Function at 0x48ea60
Capabilities:
Enumerate processes
Get disk information
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c8111
mov eax, dword fs:[0]
push eax
sub esp, 0x668
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x678]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
push 0x206
mov edi, ecx
lea ecx, [esp + 0x262]
push esi
push ecx
mov dword [esp + 0x34], eax
mov word [esp + 0x268], si
call fcn.004a1e50
push 0x228
lea edx, [esp + 0x40]
push esi
push edx
mov dword [esp + 0x44], esi
call fcn.004a1e50
add esp, 0x18
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call fcn.00418110
mov dword [esp + 0x680], esi
call fcn.0048c830
call fcn.0048cd10
test eax, eax
je 0x48ec04
lea ecx, [esp + 0x20]
call fcn.00418110
push 0x206
lea eax, [esp + 0x46a]
push esi
mov byte [esp + 0x688], 1
push eax
mov word [esp + 0x470], si
call fcn.004a1e50
movzx ecx, word [edi]
push ecx
lea edx, [esp + 0x30]
push 0x4e251c
push edx
call fcn.0041b480
add esp, 0x18
push 0x104
lea eax, [esp + 0x468]
push eax
lea ecx, [esp + 0x28]
call fcn.0042cd20
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea ecx, [esp + 0x464]
push ecx
lea ecx, [esp + 0x18]
call fcn.00403020
push 1
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x1c]
call fcn.0043b2a0
push 0x4e1cf8
mov ecx, eax
mov byte [esp + 0x684], 2
call fcn.0043d4b0
test eax, eax
lea ecx, [esp + 0x24]
setne bl
mov byte [esp + 0x680], 1
call fcn.00418010
test bl, bl
je 0x48ebc3
push 0x4e1cf8
lea ecx, [esp + 0x18]
call fcn.00403050
mov eax, edi
lea edx, [eax + 2]
jmp 0x48ebd0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48ebd0
sub eax, edx
sar eax, 1
cmp eax, 3
jbe 0x48ebf1
add edi, 6
push edi
lea ecx, [esp + 0x18]
call fcn.00403050
lea ecx, [esp + 0x20]
mov byte [esp + 0x680], 0
call fcn.00418010
jmp 0x48ec0e
push edi
lea ecx, [esp + 0x18]
call fcn.00403020
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x20], edi
je 0x48eda1
lea eax, [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x34], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x48ed9a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
cmp eax, dword [esp + 0x24]
je 0x48ed7c
test eax, eax
je 0x48ed7c
cmp eax, 4
je 0x48ed7c
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x48ed7c
call fcn.0048cd10
test eax, eax
je 0x48eca6
mov eax, dword [0x4f8888]
test eax, eax
je 0x48eca6
push 0x104
lea ecx, [esp + 0x260]
push ecx
push esi
call eax
jmp 0x48ecc5
mov eax, dword [0x4f8884]
test eax, eax
je 0x48ed6f
push 0x104
lea edx, [esp + 0x260]
push edx
push 0
push esi
call eax
mov edi, eax
test edi, edi
je 0x48ed6f
lea ecx, [esp + 0x14]
call fcn.004180e0
cmp dword [ebp + 0xc], 0
je 0x48ed0c
cmp edi, eax
jbe 0x48ed6f
lea ecx, [esp + 0x14]
call fcn.004180e0
push eax
lea eax, [esp + 0x260]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042cd20
push eax
call fcn.004a716c
add esp, 0xc
jmp 0x48ed2a
cmp edi, eax
jne 0x48ed6f
lea eax, [esp + 0x25c]
push eax
lea ecx, [esp + 0x18]
call fcn.0042cd20
push eax
call fcn.004a3704
add esp, 8
test eax, eax
jne 0x48ed6f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x25c]
push ecx
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Terminate_Process_return:_d__error:_d__pid:_d__path:_ws
mov ebx, 0x4f8948
call fcn.0048a860
add esp, 0x14
test edi, edi
jne 0x48ed6a
add dword [esp + 0x1c], 1
jmp 0x48ed6f
add dword [esp + 0x18], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x20]
xor esi, esi
lea eax, [esp + 0x2c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x48ec4b
test esi, esi
je 0x48ed9a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x48edaf
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ecx, [esp + 0x14]
call fcn.00418010
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x678]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.004a1873
mov esp, ebp
pop ebp
ret