Function at 0x406d70
Capabilities:
Terminate process

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
push edi
xor esi, esi
xor edi, edi
push str.Kernel32.dll
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, esi
mov dword [esp + 0x24], ebp
jne 0x406da8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x21c
ret
push 0x128
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x406ff7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x4a
xor eax, eax
mov edi, ebx
push str.CreateToolhelp32Snapshot
push ebp
rep stosd dword es:[edi], eax
call esi
push 0
push 2
call eax
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
jne 0x406df9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x21c
ret
push str.Process32First
push ebp
call esi
push 0x15c
mov esi, eax
mov dword [ebx], 0x128
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x406e28
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret
mov ecx, 0x57
xor eax, eax
mov edi, ebp
push ebx
rep stosd dword es:[edi], eax
mov dword [ebp + 0x158], eax
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x20], ebp
call esi
and eax, 0xff
add ebx, 0x24
mov dword [esp + 0x10], eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea edx, [ebp + 4]
dec ecx
mov dword [esp + 0x28], edx
mov edi, edx
mov edx, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + 8]
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [ebp], ecx
jne 0x406e95
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x21c
ret
mov edx, dword [esp + 0x24]
push str.Process32Next
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406feb
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
push ecx
push edx
call eax
test al, al
je 0x406f1d
push 0x15c
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, eax
add esp, 4
test edx, edx
je 0x406feb
mov ecx, 0x57
xor eax, eax
mov edi, edx
mov esi, ebx
rep stosd dword es:[edi], eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [ebp + 0x158], edx
mov ebp, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [edx + 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 8]
mov dword [edx + 0x158], 0
mov dword [edx], eax
jmp 0x406e95
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x406feb
test ebx, ebx
je 0x406feb
lea edi, [ebx + 4]
xor ebp, ebp
push 4
push edi
mov dword [esp + 0x18], ebp
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
cmp eax, 0xffffffff
je 0x406f5c
push edi
call fcn.004056a0
add esp, 4
mov dword [esp + 0x10], eax
mov al, byte [0x4164cc]
test al, al
je 0x406fda
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x41618c]
and ecx, 3
cmp eax, 0x67
rep movsb byte es:[edi], byte [esi]
je 0x406fda
mov ecx, dword [ebx]
push ecx
push ebp
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebp
mov dword [esp + 0x1c], eax
je 0x406fb7
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x406fb7
mov dword [esp + 0x1c], ebp
mov edx, dword [0x41618c]
lea eax, [esp + 0x2c]
push eax
mov dword [0x417d78], edx
call fcn.004056a0
add esp, 4
mov dword [esp + 0x10], eax
mov dword [0x417d78], ebp
mov ebx, dword [ebx + 0x158]
lea ecx, [ebx + 4]
test ecx, ecx
jne 0x406f2d
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.MSVCRT.dll_free]
mov eax, esi
test esi, esi
je 0x40701f
jmp 0x407009
mov esi, dword [esp + 0x18]
mov esi, dword [esi + 0x158]
push eax
mov dword [esp + 0x1c], esi
call ebp
add esp, 4
mov eax, esi
test esi, esi
jne 0x407005
test edi, edi
je 0x40702a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x407034
push ebx
call ebp
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret