Function at 0x401790
Capabilities:
Enumerate processes
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496566
mov eax, dword fs:[0]
push eax
sub esp, 0x694
push esi
push edi
lea edi, [ebp - 0x6a0]
mov ecx, 0x1a5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4b62b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0xffffffff
mov word [ebp - 0x230], 0
push 0x206
push 0
lea eax, [ebp - 0x22e]
push eax
call fcn.00472c50
add esp, 0xc
mov dword [ebp - 0x464], 0
push 0x228
push 0
lea ecx, [ebp - 0x460]
push ecx
call fcn.00472c50
add esp, 0xc
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x470], 0
lea ecx, [ebp - 0x478]
call fcn.0040f5f0
mov dword [ebp - 4], 0
call fcn.00401640
call fcn.004016f0
test eax, eax
je 0x40192e
lea ecx, [ebp - 0x484]
call fcn.0040f5f0
mov byte [ebp - 4], 1
mov word [ebp - 0x694], 0
push 0x206
push 0
lea edx, [ebp - 0x692]
push edx
call fcn.00472c50
add esp, 0xc
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
push ecx
push 0x4a6480
lea edx, [ebp - 0x484]
push edx
call fcn.00403280
add esp, 0xc
mov esi, esp
push 0x104
lea eax, [ebp - 0x694]
push eax
lea ecx, [ebp - 0x484]
call fcn.0041cae0
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp esi, esp
call fcn.00492e6b
lea ecx, [ebp - 0x694]
push ecx
lea ecx, [ebp - 0x478]
call fcn.00402400
lea edx, [ebp - 0x478]
push edx
call fcn.004015d0
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.00472839
add esp, 4
cmp eax, 3
jbe 0x40191d
mov ecx, dword [ebp + 8]
add ecx, 6
push ecx
lea ecx, [ebp - 0x478]
call fcn.00402430
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x484]
call fcn.004023a0
jmp 0x40193d
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x478]
call fcn.00402400
lea ecx, [ebp - 0x478]
call fcn.0041cae0
push eax
push str.KillProcessByPath_path:_ws
mov ecx, 0x4ba4f8
call fcn.00458c70
add esp, 8
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x401972
jmp 0x401b4b
mov dword [ebp - 0x464], 0x22c
lea eax, [ebp - 0x464]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x401995
jmp 0x401b4b
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.00492e6b
mov dword [ebp - 0x69c], eax
mov edx, dword [ebp - 0x45c]
cmp edx, dword [ebp - 0x69c]
je 0x4019ca
cmp dword [ebp - 0x45c], 0
je 0x4019ca
cmp dword [ebp - 0x45c], 4
jne 0x4019cf
jmp 0x401b2c
mov esi, esp
mov eax, dword [ebp - 0x45c]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.00492e6b
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x401b2c
mov dword [ebp - 0x1c], 0
call fcn.004016f0
test eax, eax
je 0x401a36
cmp dword [0x4b9ef0], 0
je 0x401a36
mov esi, esp
push 0x104
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [0x4b9ef0]
cmp esi, esp
call fcn.00492e6b
mov dword [ebp - 0x1c], eax
jmp 0x401a63
cmp dword [0x4b9eec], 0
je 0x401a63
mov esi, esp
push 0x104
lea eax, [ebp - 0x230]
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [0x4b9eec]
cmp esi, esp
call fcn.00492e6b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401b12
lea ecx, [ebp - 0x478]
call fcn.0040f780
cmp dword [ebp - 0x1c], eax
jne 0x401b12
lea edx, [ebp - 0x230]
push edx
lea ecx, [ebp - 0x478]
call fcn.0041cae0
push eax
call fcn.004722da
add esp, 8
test eax, eax
jne 0x401b12
mov esi, esp
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp esi, esp
call fcn.00492e6b
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x45c]
push edx
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00492e6b
push eax
mov eax, dword [ebp - 0x18]
push eax
push str.Terminate_Process_return:_d__error:_d__pid:_d__path:_ws
mov ecx, 0x4ba4f8
call fcn.00458c70
add esp, 0x14
cmp dword [ebp - 0x18], 0
jne 0x401b03
mov ecx, dword [ebp - 0x470]
add ecx, 1
mov dword [ebp - 0x470], ecx
jmp 0x401b12
mov edx, dword [ebp - 0x46c]
add edx, 1
mov dword [ebp - 0x46c], edx
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00492e6b
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x464]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4019aa
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x20], 0
je 0x401b64
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00492e6b
cmp dword [ebp - 0x24], 0xffffffff
je 0x401b7d
mov esi, esp
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00492e6b
cmp dword [ebp + 0xc], 0
je 0x401b8e
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x46c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x470]
mov dword [ebp - 0x6a0], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.004023a0
mov eax, dword [ebp - 0x6a0]
push edx
mov ecx, ebp
push eax
lea edx, [0x401bec]
call fcn.00492e8e
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472710
add esp, 0x6a0
cmp ebp, esp
call fcn.00492e6b
mov esp, ebp
pop ebp
ret