Function at 0x481c0b
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x624]
sub esp, 0x624
push 0xffffffffffffffff
push 0x4c0280
mov eax, dword fs:[0]
push eax
mov eax, 0x1038
call fcn.004933d0
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x620], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x62c]
xor edi, edi
cmp esi, edi
jne 0x481c7d
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x620]
xor ecx, ebp
call fcn.0048c64c
add ebp, 0x624
leave
ret
xor eax, eax
push 0x206
mov word [ebp + 0x418], ax
lea eax, [ebp + 0x41a]
push edi
push eax
call fcn.00492200
push esi
call fcn.00492919
add esp, 0x10
cmp word [esi + eax*2 - 2], 0x5c
push esi
lea eax, [ebp + 0x418]
jne 0x481cb7
push 0x4cdb2c
jmp 0x481cbc
push 0x4cdb20
push 0x103
push eax
call fcn.0048e74d
add esp, 0x10
lea eax, [ebp + 0x418]
push eax
lea ecx, [ebp - 0x14]
call fcn.0047a994
push 0x5c
push 0x2f
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.0048101a
lea eax, [ebp - 0x28]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
or esi, 0xffffffff
push eax
mov dword [ebp - 0x1c], esi
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x481d16
lea ecx, [ebp - 0x14]
call fcn.0047a8f6
mov eax, esi
jmp 0x481c5a
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
call fcn.00492200
add esp, 0xc
mov ebx, 0x104
push ebx
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call fcn.0047a994
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
shr edi, 2
call fcn.0048177a
xor eax, eax
push esi
mov word [ebp + 0x20c], ax
xor esi, esi
lea eax, [ebp + 0x20e]
push esi
push eax
mov byte [ebp - 4], 2
call fcn.00492200
add esp, 0xc
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], esi
cmp edi, esi
jbe 0x481e2d
mov eax, dword [ebp - 0x10]
push dword [ebp + eax*4 - 0x1044]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x481e21
lea eax, [ebp - 0x44]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x481e1a
push ebx
lea eax, [ebp + 0x20c]
push eax
push dword [ebp - 0x20]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
cmp dword [ebp + 0x634], 0
jne 0x481def
lea eax, [ebp + 0x20c]
push eax
push dword [ebp - 0x18]
call fcn.0048c804
pop ecx
pop ecx
test eax, eax
je 0x481e1a
push dword [ebp - 0x14]
lea eax, [ebp + 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x481e1a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x40]
call fcn.0048180f
jmp 0x481e21
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jb 0x481d8c
mov esi, dword [ebp - 0x30]
sub esi, dword [ebp - 0x34]
sar esi, 2
test esi, esi
jbe 0x481ea6
xor ecx, ecx
push 4
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048bc2e
mov ebx, eax
pop ecx
test ebx, ebx
je 0x481e8a
xor edi, edi
test esi, esi
jbe 0x481e70
push edi
lea ecx, [ebp - 0x40]
call fcn.00480be5
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
inc edi
cmp edi, esi
jb 0x481e5d
push dword [ebp + 0x630]
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push ebx
mov dword [ebp - 0x1c], eax
call fcn.0048cd90
pop ecx
xor edi, edi
test esi, esi
jbe 0x481ea6
push edi
lea ecx, [ebp - 0x40]
call fcn.00480be5
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, esi
jb 0x481e90
lea ecx, [ebp - 0x40]
call fcn.00480f62
push dword [ebp - 0x40]
call fcn.0048c641
pop ecx
lea ecx, [ebp - 0x18]
call fcn.0047a8f6
mov esi, dword [ebp - 0x1c]
jmp 0x481d07