Function at 0x421fd0
Capabilities:
Check for unmoving mouse cursor
Enumerate processes
Terminate process
Terminate process by name
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470a1b
mov eax, dword fs:[0]
push eax
sub esp, 0x3cc
mov eax, dword [0x5e500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [esi + 0x8fe4]
mov dword [ebp - 0x244], 0
cmp edi, eax
jne 0x422090
push dword [esi + 0x8ff0]
call dword [0x5e65dc]
mov ecx, dword [esi + 0x8ff0]
cmp eax, 0x1b7
jne 0x422058
push 0x39
push ecx
call dword [0x5e65d8]
push 0
push dword [esi + 0x9360]
call dword [0x5e65d4]
push 0
push dword [esi + 0x9140]
call dword [0x5e65d4]
push 1
jmp 0x422082
push 0x1b7
push ecx
call dword [0x5e65d8]
push 1
push dword [esi + 0x9360]
call dword [0x5e65d4]
push 1
push dword [esi + 0x9140]
call dword [0x5e65d4]
push 0
push 8
push dword [esi + 0x98a0]
call dword [0x5e65a4]
lea eax, [esi + 0x85e4]
cmp edi, eax
jne 0x422114
push dword [esi + 0x85f0]
call dword [0x5e65dc]
mov ecx, dword [esi + 0x85f0]
cmp eax, 0x1b7
jne 0x4220dc
push 0x39
push ecx
call dword [0x5e65d8]
push 0
push dword [esi + 0x8960]
call dword [0x5e65d4]
push 0
push dword [esi + 0x8740]
call dword [0x5e65d4]
push 1
jmp 0x422106
push 0x1b7
push ecx
call dword [0x5e65d8]
push 1
push dword [esi + 0x8960]
call dword [0x5e65d4]
push 1
push dword [esi + 0x8740]
call dword [0x5e65d4]
push 0
push 8
push dword [esi + 0x8ea0]
call dword [0x5e65a4]
lea eax, [esi + 0x2ba4]
cmp edi, eax
jne 0x422198
push dword [esi + 0x2bb0]
call dword [0x5e65dc]
mov ecx, dword [esi + 0x2bb0]
cmp eax, 0x1b7
jne 0x422160
push 0x39
push ecx
call dword [0x5e65d8]
push 0
push dword [esi + 0x2f20]
call dword [0x5e65d4]
push 0
push dword [esi + 0x2d00]
call dword [0x5e65d4]
push 1
jmp 0x42218a
push 0x1b7
push ecx
call dword [0x5e65d8]
push 1
push dword [esi + 0x2f20]
call dword [0x5e65d4]
push 1
push dword [esi + 0x2d00]
call dword [0x5e65d4]
push 0
push 8
push dword [esi + 0x3460]
call dword [0x5e65a4]
lea eax, [esi + 0xc954]
cmp edi, eax
jne 0x422305
push dword [esi + 0xc960]
call dword [0x5e65dc]
mov ecx, dword [esi + 0xc960]
cmp eax, 0x104
jne 0x422229
push 0x39
push ecx
call dword [0x5e65d8]
push 0
push dword [esi + 0xccd0]
call dword [0x5e65d4]
push 0
push dword [esi + 0xcab0]
call dword [0x5e65d4]
push 1
push 8
push dword [esi + 0xd210]
call dword [0x5e65a4]
push 0xc0
push dword [esi + 0xd360]
call dword [0x5e65e0]
push 0x11f
push dword [esi + 0xdd60]
call dword [0x5e65e0]
push 0x67
push dword [esi + 0xc960]
call dword [0x5e65e0]
jmp 0x422305
push 0x104
push ecx
call dword [0x5e65d8]
push 1
push dword [esi + 0xccd0]
call dword [0x5e65d4]
push 1
push dword [esi + 0xcab0]
call dword [0x5e65d4]
push 0
push 8
push dword [esi + 0xd210]
call dword [0x5e65a4]
push 0x180
push dword [esi + 0xd360]
call dword [0x5e65e0]
push 0x1d8
push dword [esi + 0xdd60]
call dword [0x5e65e0]
push 0x67
push dword [esi + 0xc960]
call dword [0x5e65e0]
push 0x39
push dword [esi + 0xd360]
call dword [0x5e65d8]
push 0
push dword [esi + 0xd6d0]
call dword [0x5e65d4]
push 0
push dword [esi + 0xd4b0]
call dword [0x5e65d4]
push 1
push 8
push dword [esi + 0xdc10]
call dword [0x5e65a4]
push 0x39
push dword [esi + 0xdd60]
call dword [0x5e65d8]
push 0
push dword [esi + 0xe0d0]
call dword [0x5e65d4]
push 0
push dword [esi + 0xdeb0]
call dword [0x5e65d4]
push 1
push 8
push dword [esi + 0xe610]
call dword [0x5e65a4]
lea eax, [esi + 0xd354]
cmp edi, eax
jne 0x4224e5
push dword [esi + 0xd360]
call dword [0x5e65dc]
cmp eax, 0x104
jne 0x422395
push 0x39
push dword [esi + 0xd360]
call dword [0x5e65d8]
push 0
push dword [esi + 0xd6d0]
call dword [0x5e65d4]
push 0
push dword [esi + 0xd4b0]
