Function at 0x41d8c0
Capabilities:
Enumerate gui resources
Enumerate process modules
Get disk information
Get process image filename
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463a09
mov eax, dword fs:[0]
push eax
mov eax, 0x1248
call fcn.00444b00
mov eax, dword [0x4826d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1248], ecx
push ecx
lea ecx, [ebp - 0x122c]
mov dword [ebp - 0x1220], eax
mov dword [ebp - 0x1238], eax
call fcn.0040d6d0
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], 0
je 0x41d9c3
mov eax, dword [ebp - 0x122c]
mov edx, 1
mov ecx, dword [eax - 0xc]
cmp ecx, 2
jge 0x41d93c
lea edx, [ecx - 1]
xor esi, esi
cmp ecx, 1
mov ecx, dword [eax - 0x10]
cmovge esi, edx
test ecx, ecx
je 0x41d954
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x41d960
call fcn.00403330
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
mov eax, dword [ebp - 0x122c]
lea ecx, [ebp - 0x1224]
push esi
add eax, 2
push eax
call fcn.0040f170
mov eax, 5
mov edx, 0x468c80
mov dword [ebp - 0x1220], eax
mov eax, dword [ebp - 0x1224]
mov ecx, eax
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x41d9b6
test si, si
je 0x41d9b2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x41d9b6
add ecx, 4
add edx, 4
test si, si
jne 0x41d990
xor ecx, ecx
jmp 0x41d9bb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x41d9c9
mov bl, 1
jmp 0x41d9cb
mov eax, dword [ebp - 0x1224]
xor bl, bl
mov ecx, dword [ebp - 0x1220]
test cl, 1
je 0x41d9f7
and ecx, 0xfffffffe
lea edx, [eax - 0x10]
mov dword [ebp - 0x1220], ecx
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41d9f7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x41dc84
call fcn.00403330
mov ecx, eax
test ecx, ecx
je 0x41dfb6
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1234], esi
mov eax, dword [ebp - 0x122c]
mov byte [ebp - 4], 1
cmp dword [eax - 0xc], 2
jg 0x41da43
add eax, 0xfffffff0
push eax
call fcn.00402c90
add esp, 4
lea edi, [eax + 0x10]
mov dword [ebp - 0x1224], edi
jmp 0x41da79
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x41da53
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x41da5f
call fcn.00403330
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
push 2
push dword [ebp - 0x122c]
lea ecx, [ebp - 0x1224]
call fcn.0040f170
mov edi, dword [ebp - 0x1224]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or dword [ebp - 0x1220], 8
or eax, ecx
mov byte [ebp - 4], 2
jge 0x41daae
push 0x104
lea ecx, [ebp - 0x1234]
call fcn.00404230
mov esi, dword [ebp - 0x1234]
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
mov byte [ebp - 4], 1
setne bl
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41dadc
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x41dc66
push dword [esi - 8]
push esi
call fcn.0044c2df
add esp, 8
test eax, eax
js 0x41dfca
cmp eax, dword [esi - 8]
jg 0x41dfca
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
lea ecx, [ebp - 0x122c]
mov eax, dword [ebp - 0x122c]
mov eax, dword [eax - 0xc]
add eax, 0xfffffffe
push eax
push 2
lea eax, [ebp - 0x1224]
push eax
call fcn.0041dfe0
mov ebx, dword [ebp - 0x1220]
mov eax, ebx
or eax, 0x10
mov dword [ebp - 0x1238], eax
mov ecx, dword [esi - 0x10]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x41db52
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x41db68
call fcn.00403330
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x41dfc0
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [esi - 0xc]
or ebx, 0x30
mov dword [ebp - 0x1220], ebx
mov dword [ebp - 0x1238], ebx
lea edi, [eax + 0x10]
mov dword [ebp - 0x123c], ecx
mov eax, dword [ebp - 0x1224]
mov dword [ebp - 0x1230], edi
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x1244], eax
lea ebx, [ecx + eax]
test ebx, ebx
js 0x41dfca
mov eax, dword [edi - 8]
mov edx, 1
sub edx, dword [edi - 4]
sub eax, ebx
or eax, edx
jge 0x41dbd1
push ebx
lea ecx, [ebp - 0x1230]
call fcn.00404230
mov edi, dword [ebp - 0x1230]
mov ecx, dword [ebp - 0x123c]
push ecx
push esi
push ecx
push edi
call fcn.00408cd0
mov eax, dword [ebp - 0x1244]
push eax
push dword [ebp - 0x1224]
push eax
mov eax, dword [ebp - 0x123c]
lea eax, [edi + eax*2]
push eax
call fcn.00408cd0
add esp, 0x20
cmp ebx, dword [edi - 8]
jg 0x41dfca
xor eax, eax
mov dword [edi - 0xc], ebx
mov word [edi + ebx*2], ax
lea ecx, [ebp - 0x122c]
