Function at 0x40b5b0
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
mov eax, 0x1918
call fcn.0040d880
push ebx
push ebp
mov ebp, dword [esp + 0x1924]
push esi
push edi
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
mov dword [esp + 0x24], ecx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
cmp esi, 1
jl 0x40bcaa
cmp esi, 0x104
jg 0x40bcaa
xor edi, edi
test esi, esi
jle 0x40b616
lea eax, [esp + 0xc4]
sub ebp, eax
lea ebx, [esp + edi + 0xc4]
movsx ecx, byte [ebx + ebp]
push ecx
call fcn.0040deb3
add esp, 4
inc edi
cmp edi, esi
mov byte [ebx], al
jl 0x40b5fb
mov byte [esp + esi + 0xc4], 0
mov esi, str.__KILL_BY_PID__
lea eax, [esp + 0xc4]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40b652
test cl, cl
je 0x40b64e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40b652
add eax, 2
add esi, 2
test cl, cl
jne 0x40b62a
xor eax, eax
jmp 0x40b657
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40b693
push 0x1f3
lea eax, [esp + 0xc8]
push 0x41b8cc
push eax
call fcn.0040d1a0
mov ecx, dword [esp + 0x193c]
add esp, 0xc
lea edx, [esp + 0x4a8]
push ecx
push 0x418924
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40b6ba
pop edi
pop esi
pop ebp
mov eax, 0x25e
pop ebx
add esp, 0x1918
ret
mov eax, dword [esp + 0x40]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, 2
je 0x40b6e2
cmp eax, 1
je 0x40b90b
pop edi
pop esi
pop ebp
mov eax, 0x25f
pop ebx
add esp, 0x1918
ret
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
jne 0x40b707
pop edi
pop esi
pop ebp
mov eax, 0x25d
pop ebx
add esp, 0x1918
ret
push str.EnumProcesses
push edi
call ebx
push str.EnumProcessModules
push edi
mov esi, eax
call ebx
mov ebp, eax
push str.GetModuleBaseNameA
push edi
mov dword [esp + 0x24], ebp
call ebx
test esi, esi
mov dword [esp + 0x18], eax
je 0x40b97d
test ebp, ebp
je 0x40b97d
test eax, eax
je 0x40b97d
lea ecx, [esp + 0x28]
lea edx, [esp + 0x988]
push ecx
push 0x3e8
push edx
call esi
test eax, eax
jne 0x40b772
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bd
pop ebx
add esp, 0x1918
ret
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], 0
shr eax, 2
mov dword [esp + 0x20], eax
je 0x40b900
lea ebp, [esp + 0x988]
push 0x1f3
lea eax, [esp + 0x798]
push str.Unknown
push eax
call fcn.0040d1a0
mov ecx, dword [ebp]
add esp, 0xc
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40b7ef
lea edx, [esp + 0x28]
lea eax, [esp + 0x2c]
push edx
push 4
push eax
push esi
call dword [esp + 0x2c]
test eax, eax
je 0x40b7ef
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x794]
push 0x104
push ecx
push edx
push esi
call dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40b823
mov eax, dword [ebp]
lea ecx, [esp + 0x3e0]
push eax
push 0x418924
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40b87a
lea edx, [esp + 0x794]
lea esi, [esp + 0xc4]
push edx
call fcn.0040de15
add esp, 4
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40b871
test cl, cl
je 0x40b86d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40b871
add eax, 2
add esi, 2
test cl, cl
jne 0x40b84d
xor eax, eax
jmp 0x40b876
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40b8c8
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40b8e4
lea esi, [esp + 0x4a8]
lea eax, [esp + 0x3e0]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40b8bf
test cl, cl
je 0x40b8bb
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40b8bf
add eax, 2
add esi, 2
test cl, cl
jne 0x40b89b
xor eax, eax
jmp 0x40b8c4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40b8e4
mov eax, dword [ebp]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40b930
mov dword [esp + 0x24], 0x25c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
inc eax
add ebp, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x40b792
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x40], 1
jne 0x40bc7e
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
jne 0x40b994
pop edi
pop esi
pop ebp
mov eax, 0x2be
pop ebx
add esp, 0x1918
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push esi
je 0x40b95c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1918
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25a
pop ebx
add esp, 0x1918
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bc
pop ebx
add esp, 0x1918
ret
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Process32First
push edi
mov dword [esp + 0x20], eax
call ebx
push str.Process32Next
push edi
mov esi, eax
call ebx
mov ebp, eax
push str.Module32First
push edi
mov dword [esp + 0x28], ebp
call ebx
push str.Module32Next
push edi
mov dword [esp + 0x24], eax
call ebx
test ebp, ebp
mov ebx, eax
je 0x40bc67
test esi, esi
je 0x40bc67
test ebx, ebx
je 0x40bc67
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40bc67
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40bc67
push 0
push 2
call eax
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x10], ebp
jne 0x40ba26
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2c0
pop ebx
add esp, 0x1918
ret
lea eax, [esp + 0x2b8]
mov dword [esp + 0x2b8], 0x128
push eax
push ebp
call esi
test eax, eax
je 0x40bbd6
mov ecx, dword [esp + 0x2c0]
push ecx
push 8
call dword [esp + 0x20]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40bbe2
lea edx, [esp + 0x570]
mov dword [esp + 0x570], 0x224
push edx
push ebp
call dword [esp + 0x24]
mov esi, eax
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40baa8
mov eax, dword [esp + 0x2c0]
lea ecx, [esp + 0x3e0]
push eax
push 0x418924
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
test esi, esi
je 0x40bba3
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40bafe
lea esi, [esp + 0xc4]
lea eax, [esp + 0x590]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40baf5
test cl, cl
je 0x40baf1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40baf5
add eax, 2
add esi, 2
test cl, cl
jne 0x40bad1
xor eax, eax
jmp 0x40bafa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40bb4c
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40bb85
lea esi, [esp + 0x4a8]
lea eax, [esp + 0x3e0]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40bb43
test cl, cl
je 0x40bb3f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40bb43
add eax, 2
add esi, 2
test cl, cl
jne 0x40bb1f
xor eax, eax
jmp 0x40bb48
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40bb85
mov eax, dword [esp + 0x2c0]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40bc08
lea ecx, [esp + 0x570]
mov dword [esp + 0x24], 0x25c
mov dword [esp + 0x570], 0x224
push ecx
jmp 0x40bb98
lea edx, [esp + 0x570]
mov dword [esp + 0x570], 0x224
push edx
push ebp
call ebx
test eax, eax
jne 0x40bab0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x2b8]
push eax
push ecx
mov dword [esp + 0x2c0], 0x128
call dword [esp + 0x28]
test eax, eax
jne 0x40ba44
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40bc7e
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2c0
pop ebx
add esp, 0x1918
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
test eax, eax
je 0x40bc40
call edi
mov ecx, dword [esp + 0x10]
push ecx
call edi
push esi
call edi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1918
ret
call edi
mov eax, dword [esp + 0x10]
push eax
call edi
push esi
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25a
pop ebx
add esp, 0x1918
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bf
pop ebx
add esp, 0x1918
ret
xor eax, eax
push edi
test eax, eax
jne 0x40bc2d
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esp + 0x24]
xor eax, eax
cmp edx, 0x25c
pop edi
sete al
pop esi
pop ebp
add eax, 0x25b
pop ebx
add esp, 0x1918
ret
pop edi
pop esi
pop ebp
mov eax, 0x278
pop ebx
add esp, 0x1918
ret