Function at 0x57a800
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fcfcb
mov eax, dword fs:[0]
push eax
sub esp, 0x524
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x520], edi
test byte [edi + 0x28], 1
lea ecx, [ebp - 0x3c]
movzx eax, byte [ebp + 8]
xorps xmm0, xmm0
mov ebx, 1
movq qword [ebp - 0x3c], xmm0
cmove ebx, eax
mov dword [ebp - 0x34], 0
call fcn.005dc5e0
sub esp, 8
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x48]
movq qword [ebp - 0x48], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x63623c
push dword [edi + 0xfc]
call fcn.005dc520
push 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
push 0xffffffffffffffff
mov dword [ebp - 0x28], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28]
call fcn.005d6a80
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 2
push eax
push str.KillAllIgnoreList
lea ecx, [ebp - 0x28]
call fcn.005d6740
test bl, bl
je 0x57a92b
mov ecx, dword [edi + 0xcc]
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x57a913
test bl, 4
je 0x57a8eb
push str.Killing_all_not_digitally_signed_processes...
jmp 0x57a90c
test bl, 2
je 0x57a8f7
push str.Killing_all_non_trusted_processes...
jmp 0x57a90c
test bl, 1
je 0x57a903
push str.Killing_all_non_system_processes...
jmp 0x57a90c
test ebx, ebx
jne 0x57a913
push str.Killing_all_non_critical_processes...
push 0xffffffffffffffff
call fcn.005b66e0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push ebx
mov ecx, edi
call fcn.0057a310
mov ebx, eax
jmp 0x57b01e
push ecx
mov ecx, edi
call fcn.0057c7a0
push 0x270
mov esi, eax
lea eax, [ebp - 0x2b8]
push 0
push eax
call fcn.00420090
add esp, 8
lea ecx, [ebp - 0x2b8]
push esi
push 0xffffffffffffffff
push 0xc80000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x172
push 0x244
push str.Kill_processes_using_filters
push str.UVK_DLG_CLASS
push dword [edi + 0xc]
call fcn.005c6220
push 0xffffff
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 3
call fcn.005c4720
push 0
lea ecx, [ebp - 0x2b8]
call fcn.005c44a0
push 0xffffff
call fcn.005c44b0
push 0
push 0
call fcn.005c5730
mov edx, esi
mov ecx, eax
call fcn.005d3010
test esi, esi
je 0x57a9d0
push 0
lea ecx, [ebp - 0x2b8]
call fcn.005c5730
mov ecx, dword [edi + 0x10]
push eax
call fcn.005c6150
movsd xmm1, qword [0x6edb20]
lea ecx, [ebp - 0x2b8]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
sub esp, 8
push 0x28
push 0x28
push 5
push 5
push ecx
push 0x81
push dword [edi + 0x20]
lea ecx, [ebp - 0x2b8]
call fcn.005c01a0
push 0xffffffffffffffff
push 0x10000001
push 0x19
push 0x1a4
push 0xf
push 0x55
push str.Kill_processes_using_filters
lea ecx, [ebp - 0x2b8]
call fcn.005c0890
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x2b8]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x37
push 0x113
push 0x3c
push 0x14
push str.Please_save_your_work_before_using_this_feature._r_nSelect_the_desired_option_below.
lea ecx, [ebp - 0x2b8]
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x23
push 0xf5
push 0x3c
push 0x140
push str.Add_process_names_to_ignore_in_the_text_box_below__one_per_line.
lea ecx, [ebp - 0x2b8]
call fcn.005c0890
movsd xmm1, qword [0x6edb08]
lea ecx, [ebp - 0x2b8]
push 0
push str.Arial
push 1
push 0x190
mov dword [ebp - 0x514], eax
call fcn.005c42b0
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x2b8]
sub esp, 0xc
push eax
push str.Kill_all_processes_whose_executable_files_are_not_digitally_signed.
mov al, bl
and al, 4
movzx eax, al
push eax
push ecx
push 0xd2
push 0x78
push 0x1e
push str._Kill_all_non_signed_processes
mov ecx, edi
call fcn.005491c0
sub esp, 0xc
mov dword [ebp - 0x528], eax
lea eax, [ebp - 0x2b8]
mov cl, bl
push eax
push str.Kill_all_processes_whose_executable_files_are_not_part_of_a_internal_trusted_list.
and cl, 2
movzx ecx, cl
push ecx
push ecx
push 0xd2
push 0xa0
push 0x1e
push str._Kill_all_non_trusted_processes
mov ecx, edi
call fcn.005491c0
sub esp, 0xc
mov dword [ebp - 0x52c], eax
lea eax, [ebp - 0x2b8]
mov cl, bl
and cl, 1
movzx ecx, cl
push eax
push str.Kill_all_processes_whose_executable_files_are_not_system_protected_files.
