Function at 0x418827
Capabilities:
Enumerate processes
Extract resource via kernel32 functions
Terminate process

Disassembly:
mov eax, 0x4334cc
call fcn.004269c8
sub esp, 0x580
mov eax, dword [0x44de90]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push str.Start_scan_hidden_processes_n
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edi
mov byte [ebp - 0x251], 1
mov dword [ebp - 0x120], edi
call fcn.00425036
pop ecx
push edi
push 2
mov dword [ebp - 0x258], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4188ba
lea eax, [ebp - 0x250]
push eax
push esi
mov dword [ebp - 0x250], 0x128
call sub.KERNEL32.dll_Process32First
jmp 0x4188b6
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x258]
inc dword [ebp - 0x258]
mov dword [ebp + ecx*4 - 0x58c], eax
lea eax, [ebp - 0x250]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x418890
push 0x14
pop eax
push eax
mov dword [ebp - 0x260], eax
call fcn.00425520
mov dword [esp], 0x43e504
push str.ntdll.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
push esi
push 0x10
call ebx
cmp eax, 0xc0000004
jne 0x418920
add dword [ebp - 0x260], 0x1000
push esi
call fcn.00425476
push dword [ebp - 0x260]
call fcn.00425520
pop ecx
pop ecx
mov esi, eax
jmp 0x4188e6
mov dword [ebp - 0x25c], edi
xor ecx, ecx
cmp ecx, dword [esi]
jae 0x418995
xor dl, dl
xor eax, eax
cmp eax, dword [ebp - 0x258]
jge 0x41894d
mov ebx, dword [ebp + eax*4 - 0x58c]
mov edi, ecx
shl edi, 4
cmp ebx, dword [edi + esi + 4]
je 0x418990
inc eax
jmp 0x418930
test dl, dl
jne 0x418990
xor eax, eax
cmp eax, dword [ebp - 0x25c]
jge 0x418970
mov ebx, dword [ebp + eax*4 - 0x3fc]
mov edi, ecx
shl edi, 4
cmp ebx, dword [edi + esi + 4]
je 0x418990
inc eax
jmp 0x418953
test dl, dl
jne 0x418990
mov edx, dword [ebp - 0x25c]
mov eax, ecx
shl eax, 4
mov eax, dword [eax + esi + 4]
inc dword [ebp - 0x25c]
mov dword [ebp + edx*4 - 0x3fc], eax
inc ecx
xor edi, edi
jmp 0x418928
cmp dword [ebp - 0x25c], edi
je 0x418bd1
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0x268], ebx
je 0x418aa2
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x418bc5
push 4
push 0x1000
push dword [ebp + 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
mov dword [ebp - 0x264], esi
je 0x418bc5
push dword [ebp + 0x10]
push edi
push esi
call fcn.00425790
add esp, 0xc
xor eax, eax
cmp eax, dword [ebp + 0x10]
jae 0x418a08
not byte [eax + esi]
inc eax
jmp 0x4189fd
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edi, dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
mov dword [ebp - 0x258], eax
mov ebx, 0x8000
cmp eax, dword [ebp - 0x25c]
jge 0x418ba6
push dword [ebp + eax*4 - 0x3fc]
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
push 0
push eax
mov dword [ebp - 0x26c], eax
mov byte [ebp - 0x22c], 0
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x128]
call fcn.00418400
lea ecx, [ebp - 0x128]
call fcn.0041841d
lea ecx, [ebp - 0x128]
call fcn.004183da
test eax, eax
je 0x418abb
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x264]
call esi
push dword [ebp - 0x268]
call edi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00425221
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push dword [ebp - 0x264]
add dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call fcn.00425540
add esp, 0xc
test eax, eax
jne 0x418b8a
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x264]
call esi
push dword [ebp - 0x268]
call edi
lea ecx, [ebp - 0x128]
call fcn.004183de
push 0
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push str.Evil_hidden_process_pid_
push 0x45e638
jne 0x418b4f
call fcn.0040ac94
pop ecx
pop ecx
mov ecx, dword [ebp - 0x258]
push dword [ebp + ecx*4 - 0x3fc]
mov ecx, eax
call fcn.0041867d
push str._found_but_not_killed
push eax
call fcn.0040ac94
pop ecx
pop ecx
push eax
call fcn.0041880e
mov byte [ebp - 0x251], 0
jmp 0x418b7d
call fcn.0040ac94
pop ecx
pop ecx
mov ecx, dword [ebp - 0x258]
push dword [ebp + ecx*4 - 0x3fc]
mov ecx, eax
call fcn.0041867d
push str._was_killed
push eax
call fcn.0040ac94
pop ecx
pop ecx
push eax
call fcn.0041880e
pop ecx
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x128]
call fcn.004183de
inc dword [ebp - 0x258]
mov eax, dword [ebp - 0x258]
jmp 0x418a21
push dword [ebp - 0x268]
call edi
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x264]
call esi
mov al, byte [ebp - 0x251]
jmp 0x418aa4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x418aa2
mov al, 1
jmp 0x418aa4