call dword [0x5e65d4]
push 1
push 8
push dword [esi + 0xdc10]
call dword [0x5e65a4]
push 0x67
push dword [esi + 0xc960]
call dword [0x5e65e0]
push 0x11f
push dword [esi + 0xdd60]
call dword [0x5e65e0]
push 0xc0
push dword [esi + 0xd360]
call dword [0x5e65e0]
jmp 0x4224e5
mov dword [ebp - 4], 0
push 7
push dword [esi + 0xdac0]
call dword [0x5e65b4]
mov edx, eax
lea ecx, [ebp - 0x3ac]
call fcn.00468d50
mov edx, 0x5cab9c
mov dword [ebp - 0x244], 1
lea ecx, [ebp - 0x3ac]
call fcn.00446870
mov edi, eax
mov eax, 1
mov dword [ebp - 0x244], eax
and eax, 0xfffffffe
mov dword [ebp - 0x244], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ac]
call fcn.00401f80
test edi, edi
je 0x4224e2
push 0x104
push dword [esi + 0xd360]
call dword [0x5e65d8]
push 1
push dword [esi + 0xd6d0]
call dword [0x5e65d4]
push 1
push dword [esi + 0xd4b0]
call dword [0x5e65d4]
push 0
push 8
push dword [esi + 0xdc10]
call dword [0x5e65a4]
push 0x67
push dword [esi + 0xc960]
call dword [0x5e65e0]
push 0x1e0
push dword [esi + 0xdd60]
call dword [0x5e65e0]
push 0xc0
push dword [esi + 0xd360]
call dword [0x5e65e0]
push 0x39
push dword [esi + 0xc960]
call dword [0x5e65d8]
push 0
push dword [esi + 0xccd0]
call dword [0x5e65d4]
push 0
push dword [esi + 0xcab0]
call dword [0x5e65d4]
push 1
push 8
push dword [esi + 0xd210]
call dword [0x5e65a4]
push 0x39
push dword [esi + 0xdd60]
call dword [0x5e65d8]
push 0
push dword [esi + 0xe0d0]
call dword [0x5e65d4]
push 0
push dword [esi + 0xdeb0]
call dword [0x5e65d4]
push 1
push 8
push dword [esi + 0xe610]
call dword [0x5e65a4]
mov edi, dword [ebp + 8]
lea eax, [esi + 0xdd54]
cmp edi, eax
jne 0x4226b5
push dword [esi + 0xdd60]
call dword [0x5e65dc]
cmp eax, 0x104
jne 0x422575
push 0x39
push dword [esi + 0xdd60]
call dword [0x5e65d8]
push 0
push dword [esi + 0xe0d0]
call dword [0x5e65d4]
push 0
push dword [esi + 0xdeb0]
call dword [0x5e65d4]
push 1
push 8
push dword [esi + 0xe610]
call dword [0x5e65a4]
push 0xc0
push dword [esi + 0xd360]
call dword [0x5e65e0]
push 0x67
push dword [esi + 0xc960]
call dword [0x5e65e0]
push 0x11f
push dword [esi + 0xdd60]
call dword [0x5e65e0]
jmp 0x4226b5
mov dword [ebp - 4], 1
push 7
push dword [esi + 0xe4c0]
call dword [0x5e65b4]
mov edx, eax
lea ecx, [ebp - 0x3d8]
call fcn.00468d50
or dword [ebp - 0x244], 2
lea ecx, [ebp - 0x3d8]
mov edx, 0x5cab9c
call fcn.00446870
and dword [ebp - 0x244], 0xfffffffd
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d8]
call fcn.00401f80
test edi, edi
je 0x4226b2
push 0x104
push dword [esi + 0xdd60]
call dword [0x5e65d8]
push 1
push dword [esi + 0xe0d0]
call dword [0x5e65d4]
push 1
push dword [esi + 0xdeb0]
call dword [0x5e65d4]
push 0
push 8
push dword [esi + 0xe610]
call dword [0x5e65a4]
push 0xc0
push dword [esi + 0xd360]
call dword [0x5e65e0]
push 0x67
push dword [esi + 0xc960]
call dword [0x5e65e0]
push 0x11f
push dword [esi + 0xdd60]
call dword [0x5e65e0]
push 0x39
push dword [esi + 0xc960]
call dword [0x5e65d8]
push 0
push dword [esi + 0xccd0]
call dword [0x5e65d4]
push 0
push dword [esi + 0xcab0]
call dword [0x5e65d4]
push 1
push 8
push dword [esi + 0xd210]
call dword [0x5e65a4]
push 0x39
push dword [esi + 0xd360]
call dword [0x5e65d8]
push 0
push dword [esi + 0xd6d0]
call dword [0x5e65d4]
push 0
push dword [esi + 0xd4b0]
call dword [0x5e65d4]
push 1
push 8
push dword [esi + 0xdc10]
call dword [0x5e65a4]
mov edi, dword [ebp + 8]
lea eax, [esi + 0xc174]
cmp edi, eax
jne 0x4226fd
push 1
push 8
push dword [esi + 0xb250]
call dword [0x5e65bc]
mov edi, dword [esi + 0xf614]
lea eax, [ebp - 0x278]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x278]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [ebp + 8]