push ecx
push ecx
push 0xd2
push 0xc8
push 0x1e
push str._Kill_all_non_system_processes
mov ecx, edi
call fcn.005491c0
sub esp, 0xc
mov dword [ebp - 0x530], eax
lea eax, [ebp - 0x2b8]
test ebx, ebx
sete cl
push eax
push str.Kill_all_processes_that_can_be_killed_without_making_the_computer_reboot.
movzx ecx, cl
push ecx
push ecx
push 0xd2
push 0xf0
push 0x1e
push str._Kill_all_non_critical_processes
mov ecx, edi
call fcn.005491c0
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x2b8]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 1
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x24], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc570
push 0
push 0
push 0x62781c
push 0x624514
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.005da270
push 0xffffffffffffffff
push 0x10b010c0
push 0xb4
push 0xf5
push 0x64
push 0x140
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2b8]
call fcn.005c0c90
mov esi, eax
push ecx
mov dword [ebp - 0x4fc], esi
push 0xffffffffffffffff
push 0x16
push 0x55
push 0x11d
push 0x159
push str.Add...
lea ecx, [ebp - 0x2b8]
call fcn.005c1a50
push ecx
push 0xffffffffffffffff
push 0x16
push 0x55
push 0x11d
push 0x1c7
push str.Save
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x504], eax
call fcn.005c1a50
push 0x10024
push 0x800009
push 0xb4
push 0xf5
push 0x64
push 0x140
push 0
push str.__Process_name
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x508], eax
call fcn.005c0620
push 1
mov ebx, eax
lea ecx, [ebp - 0x2b8]
push 0xffffffffffffffff
mov dword [ebp - 0x518], ebx
call fcn.005ba360
push ecx
push 0
push 0x16
push 0x5f
push 0x11d
push 0x18b
push str.Add___Close
lea ecx, [ebp - 0x2b8]
call fcn.005c1a50
push ebx
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x50c], eax
call fcn.005c5730
push 0xdc
push 0
push 0x101e
push eax
mov dword [ebp - 0x510], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x96
push 0x14a
push 0x6e
push str.Kill_processes
lea ecx, [ebp - 0x2b8]
call fcn.005c1a50
push 0x186a0
push ecx
push str.Start_killing_the_selected_processes
push 0xffffffffffffffff
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x524], eax
call fcn.005bcaf0
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x64
push 0x14a
push 0x172
push str.Close___Cancel
lea ecx, [ebp - 0x2b8]
call fcn.005c1a50
mov dword [ebp - 0x51c], eax
lea eax, [ebp - 0x2b8]
push eax
sub esp, 8
call fcn.0057b940
mov eax, 0x1b
mov byte [ebp - 0x18], 1
mov word [ebp - 0x16], ax
lea ecx, [ebp - 0x2b8]
mov eax, dword [ebp - 0x51c]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x18]
push 1
push eax
call fcn.005c47a0
push 1
push 1
lea ecx, [ebp - 0x2b8]
call fcn.005c3f80
push 0
lea ecx, [ebp - 0x2b8]
call fcn.005c5730
mov ecx, dword [edi + 0xcc]
mov dword [ebp - 0x500], eax
test ecx, ecx
je 0x57adee
call fcn.005b6bd0
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x57adee
mov ecx, dword [edi + 0xcc]
push 1
mov byte [ebp - 0x4f5], 1
call fcn.005b6250
jmp 0x57adf5
mov byte [ebp - 0x4f5], 0
push 0
mov ecx, edi
call fcn.0057b640
test eax, eax
je 0x57afee
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
cmp eax, 0xfffffffa
je 0x57afee
lea edx, [ebp - 0x2b8]
cmp dword [ecx + 0x30], edx
jne 0x57afdd
cmp eax, dword [ebp - 0x504]
jne 0x57b070
push 0
push 0
push 0x1009
push dword [ebp - 0x510]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x4ec], esi
mov byte [ebp - 4], 5
cmp esi, eax
je 0x57b056
test esi, esi
je 0x57b056
push 0x228
lea eax, [ebp - 0x4e4]
push 0
push eax
call fcn.00420090
add esp, 0xc
mov dword [ebp - 0x4e8], 0x22c
lea eax, [ebp - 0x4e8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x57af06
lea eax, [ebp - 0x4c4]
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc510
push str._System_Process_
lea ecx, [ebp - 0x24]
call fcn.005dc4c0
test al, al
jne 0x57aef4
push str.System
lea ecx, [ebp - 0x24]
call fcn.005dc4c0
test al, al
jne 0x57aef4
push 0
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x4c4]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.005bbb80
lea eax, [ebp - 0x4e8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x57aea6
mov ecx, dword [ebp - 0x510]
xor edx, edx
push 0xfffffffffffffffe
call fcn.005c8de0
push 0
push 0
push 0xb
push dword [ebp - 0x500]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push str.Tick_the_check_box_in_the_lines_you_wish_to_add__and_click__Add___Close_.
