn.0040feb0
cmp dword [ebp + 0xc], 0
je 0x45d32d
cmp edi, eax
jbe 0x45d38c
lea ecx, [esp + 0x14]
call fcn.0040feb0
push eax
lea eax, [esp + 0x260]
push eax
lea ecx, [esp + 0x1c]
call fcn.00410760
push eax
call fcn.0048485d
add esp, 0xc
jmp 0x45d34b
cmp edi, eax
jne 0x45d38c
lea eax, [esp + 0x25c]
push eax
lea ecx, [esp + 0x18]
call fcn.00410760
push eax
call fcn.00482c1c
add esp, 8
test eax, eax
jne 0x45d38c
push eax
push esi
call ebx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x25c]
push ecx
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Terminate_Process_return:_d__error:_d__pid:_d__path:_ws
mov ecx, 0x4ca290
call fcn.0045ef50
add esp, 0x14
test edi, edi
jne 0x45d387
add dword [esp + 0x1c], 1
jmp 0x45d38c
add dword [esp + 0x18], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x20]
xor esi, esi
lea eax, [esp + 0x2c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45d151
test esi, esi
je 0x45d3b7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x45d3cc
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ecx, [esp + 0x14]
call fcn.0040fde0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x678]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.0047f404
mov esp, ebp
pop ebp
ret