Function at 0x472240
Capabilities:
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cad1c
mov eax, dword fs:[0]
push eax
sub esp, 0x67c
mov eax, dword [0x502054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x678], ecx
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 0x641], 0
push 0
push eax
call fcn.004abb60
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x664], eax
xor edi, edi
mov dword [ebp - 0x660], ebx
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x658], edi
mov dword [ebp - 0x65c], edi
mov dword [ebp - 4], edi
sub esp, 8
lea ecx, [ebp - 0x670]
call fcn.0047a610
push edi
push 2
mov eax, dword [eax + 8]
call eax
mov esi, eax
mov dword [ebp - 0x650], esi
cmp esi, 0xffffffff
je 0x472387
lea eax, [ebp - 0x444]
mov dword [ebp - 0x444], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x472380
cmp ebx, edi
je 0x47233d
mov edi, ebx
lea esi, [ebp - 0x444]
mov ecx, 0x8b
add ebx, 0x22c
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x650]
mov dword [ebp - 0x660], ebx
mov edi, dword [ebp - 0x658]
jmp 0x472362
lea eax, [ebp - 0x444]
push eax
push ebx
lea ecx, [ebp - 0x664]
call fcn.0047c840
mov edi, dword [ebp - 0x65c]
mov ebx, dword [ebp - 0x660]
mov dword [ebp - 0x658], edi
lea eax, [ebp - 0x444]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x472310
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x654], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x654]
mov eax, 0x75ded953
sub ebx, esi
mov dword [ebp - 0x650], 0
imul ebx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x67c], eax
je 0x472671
add esi, 8
mov dword [ebp - 0x64c], esi
nop
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x472646
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x670], ebx
xor eax, eax
mov dword [ebp - 0x66c], edi
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 1
sub esp, 8
mov esi, dword [esi]
lea ecx, [ebp - 0x688]
call fcn.0047a610
push esi
push 8
mov eax, dword [eax + 8]
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x47245d
lea eax, [ebp - 0x640]
mov dword [ebp - 0x640], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x472456
lea eax, [ebp - 0x640]
push eax
push edi
lea ecx, [ebp - 0x670]
call fcn.0047c630
mov eax, dword [ebp - 0x668]
mov edi, dword [ebp - 0x66c]
mov ebx, dword [ebp - 0x670]
mov dword [ebp - 0x674], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub edi, ebx
mov eax, 0xf6603d99
imul edi
add edx, edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4725d1
lea esi, [ebx + 0x220]
call fcn.00456f20
mov ecx, eax
test ecx, ecx
je 0x47270e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x648], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x648]
push esi
call fcn.00460eb0
test al, al
jne 0x4724dc
test esi, esi
jne 0x4724b7
xor ecx, ecx
jmp 0x4724cf
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4724c0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x648]
call fcn.00461210
mov byte [ebp - 4], 3
lea eax, [ebp - 0x218]
push eax
push 0x4ee1fc
lea ecx, [ebp - 0x648]
call fcn.00460510
push 0x4ec298
push str.___
lea ecx, [ebp - 0x648]
call fcn.00460510
mov esi, dword [ebp - 0x648]
mov edi, dword [esi - 0xc]
test edi, edi
js 0x472704
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x472540
push edi
lea ecx, [ebp - 0x648]
call fcn.00461340
mov esi, dword [ebp - 0x648]
lea eax, [edi + 1]
push eax
push esi
call fcn.004b372e
add esp, 8
cmp edi, dword [esi - 8]
jg 0x472704
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
mov eax, dword [ebp - 0x678]
test eax, eax
je 0x47270e
push eax
push esi
call fcn.004b306b
add esp, 8
test eax, eax
jne 0x4725b5
mov eax, dword [ebp - 0x64c]
push dword [eax]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4725b5
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x641], 1
mov byte [ebp - 4], 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4725d1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
test ebx, ebx
je 0x472640
mov ecx, dword [ebp - 0x674]
mov eax, 0xf6603d99
sub ecx, ebx
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
imul ecx, eax, 0x428
mov eax, ebx
cmp ecx, 0x1000
jb 0x472618
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4726ff
push ecx
push ebx
call fcn.004aa103
add esp, 8
mov dword [ebp - 0x670], 0
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x668], 0
mov esi, dword [ebp - 0x64c]
mov eax, dword [ebp - 0x650]
add esi, 0x22c
inc eax
mov dword [ebp - 0x64c], esi
mov dword [ebp - 0x650], eax
cmp eax, dword [ebp - 0x67c]
jb 0x4723c0
mov esi, dword [ebp - 0x654]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4726dd
mov ecx, dword [ebp - 0x658]
mov eax, 0x75ded953
sub ecx, esi
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
imul ecx, eax, 0x22c
mov eax, esi
cmp ecx, 0x1000
jb 0x4726b5
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4726ff
push ecx
push esi
call fcn.004aa103
add esp, 8
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 0
mov al, byte [ebp - 0x641]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a9913
mov esp, ebp
pop ebp
ret
call fcn.004b3474
push 0x80070057
call fcn.00456c70
push 0x80004005
call fcn.00456c70
int3