push dword [ebp - 0x514]
lea ecx, [ebp - 0x2b8]
call fcn.005bcd30
push 1
push dword [ebp - 0x4fc]
lea ecx, [ebp - 0x2b8]
call fcn.005bd3f0
push 1
push dword [ebp - 0x504]
lea ecx, [ebp - 0x2b8]
call fcn.005bd3f0
push 1
push dword [ebp - 0x508]
lea ecx, [ebp - 0x2b8]
call fcn.005bd3f0
push 2
push ebx
lea ecx, [ebp - 0x2b8]
call fcn.005bd3f0
push 2
push dword [ebp - 0x50c]
lea ecx, [ebp - 0x2b8]
call fcn.005bd3f0
push 0
push 1
push 0xb
push dword [ebp - 0x500]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0
push dword [ebp - 0x500]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x80
push ebx
lea ecx, [ebp - 0x2b8]
call fcn.005bd3f0
mov byte [ebp - 4], 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x4fc]
push 0
mov ecx, edi
call fcn.0057b640
test eax, eax
jne 0x57ae06
xor ebx, ebx
cmp byte [ebp - 0x4f5], 0
je 0x57b00b
mov ecx, dword [edi + 0xcc]
test ecx, ecx
je 0x57b00b
sub esp, 8
call fcn.005b62b0
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x2b8]
call fcn.005c1c60
lea ecx, [ebp - 0x28]
call fcn.005d69e0
lea ecx, [ebp - 0x48]
call fcn.005dc430
lea ecx, [ebp - 0x3c]
call fcn.005dc430
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
mov byte [ebp - 4], 4
cmp esi, 0xffffffff
je 0x57afd7
test esi, esi
je 0x57afd7
jmp 0x57afd0
cmp eax, dword [ebp - 0x508]
jne 0x57b0f0
push esi
lea ecx, [ebp - 0x2b8]
call fcn.005bc230
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc1c0
push 0
push 0
push 0x624514
push 0x62781c
lea ecx, [ebp - 0x24]
call fcn.005da270
push 0
push 0
push 0x624514
push 0x636a84
lea ecx, [ebp - 0x24]
call fcn.005da270
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
push 1
push str.KillAllIgnoreList
lea ecx, [ebp - 0x28]
call fcn.005d5f20
sub esp, 0x14
lea eax, [ebp - 0x2b8]
mov ecx, edi
push eax
push 4
push str.Your_ignore_list_has_been_saved_for_the_next_time_you_use_this_feature.
call fcn.005496a0
jmp 0x57afdd
cmp eax, dword [ebp - 0x50c]
jne 0x57b31a
xorps xmm0, xmm0
lea ecx, [ebp - 0x2b8]
push ebx
movlpd qword [ebp - 0x30], xmm0
call fcn.005bb7f0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0
xorps xmm0, xmm0
xor esi, esi
movlpd qword [ebp - 0x4f4], xmm0
mov dword [ebp - 0x4f4], esi
mov dword [ebp - 0x4f0], esi
push dword [ebp - 0x4fc]
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 7
call fcn.005bc230
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc1c0
lea ecx, [ebp - 0x24]
call fcn.005dc3a0
dec eax
lea ecx, [ebp - 0x24]
push eax
call fcn.005dc440
cmp word [eax], 0xa
je 0x57b181
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x62781c
lea ecx, [ebp - 0x24]
call fcn.005da780
mov eax, dword [ebp - 0x30]
mov ebx, 1
cmp dword [eax], ebx
jl 0x57b214
mov edi, 4
nop word [eax + eax]
push 0
push dword [eax + edi]
lea ecx, [ebp - 0x2b8]
push dword [ebp - 0x518]
call fcn.005bb510
mov dword [ebp - 0x4ec], eax
test esi, esi
je 0x57b1cf
push esi
call fcn.0041e1c3
mov eax, dword [ebp - 0x4ec]
add esp, 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
mov esi, eax
mov dword [ebp - 0x4f0], 0xffffffff
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x4f4], esi
call fcn.005da780
mov eax, dword [ebp - 0x30]
inc ebx
add edi, 4
cmp ebx, dword [eax]
jle 0x57b1a0
mov edi, dword [ebp - 0x520]
push 2
lea ecx, [ebp - 0x24]
call fcn.005dadc0
push 0
push 0
push 0x62781c
push 0x629230
lea ecx, [ebp - 0x24]
call fcn.005da270
push 0
push 0
push 0xb
push dword [ebp - 0x500]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push str.Add_process_names_to_ignore_in_the_text_box_below__one_per_line.
