Function at 0x40cec0
Capabilities:
Enumerate gui resources
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4664e8
push 0x43a420
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x46d560]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x518], ecx
mov dword [ebp - 0x514], 0
wait
mov dword [ebp - 4], 0
xor esi, esi
mov dword [ebp - 0x51c], esi
xor ebx, ebx
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x508], 0x128
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x528], edi
cmp edi, 0xffffffff
jne 0x40cf59
push 0x30
push 0x45f808
push 0x461330
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40d3a9
lea eax, [ebp - 0x508]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x40d31d
mov edi, dword [ebp - 0x500]
mov dword [ebp + ebx*4 - 0x3c8], edi
mov ecx, 0x460cdc
lea eax, [ebp - 0x4e4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40cfa7
test dl, dl
je 0x40cfa3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40cfa7
add eax, 2
add ecx, 2
test dl, dl
jne 0x40cf87
xor eax, eax
jmp 0x40cfac
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40d2fd
mov dword [0x47313c], eax
push edi
push 0x40df70
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x47313c], 0
je 0x40d2fd
cmp dword [0x473a10], 0
je 0x40cfe4
cmp dword [0x473a0c], 0
jne 0x40cffd
mov ecx, edi
call fcn.004091b0
mov eax, dword [ebp - 0x518]
push dword [eax + 0x20]
call dword [0x473664]
add esp, 4
mov dword [ebp - 0x3cc], 0
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0x510], 0
mov dword [ebp - 0x3d0], 0
mov dword [ebp - 0x3d4], 0
mov dword [ebp - 0x3d8], 0
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x3c], xmm0
movdqu xmmword [ebp - 0x2c], xmm0
push dword [ebp + ebx*4 - 0x3c8]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x514], edi
test edi, edi
jne 0x40d0d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov byte [ebp - 0xa8], 0
push 0x63
push edi
lea eax, [ebp - 0xa7]
push eax
call fcn.0043a170
add esp, 0xc
push esi
push 0x461344
push 0x64
lea eax, [ebp - 0xa8]
push eax
call fcn.0043959d
add esp, 0x10
push 0x34
push 0x4607a8
lea eax, [ebp - 0xa8]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40d3a9
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [ebp - 0x51c]
lea eax, [ebp - 0x3cc]
push eax
push 4
lea eax, [ebp - 0x50c]
push eax
push dword [0x473a0c]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 4
lea eax, [ebp - 0x50c]
push eax
mov eax, dword [ebp - 0x50c]
add eax, 0x70
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x50c]
test eax, eax
je 0x40d2a5
mov dword [ebp - 0x3dc], 0
lea ecx, [ebp - 0x3cc]
push ecx
push 4
lea ecx, [ebp - 0x3dc]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 4
lea eax, [ebp - 0x50c]
push eax
mov eax, dword [0x473a08]
add eax, dword [ebp - 0x50c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 4
lea eax, [ebp - 0x50c]
push eax
mov eax, dword [ebp - 0x50c]
add eax, 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 4
lea eax, [ebp - 0x3d0]
push eax
mov eax, dword [ebp - 0x50c]
add eax, 0x4c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 4
lea eax, [ebp - 0x3d4]
push eax
mov eax, dword [ebp - 0x50c]
add eax, 0x24a0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 4
lea eax, [ebp - 0x3d8]
push eax
mov eax, dword [ebp - 0x50c]
add eax, 0x2520
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 0x10
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x50c]
add eax, 0x34
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 4
lea eax, [ebp - 0x510]
push eax
push dword [0x473a04]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 4
lea eax, [ebp - 0x510]
push eax
mov ecx, dword [ebp - 0x510]
mov eax, dword [0x473998]
add eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 4
lea eax, [ebp - 0x510]
push eax
mov eax, dword [ebp - 0x510]
add eax, 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 4
lea eax, [ebp - 0x510]
push eax
mov eax, dword [ebp - 0x510]
add eax, 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x3cc]
push eax
push 0x10
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x510]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x514], 0
movss xmm0, dword [ebp - 0x3d4]
divss xmm0, dword [ebp - 0x3d8]
mulss xmm0, dword [0x4624a0]
cvttss2si eax, xmm0
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x3d0]
lea eax, [ebp - 0x3c]
push eax
push esi
push ecx
push dword [ebp + ebx*4 - 0x3c8]
push ecx
mov ecx, dword [ebp - 0x518]
call fcn.0040ca50
inc esi
mov dword [ebp - 0x51c], esi
lea eax, [ebp - 0x508]
push eax
mov edi, dword [ebp - 0x528]
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
inc ebx
mov dword [ebp - 0x520], ebx
jmp 0x40cf67
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x473b24]
mov esi, eax
mov edi, dword [ebp - 0x51c]
sub esi, edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x524], esi
test esi, esi
jle 0x40d363
sub eax, esi
push 0
push eax
push 0x1008
mov eax, dword [ebp - 0x518]
push dword [eax + 0x1058]
call ebx
dec esi
mov eax, dword [0x473b24]
jmp 0x40d339
cmp eax, edi
cmovne eax, edi
mov dword [0x473b24], eax
wait
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x40d3b3
wait
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004384c1
mov esp, ebp
pop ebp
ret