lea eax, [ebp - 0x1230]
push eax
call fcn.004019b0
and dword [ebp - 0x1220], 0xffffffdf
or ebx, 0xffffffff
mov byte [ebp - 4], 3
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41dc43
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1224]
mov eax, ebx
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41dc69
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41dc69
or ebx, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41dc84
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1240]
mov esi, 0x1000
push eax
lea edi, [ebp - 0x1218]
push esi
mov eax, edi
mov dword [ebp - 0x1230], edi
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x41ddf7
mov eax, dword [ebp - 0x1240]
cmp eax, esi
jne 0x41dd0a
nop word [eax + eax]
lea eax, [ebp - 0x1218]
cmp eax, edi
je 0x41dcd3
push edi
call fcn.00449b75
add esp, 4
add esi, 0x1000
push esi
call fcn.00449b7a
add esp, 4
mov edi, eax
lea eax, [ebp - 0x1240]
mov dword [ebp - 0x1230], edi
push eax
push esi
push edi
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x41ddee
mov eax, dword [ebp - 0x1240]
cmp eax, esi
je 0x41dcc0
xor cl, cl
shr eax, 2
mov byte [ebp - 0x1219], cl
lea esi, [ebp - 0x218]
xor ecx, ecx
mov dword [ebp - 0x124c], eax
mov dword [ebp - 0x1234], ecx
mov ebx, 0x104
test eax, eax
je 0x41df92
push dword [edi + ecx*4]
lea eax, [edi + ecx*4]
push 0
push 0x410
mov dword [ebp - 0x1238], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x123c], eax
test eax, eax
je 0x41df4a
push ebx
push esi
push eax
call sub.PSAPI.DLL_GetProcessImageFileNameW
mov edi, eax
test edi, edi
jne 0x41ddbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41ddbb
lea eax, [ebp - 0x218]
cmp eax, esi
je 0x41dd89
push esi
call fcn.00449b75
add esp, 4
add ebx, 0x104
lea eax, [ebx + ebx]
push eax
call fcn.00449b7a
add esp, 4
mov esi, eax
push ebx
push esi
push dword [ebp - 0x123c]
call sub.PSAPI.DLL_GetProcessImageFileNameW
mov edi, eax
test edi, edi
jg 0x41ddbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x41dd76
push dword [ebp - 0x123c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jle 0x41df44
push esi
lea ecx, [ebp - 0x1224]
call fcn.0040d6d0
cmp byte [ebp + 0xc], 0
mov byte [ebp - 4], 5
je 0x41de3c
push dword [ebp - 0x122c]
push esi
jmp 0x41de5d
push edi
call fcn.00449b75
add esp, 4
xor bl, bl
mov eax, dword [ebp - 0x122c]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x41de1e
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00444abb
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1244]
push eax
lea ecx, [ebp - 0x1224]
call fcn.0040f4d0
push dword [ebp - 0x1248]
or dword [ebp - 0x1220], 2
push dword [eax]
call fcn.0044c5d8
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x1220]
sete byte [ebp - 0x1225]
test al, 2
je 0x41de9f
mov edx, dword [ebp - 0x1244]
and eax, 0xfffffffd
mov dword [ebp - 0x1220], eax
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41de9f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x1225], 0
je 0x41df22
mov eax, dword [ebp - 0x1238]
push dword [eax]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x41df22
mov eax, dword [ebp - 0x1238]
mov byte [ebp - 0x1250], 0
mov ecx, dword [eax]
lea eax, [ebp - 0x1254]
push eax
push 0x41d880
mov dword [ebp - 0x1254], ecx
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x41df07
cmp byte [ebp - 0x1250], 0
je 0x41df07
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41df14
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x41df65
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x1219], 1
mov edx, dword [ebp - 0x1224]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41df44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x1230]
mov ecx, dword [ebp - 0x1234]
inc ecx
mov dword [ebp - 0x1234], ecx
cmp ecx, dword [ebp - 0x124c]
jb 0x41dd36
jmp 0x41df7f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor cl, cl
mov byte [ebp - 0x1219], cl
lea ecx, [ebp - 0x1224]
call fcn.0040d850
lea eax, [ebp - 0x218]
cmp eax, esi
je 0x41df92
push esi
call fcn.00449b75
add esp, 4
mov eax, dword [ebp - 0x1230]
lea ecx, [ebp - 0x1218]
cmp ecx, eax
je 0x41dfab
push eax
call fcn.00449b75
add esp, 4
mov bl, byte [ebp - 0x1219]
jmp 0x41ddf9
push 0x80004005
call fcn.004024f0
push 0x80004005
call fcn.004024f0
push 0x80070057
call fcn.004024f0
int3