push dword [ebp - 0x514]
lea ecx, [ebp - 0x2b8]
call fcn.005bcd30
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
mov ebx, dword [ebp - 0x4fc]
lea ecx, [ebp - 0x2b8]
push eax
push ebx
call fcn.005bcd30
push 2
push ebx
lea ecx, [ebp - 0x2b8]
call fcn.005bd3f0
push 2
push dword [ebp - 0x504]
lea ecx, [ebp - 0x2b8]
call fcn.005bd3f0
push 2
push dword [ebp - 0x508]
lea ecx, [ebp - 0x2b8]
call fcn.005bd3f0
mov ebx, dword [ebp - 0x518]
lea ecx, [ebp - 0x2b8]
push 1
push ebx
call fcn.005bd3f0
push 1
push dword [ebp - 0x50c]
lea ecx, [ebp - 0x2b8]
call fcn.005bd3f0
push 0
push 1
push 0xb
push dword [ebp - 0x500]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0
push dword [ebp - 0x500]
call dword [sym.imp.USER32.dll_InvalidateRect]
test esi, esi
je 0x57b305
push esi
call fcn.0041e1c3
add esp, 4
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x30]
push eax
call fcn.0041e1c3
add esp, 4
jmp 0x57afd7
cmp eax, dword [ebp - 0x524]
jne 0x57b373
sub esp, 0x14
lea eax, [ebp - 0x2b8]
mov ecx, edi
push eax
push 1
push str.Are_you_sure_you_want_to_start_terminating_processes_
call fcn.005496a0
cmp eax, 1
jne 0x57afdd
mov ecx, dword [edi + 0xcc]
test ecx, ecx
je 0x57b389
sub esp, 8
cmp byte [ebp - 0x4f5], 0
jne 0x57b384
push 0x46
push 0x1c2
lea eax, [ebp - 0x2b8]
push eax
push str.Curently_processing:
call fcn.005b6bf0
jmp 0x57b389
cmp eax, dword [ebp - 0x51c]
je 0x57afee
jmp 0x57afdd
call fcn.005b62b0
push esi
lea ecx, [ebp - 0x2b8]
call fcn.005bc230
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc1c0
push 0
push 0
push 0x624514
push 0x62781c
lea ecx, [ebp - 0x24]
call fcn.005da270
push 0
push 0
push 0x624514
push 0x636a84
lea ecx, [ebp - 0x24]
call fcn.005da270
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
push 1
push str.KillAllIgnoreList
lea ecx, [ebp - 0x28]
call fcn.005d5f20
push 4
push dword [ebp - 0x528]
lea ecx, [ebp - 0x2b8]
call fcn.005bc500
test eax, eax
je 0x57b402
mov esi, 4
jmp 0x57b439
push 4
push dword [ebp - 0x52c]
lea ecx, [ebp - 0x2b8]
call fcn.005bc500
test eax, eax
je 0x57b420
mov esi, 2
jmp 0x57b439
push 4
push dword [ebp - 0x530]
lea ecx, [ebp - 0x2b8]
call fcn.005bc500
neg eax
sbb esi, esi
neg esi
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
mov ecx, edi
call fcn.0057a310
cmp byte [ebp - 0x4f5], 0
mov ebx, eax
jne 0x57b466
mov ecx, dword [edi + 0xcc]
test ecx, ecx
je 0x57b466
push 2
call fcn.005b6250
mov eax, 0x636bb8
lea ecx, [ebp - 0x24]
cmp ebx, 1
mov esi, 0x62439c
push ebx
cmovne esi, eax
call fcn.005db320
push 0x62796c
lea ecx, [ebp - 0x24]
call fcn.005dc4c0
test al, al
je 0x57b49d
push 0x628f64
lea ecx, [ebp - 0x24]
call fcn.005dc510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._killed_with_the_selected_filter.
push esi
push str._process
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
push 0x635804
lea ecx, [ebp - 0x24]
call fcn.005dc200
sub esp, 0x14
lea eax, [ebp - 0x2b8]
lea ecx, [ebp - 0x24]
push eax
push 4
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005496a0
jmp 0x57aff0