mov dword [esi + 0xf6a8], 0
lea eax, [esi + 0xa914]
cmp edi, eax
jne 0x422745
push 1
push 8
push dword [esi + 0x99f0]
call dword [0x5e65bc]
mov edi, dword [esi + 0xf60c]
lea eax, [ebp - 0x27c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x27c]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [ebp + 8]
mov dword [esi + 0xf6a4], 0
lea eax, [esi + 0x7cb4]
cmp edi, eax
jne 0x42278d
push 1
push 8
push dword [esi + 0x6d90]
call dword [0x5e65bc]
mov edi, dword [esi + 0xf604]
lea eax, [ebp - 0x280]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x280]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [ebp + 8]
mov dword [esi + 0xf6a0], 0
lea eax, [esi + 0x44d4]
cmp edi, eax
jne 0x4227cb
push 1
push 8
push dword [esi + 0x35b0]
call dword [0x5e65bc]
mov edi, dword [esi + 0xf5fc]
lea eax, [ebp - 0x284]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x284]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [ebp + 8]
lea eax, [esi + 0xb994]
cmp edi, eax
jne 0x422813
push 0
push 8
push dword [esi + 0x1b30]
call dword [0x5e65bc]
mov edi, dword [esi + 0xf610]
lea eax, [ebp - 0x288]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x288]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [ebp + 8]
mov dword [esi + 0xf6a8], 0
lea eax, [esi + 0xa134]
cmp edi, eax
jne 0x42285b
push 6
push 8
push dword [esi + 0x1b30]
call dword [0x5e65bc]
mov edi, dword [esi + 0xf608]
lea eax, [ebp - 0x28c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x28c]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [ebp + 8]
mov dword [esi + 0xf6a4], 0
lea eax, [esi + 0x74d4]
cmp edi, eax
jne 0x4228a3
push 3
push 8
push dword [esi + 0x1b30]
call dword [0x5e65bc]
mov edi, dword [esi + 0xf600]
lea eax, [ebp - 0x290]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x290]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [ebp + 8]
mov dword [esi + 0xf6a0], 0
lea eax, [esi + 0x3cf4]
cmp edi, eax
jne 0x4228eb
push 4
push 8
push dword [esi + 0x1b30]
call dword [0x5e65bc]
mov edi, dword [esi + 0xf5f8]
lea eax, [ebp - 0x294]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x294]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [ebp + 8]
mov dword [esi + 0xf69c], 0
lea eax, [esi + 0xef34]
cmp edi, eax
jne 0x422918
mov ecx, dword [0x5e6670]
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ecx + 0xc960]
add ecx, 0xc
push 0
push eax
call fcn.00421fd0
lea eax, [esi + 0xe8a4]
cmp edi, eax
jne 0x422971
mov edi, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x29c]
push eax
call edi
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x2a4]
push eax
call edi
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x2a4]
add eax, 5
push 0
push 0
push 0
push eax
add ecx, 0xffffffc4
push ecx
push 0
push dword [esi + 0xf484]
call dword [0x5e6608]
mov edi, dword [ebp + 8]
lea eax, [esi + 0xec94]
cmp edi, eax
jne 0x422d4d
lea ecx, [ebp - 0x2fc]
call fcn.00402290
mov dword [ebp - 4], 2
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x2f0], str.VIP.exe
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x274]
call fcn.00402290
mov byte [ebp - 4], 4
lea eax, [ebp - 0x238]
push 0x228
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x248], eax
cmp eax, 0xffffffff
je 0x422add
lea ecx, [ebp - 0x23c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x422ad1
nop word [eax + eax]
xor ecx, ecx
mov dword [ebp - 0x268], ecx
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x422a38
push eax
mov eax, dword [ebp - 0x264]
lea ecx, [ebp - 0x264]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x268]
xor edx, edx
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x250], edx
