Function at 0x42f080
Capabilities:
Enumerate process modules
Get file version info
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x143c
call fcn.00620410
mov eax, dword [0x6d6ec0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x143c], ecx
push eax
push 0x1000
lea eax, [ebp - 0x140c]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x42f2de
push esi
mov esi, dword [ebp - 0x1414]
shr esi, 2
mov dword [ebp - 0x1430], esi
test esi, esi
je 0x42f2dd
push ebx
lea ebx, [ebp - 0x140c]
push edi
mov dword [ebp - 0x1428], ebx
mov eax, dword [ebx]
test eax, eax
je 0x42f2c3
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1438], eax
test eax, eax
je 0x42f2c3
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x42f2b7
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jle 0x42f2b1
push esi
call fcn.0061f91b
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x1424], edi
call fcn.00621d30
add esp, 0x10
lea eax, [ebp - 0x20c]
push edi
push esi
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x42f2a8
lea eax, [ebp - 0x1410]
mov dword [ebp - 0x1410], 0
push eax
lea eax, [ebp - 0x1420]
push eax
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x42f2a8
xor ebx, ebx
test dword [ebp - 0x1410], 0xfffffffc
jbe 0x42f2a2
xor edx, edx
xor esi, esi
mov dword [ebp - 0x1434], edx
mov dword [ebp - 0x142c], esi
mov ecx, dword [ebp - 0x1420]
movzx eax, word [edx + ecx + 2]
push eax
movzx eax, word [esi + ecx]
push eax
lea eax, [ebp - 0x40c]
push str.StringFileInfo_04x_04xFileDescription
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x141c], 0
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x141c]
push eax
lea eax, [ebp - 0x40c]
push eax
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x42f274
mov eax, dword [ebp - 0x143c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
cmp esi, edi
je 0x42f26e
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x42f22a
mov eax, dword [esi]
push eax
push dword [ebp - 0x141c]
call fcn.006211ff
add esp, 8
test eax, eax
jne 0x42f246
add esi, 0x18
cmp esi, edi
jne 0x42f220
jmp 0x42f26e
mov eax, dword [ebp - 0x1428]
push dword [eax]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42f26e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x1424]
mov edx, dword [ebp - 0x1434]
inc ebx
mov eax, dword [ebp - 0x1410]
add edx, 4
add dword [ebp - 0x142c], 4
mov esi, dword [ebp - 0x142c]
shr eax, 2
mov dword [ebp - 0x1434], edx
cmp ebx, eax
jb 0x42f1c1
mov ebx, dword [ebp - 0x1428]
push edi
call fcn.0061f486
add esp, 4
mov esi, dword [ebp - 0x1430]
push dword [ebp - 0x1438]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 4
sub esi, 1
mov dword [ebp - 0x1428], ebx
mov dword [ebp - 0x1430], esi
jne 0x42f0e4
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0061f478
mov esp, ebp
pop ebp
ret