Function at 0x4636ea
Capabilities:
Enumerate processes
Get process image filename
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524bf9
mov eax, dword fs:[0]
push eax
mov eax, 0x23b0
call fcn.004ade10
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2340], ecx
and dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x233c], eax
cmp dword [ebp - 0x233c], 0xffffffff
jne 0x46375c
push str.Kill_all_process__create_snapshot_fail.
call fcn.0046c5d3
pop ecx
and dword [ebp - 0x2354], 0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2354]
jmp 0x463c61
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2348]
push eax
mov ecx, dword [ebp - 0x2340]
add ecx, 0x48
call fcn.0046bf14
lea eax, [ebp - 0x23b8]
push eax
mov ecx, dword [ebp - 0x2340]
add ecx, 0x48
call fcn.0046b1c9
mov dword [ebp - 0x2358], eax
mov eax, dword [ebp - 0x2358]
mov ecx, dword [ebp - 0x2348]
cmp ecx, dword [eax]
jne 0x4637ac
mov dword [ebp - 0x2344], 1
jmp 0x4637b3
and dword [ebp - 0x2344], 0
movzx eax, byte [ebp - 0x2344]
test eax, eax
je 0x4637e7
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Kill_all_process__game_not_find:__llu.
call fcn.0046c5d3
add esp, 0xc
and dword [ebp - 0x235c], 0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x235c]
jmp 0x463c61
mov eax, dword [ebp - 0x2348]
add eax, 0x10
mov dword [ebp - 0x2360], eax
mov eax, dword [ebp - 0x2360]
add eax, 8
push eax
lea ecx, [ebp - 0x20c0]
call fcn.00409053
mov byte [ebp - 4], 1
lea eax, [ebp - 0x20c0]
push eax
lea eax, [ebp - 0x2108]
push eax
call fcn.00481e2d
pop ecx
pop ecx
mov dword [ebp - 0x2364], eax
mov eax, dword [ebp - 0x2364]
mov dword [ebp - 0x2368], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x2368]
lea ecx, [ebp - 0x20c0]
call fcn.0041dc17
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2108]
call fcn.0040a62b
mov byte [ebp - 4], 4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2108]
mov dword [ebp - 0x23b4], eax
mov byte [ebp - 4], 5
mov byte [ebp - 4], 6
mov byte [ebp - 4], 1
push fcn.004d7c48
lea eax, [ebp - 0x23bc]
push eax
lea ecx, [ebp - 0x20c0]
call fcn.0046ae73
push dword [eax]
lea eax, [ebp - 0x2388]
push eax
lea ecx, [ebp - 0x20c0]
call fcn.0046b215
push dword [eax]
lea eax, [ebp - 0x238c]
push eax
lea ecx, [ebp - 0x20c0]
call fcn.0046ae73
push dword [eax]
lea eax, [ebp - 0x2390]
push eax
call fcn.004670f1
add esp, 0x14
push 0x1040
push 0
lea eax, [ebp - 0x2090]
push eax
call fcn.004b0090
add esp, 0xc
mov dword [ebp - 0x2334], 0x22c
mov dword [ebp - 0x2384], 0x53999c
mov dword [ebp - 0x2384], 0x5399a4
lea eax, [ebp - 0x2334]
push eax
push dword [ebp - 0x233c]
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x234c], eax
mov dword [ebp - 0x2350], 1
cmp dword [ebp - 0x234c], 0
je 0x463c1c
push dword [ebp - 0x232c]
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2338], eax
cmp dword [ebp - 0x2338], 0
je 0x463bec
push 0x81f
lea eax, [ebp - 0x2090]
push eax
push 0
push dword [ebp - 0x2338]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x463a0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2310]
push eax
push str.GetModuleFileNameEx_failed__szExeFile:__s__err:__d
call fcn.0046c5d3
add esp, 0xc
push 0x1040
push 0
lea eax, [ebp - 0x1050]
push eax
call fcn.004b0090
add esp, 0xc
push 0x81f
lea eax, [ebp - 0x1050]
push eax
push dword [ebp - 0x2338]