mov dword [ebp - 0x254], edx
cmp word [ebp - 0x218], dx
je 0x422a73
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x264]
call fcn.004633c0
mov edx, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x268]
test ecx, ecx
jne 0x422a86
cmp dword [ebp - 0x250], 0
mov ecx, 0x5ca534
cmovne ecx, edx
mov eax, dword [ebp - 0x2f0]
test eax, eax
jne 0x422aa3
cmp dword [ebp - 0x2d8], 0
mov eax, 0x5ca534
cmovne eax, dword [ebp - 0x2e0]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x422d81
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x422a10
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
mov byte [ebp - 0x23d], 1
lea ecx, [ebp - 0x274]
call fcn.00401f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.00401f80
cmp byte [ebp - 0x23d], 0
je 0x422d4d
lea ecx, [ebp - 0x274]
call fcn.00402290
mov dword [ebp - 4], 6
push 0
push dword [esi + 0x20]
call dword [0x5e65e8]
mov ecx, 0x3e8
call fcn.0040be50
lea ecx, [ebp - 0x2d0]
call fcn.00402290
mov byte [ebp - 4], 7
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x2c4], 0x5ca534
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x354]
call fcn.00402290
mov byte [ebp - 4], 9
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x348], 0x5cabb8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x328]
call fcn.00402290
mov byte [ebp - 4], 0xb
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x31c], 0x5cabbc
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x328]
push eax
lea ecx, [ebp - 0x380]
call fcn.0044a700
mov edi, eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x274]
mov edx, dword [ebp - 0x274]
call dword [edx + 0x44]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x270], ecx
mov ecx, dword [edi + 8]
mov dword [ebp - 0x26c], ecx
lea ecx, [ebp - 0x264]
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x264]
call dword [eax + 0x44]
lea eax, [edi + 0x10]
push eax
lea ecx, [ebp - 0x264]
call fcn.004026a0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x380]
call fcn.00401f80
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x328]
call fcn.00401f80
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x354]
call fcn.00401f80
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2d0]
call fcn.00401f80
mov edx, 0x5cba50
lea ecx, [ebp - 0x274]
call fcn.00446820
test eax, eax
jne 0x422d9d
mov edx, 0x5cabc8
lea ecx, [ebp - 0x274]
call fcn.00446820
test eax, eax
je 0x422d38
mov edx, 0x5ca534
mov ecx, 0x5e5054
call fcn.00446870
test eax, eax
je 0x422d9d
call fcn.00442d10
cmp eax, 1
je 0x422d9d
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2d0]
call fcn.00402290
mov edi, dword [ebp - 0x244]
lea edx, [ebp - 0x2d0]
or edi, 4
mov dword [ebp - 0x244], edi
call fcn.00460320
push str.VIP.exe_s
lea edx, [ebp - 0x2d0]
lea ecx, [ebp - 0x380]
call fcn.00465b10
add esp, 4
mov byte [ebp - 4], 0x12
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x422d07
cmp dword [eax + 0x24], ecx
mov ecx, 0x5ca534
je 0x422d07
mov ecx, dword [eax + 0x1c]
push 1
call fcn.00460840
add esp, 4
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x380]
call fcn.00401f80
and edi, 0xfffffffb
mov dword [ebp - 0x244], edi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2d0]
call fcn.00401f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x274]
call fcn.00401f80
mov edi, dword [ebp + 8]
lea eax, [esi + 0xe9f4]
cmp edi, eax
jne 0x422d62
push 2
push dword [esi + 0x20]
call dword [0x5e65ec]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00469bcf
mov esp, ebp
pop ebp
ret 0x20
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
mov byte [ebp - 0x23d], 0
jmp 0x422ae8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]