Function at 0x402920
Capabilities:
Check if file exists
Create process on windows
Enumerate process modules
Enumerate threads
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x62e4f8
push 0x57ef30
mov eax, dword fs:[0]
push eax
sub esp, 0x8cc
mov eax, dword [0x63afd4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x420], edx
mov esi, ecx
mov dword [ebp - 0x8cc], esi
mov dword [ebp - 0x8d0], esi
push 0x643be8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x6439c4], 0
jne 0x402f69
mov dword [0x6439c4], 1
mov edi, dword [0x642f40]
test edi, edi
je 0x4029be
push esi
mov ecx, edi
call dword [0x5b6448]
call edi
add esp, 4
test eax, eax
je 0x4029be
push 0x643be8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or eax, 0xffffffff
jmp 0x402f6b
mov edi, dword [0x642f3c]
test edi, edi
je 0x4029d2
mov ecx, edi
call dword [0x5b6448]
call edi
mov byte [ebp - 0x8c5], 0
mov dword [ebp - 0x42c], 0
mov edi, dword [0x643988]
test edi, edi
je 0x402b16
mov dword [ebp - 0x428], 0
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x428]
push eax
push 2
mov ecx, edi
call dword [0x5b6448]
call edi
test eax, eax
js 0x402b16
cmp dword [ebp - 0x428], 1
jne 0x402b16
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x428], eax
test eax, eax
jne 0x402a46
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x428], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x8dc], eax
xorps xmm0, xmm0
movlpd qword [ebp - 0x48c], xmm0
movlpd qword [ebp - 0x484], xmm0
movlpd qword [ebp - 0x47c], xmm0
mov dword [ebp - 0x490], 0x1c
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
je 0x402afa
lea eax, [ebp - 0x490]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x402af3
nop dword [eax]
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x484]
jne 0x402adb
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0x8dc], eax
je 0x402adb
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x402adb
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x490]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x402aa0
mov esi, dword [ebp - 0x8cc]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x64398c]
test edi, edi
je 0x402b16
push dword [ebp - 0x42c]
push 0
mov ecx, edi
call dword [0x5b6448]
call edi
mov dword [ebp - 0x8d4], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x8d4], eax
mov ecx, dword [0x643bdc]
mov eax, dword [ebp - 0x8d4]
mov dword [ecx + 0x20], eax
mov eax, dword [0x643bdc]
mov dword [eax + 0x34c], esi
mov ecx, dword [0x643bdc]
mov eax, dword [esi]
movups xmm0, xmmword [eax]
movups xmmword [ecx + 0x30], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ecx + 0x40], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [ecx + 0x50], xmm0
movups xmm0, xmmword [eax + 0x30]
movups xmmword [ecx + 0x60], xmm0
movups xmm0, xmmword [eax + 0x40]
movups xmmword [ecx + 0x70], xmm0
mov edi, dword [0x643bdc]
sub edi, 0xffffff80
mov ecx, 0xb3
mov esi, dword [esi + 4]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x643bdc]
mov ecx, dword [ebp - 0x420]
mov dword [eax + 0x5f4], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x643bdc]
mov dword [ecx + 0x18], eax
mov ecx, dword [0x643bdc]
test byte [ecx + 4], 4
je 0x402bb8
xor eax, eax
jmp 0x402bc4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x643bdc]
mov dword [ecx + 0x5fc], eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x49c], 0xc
mov dword [ebp - 0x498], edi
mov dword [ebp - 0x494], 1
push edi
push edi
push 1
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
mov dword [ebp - 0x428], esi
test esi, esi
je 0x402f20
push 2
push 1
push edi
lea eax, [ebp - 0x474]
push eax
mov eax, dword [ebp - 0x474]
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test edi, edi
je 0x402c68
cmp word [0x6439d0], 0
je 0x402c4d
push 0x6439d0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402c68
push 0
push 0x6439d0
push 0x105
push 0
push 0x61ffa0
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test esi, esi
je 0x402f20
test edi, edi
je 0x402f20
cmp word [0x6439d0], 0
je 0x402f20
mov dword [ebp - 0x8d8], 0
mov dword [ebp - 4], 0
call fcn.00402790
mov dword [ebp - 0x8d8], eax
mov dword [ebp - 4], 0xfffffffe
mov edi, dword [ebp - 0x8cc]
jmp 0x402ccd
mov eax, dword [0x643bdc]
test byte [eax + 4], 0x10
je 0x402dcd
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 0x8c4], 0x428
lea ecx, [ebp - 0x8c4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x402d9c
nop dword [eax + eax]
mov dword [ebp - 4], 2
lea eax, [ebp - 0x8a4]
push eax
call fcn.00587844
add esp, 4
lea ecx, [ebp - 0x8a4]
call fcn.00401d50
test eax, eax
jne 0x402d60
lea eax, [ebp - 0x6a4]
push eax
mov edx, dword [ebp - 0x8ac]
mov ecx, dword [ebp - 0x8a8]
call fcn.004023f0
add esp, 4
mov dword [ebp - 4], 1
jmp 0x402d85
lea eax, [ebp - 0x8c4]
push eax
push dword [ebp - 0x8cc]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x402d20
push dword [ebp - 0x8cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
jmp 0x402dcd
test edi, edi
je 0x402df6
mov edx, 8
mov ecx, edi
call fcn.00401c30
mov edx, 0x50
mov ecx, dword [edi]
call fcn.00401c30
mov edx, 0x2cc
mov ecx, dword [edi + 4]
call fcn.00401c30
push 0x400
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.0057fb60
add esp, 0xc
push dword [0x642f44]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [0x643bdc]
push dword [ebp - 0x474]
push esi
push 0x6439d0
push str.__s___buginfo:_p:_p:_p:_lu__extinfo:_p
push 0x200
lea eax, [ebp - 0x41c]
push eax
call fcn.004015a0
xorps xmm0, xmm0
movups xmmword [ebp - 0x484], xmm0
mov dword [ebp - 0x470], 0x44
push 0x40
push 0
lea eax, [ebp - 0x46c]
push eax
call fcn.0057fb60
add esp, 0x30
mov dword [ebp - 0x444], 1
mov eax, 1
mov word [ebp - 0x440], ax
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x470]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x6439d0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402f0b
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], esi
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x424]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
movzx ecx, byte [ebp - 0x8c5]
cmp eax, 1
mov eax, 1
cmove ecx, eax
mov byte [ebp - 0x8c5], cl
push dword [ebp - 0x484]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x480]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8d8]
test eax, eax
je 0x402f26
push eax
call fcn.00587998
add esp, 4
jmp 0x402f26
mov edi, dword [ebp - 0x8cc]
test esi, esi
je 0x402f31
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x642f38]
test esi, esi
je 0x402f45
mov ecx, esi
call dword [0x5b6448]
call esi
cmp byte [ebp - 0x8c5], 0
jne 0x402f58
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x402f69
mov eax, dword [edi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0057d277
mov esp, ebp
pop ebp
ret