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x4639e0
push 0x820
lea eax, [ebp - 0x2090]
push eax
lea eax, [ebp - 0x1050]
push eax
lea ecx, [ebp - 0x2380]
call fcn.00468452
jmp 0x463a0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2310]
push eax
push str.GetProcessImageFileNameW_failed__szExeFile:__s__err:__d
call fcn.0046c5d3
add esp, 0xc
push dword [ebp - 0x2338]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x463920
lea eax, [ebp - 0x2090]
push eax
lea ecx, [ebp - 0x20a8]
call fcn.00409053
mov byte [ebp - 4], 7
lea eax, [ebp - 0x20a8]
push eax
lea eax, [ebp - 0x20f0]
push eax
call fcn.00481e2d
pop ecx
pop ecx
mov dword [ebp - 0x237c], eax
mov eax, dword [ebp - 0x237c]
mov dword [ebp - 0x2378], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x2378]
lea ecx, [ebp - 0x20a8]
call fcn.0041dc17
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x20f0]
call fcn.0040a62b
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 7
lea eax, [ebp - 0x20f0]
mov dword [ebp - 0x2394], eax
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 7
push fcn.004d7c48
lea eax, [ebp - 0x2398]
push eax
lea ecx, [ebp - 0x20a8]
call fcn.0046ae73
push dword [eax]
lea eax, [ebp - 0x239c]
push eax
lea ecx, [ebp - 0x20a8]
call fcn.0046b215
push dword [eax]
lea eax, [ebp - 0x23a0]
push eax
lea ecx, [ebp - 0x20a8]
call fcn.0046ae73
push dword [eax]
lea eax, [ebp - 0x23a4]
push eax
call fcn.004670f1
add esp, 0x14
push 0
lea eax, [ebp - 0x20c0]
push eax
lea ecx, [ebp - 0x20a8]
call fcn.0046c0c6
cmp eax, 0xffffffff
je 0x463baf
lea ecx, [ebp - 0x20a8]
call fcn.0040a5f1
push eax
push str.Kill_all_process__exe_path:__s
call fcn.0046c4d6
pop ecx
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x2338]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x463baf
lea eax, [ebp - 0x20a8]
push eax
lea eax, [ebp - 0x20d8]
push eax
call fcn.0044affe
pop ecx
pop ecx
mov dword [ebp - 0x2374], eax
mov eax, dword [ebp - 0x2374]
mov dword [ebp - 0x2370], eax
mov byte [ebp - 4], 0xd
push dword [ebp - 0x2370]
mov ecx, dword [ebp + 0x10]
call fcn.004337ca
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x20d8]
call fcn.00405a40
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 7
lea eax, [ebp - 0x20d8]
mov dword [ebp - 0x23a8], eax
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 7
and dword [ebp - 0x2350], 0
lea ecx, [ebp - 0x20a8]
call fcn.0040a5f1
push eax
push str.Kill_process_failed__exe_path:__s
call fcn.0046c5d3
pop ecx
pop ecx
push dword [ebp - 0x2338]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x20a8]
call fcn.0040a62b
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 1
lea eax, [ebp - 0x20a8]
mov dword [ebp - 0x23ac], eax
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 1
jmp 0x463bff
lea eax, [ebp - 0x2310]
push eax
push str.OpenProcess_failed__szExeFile:__s
call fcn.0046c5d3
pop ecx
pop ecx
lea eax, [ebp - 0x2334]
push eax
push dword [ebp - 0x233c]
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x234c], eax
jmp 0x463920
mov eax, dword [ebp - 0x2350]
mov dword [ebp - 0x236c], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x20c0]
call fcn.0040a62b
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0
lea eax, [ebp - 0x20c0]
mov dword [ebp - 0x23b0], eax
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x236c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc