Function at 0x448987
Capabilities:
Enumerate process modules
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4fc
push edi
mov dword [ebp - 0x4fc], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1d0], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x1cc]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x4fc]
call fcn.004488e9
test eax, eax
je 0x4489d8
mov ecx, dword [ebp - 0x4fc]
call fcn.00448951
mov dword [ebp - 0xa4], 0x94
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 1
jne 0x448a23
mov ecx, dword [ebp - 0x4fc]
call fcn.0044875f
test eax, eax
jne 0x448a16
mov ecx, dword [ebp - 0x4fc]
call fcn.004487a5
test eax, eax
je 0x448a21
mov ecx, dword [ebp - 0x4fc]
call fcn.00448951
jmp 0x448a4c
mov ecx, dword [ebp - 0x4fc]
call fcn.00448929
test eax, eax
jne 0x448a41
mov ecx, dword [ebp - 0x4fc]
call fcn.004488a9
test eax, eax
je 0x448a4c
mov ecx, dword [ebp - 0x4fc]
call fcn.00448951
mov dword [ebp - 0x1d0], 0x128
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1d0]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x448afc
lea eax, [ebp - 0x1d0]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x448afc
lea edx, [ebp - 0x1ac]
push edx
mov ecx, dword [ebp - 0x4fc]
call fcn.004486a3
lea eax, [ebp - 0x1ac]
push eax
call fcn.0044b500
add esp, 4
push eax
lea ecx, [ebp - 0x1ac]
push ecx
call dword [sym.imp.USER32.dll_CharUpperBuffA]
push 0x441540
lea edx, [ebp - 0x1ac]
push edx
call fcn.0044b0d0
add esp, 8
test eax, eax
jne 0x448ae6
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xa8], eax
mov ecx, dword [ebp - 0x1c8]
cmp ecx, dword [ebp - 0xc]
jne 0x448afa
mov edx, dword [ebp - 0x1b8]
mov dword [ebp - 8], edx
jmp 0x448a7f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xa8]
je 0x448b2c
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x448c70
mov dword [ebp - 0x4f8], 0
mov ecx, 0x88
xor eax, eax
lea edi, [ebp - 0x4f4]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x4f8], 0x224
mov eax, dword [ebp - 0xa8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x4f8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x448c70
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x4f0]
jne 0x448c58
push 0x105
lea ecx, [ebp - 0x2d4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x441550
lea edx, [ebp - 0x2d4]
push edx
call fcn.0044b590
add esp, 8
push 0x441554
lea eax, [ebp - 0x2d4]
push eax
call fcn.0044b590
add esp, 8
lea ecx, [ebp - 0x3d8]
push ecx
call fcn.0044b500
add esp, 4
push eax
lea edx, [ebp - 0x3d8]
push edx
call dword [sym.imp.USER32.dll_CharUpperBuffA]
lea eax, [ebp - 0x2d4]
push eax
call fcn.0044b500
add esp, 4
push eax
lea ecx, [ebp - 0x2d4]
push ecx
lea edx, [ebp - 0x3d8]
push edx
call fcn.0044b6d0
add esp, 0xc
test eax, eax
je 0x448c58
lea eax, [ebp - 0x3d8]
push eax
mov ecx, dword [ebp - 0x4fc]
call fcn.004486a3
push 0x441564
lea ecx, [ebp - 0x3d8]
push ecx
call fcn.0044b0d0
add esp, 8
test eax, eax
jne 0x448c58
mov edx, dword [ebp - 0xa8]
push edx
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x4f8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x448b78
pop edi
mov esp, ebp
pop ebp
ret