Function at 0x423960
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1123
mov eax, dword fs:[0]
push eax
mov eax, 0x2870
call fcn.00476910
mov eax, dword [0x503074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4c965c
push str.ChpqWmiExModule::KillHpqWmiex
push 0
call fcn.00422b80
push eax
call fcn.0047bd80
xor esi, esi
add esp, 0x10
mov dword [ebp - 0x2870], esi
mov dword [ebp - 0x2878], esi
mov dword [ebp - 4], esi
call fcn.00422b80
mov al, byte [eax + 0x38]
test al, al
je 0x423a03
push 0x28
call fcn.00475970
mov esi, eax
add esp, 4
mov dword [ebp - 0x2874], esi
push str.ChpqWmiExModule::KillHpqWmiex
mov byte [ebp - 4], 1
call fcn.00422b80
push eax
mov ecx, esi
call fcn.00477bf0
mov esi, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x2870], esi
mov dword [ebp - 0x2878], esi
lea eax, [ebp - 0x286c]
mov dword [ebp - 0x286c], 0
push eax
push 0x2000
lea eax, [ebp - 0x2834]
mov ebx, 0x80004005
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x423a71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.EnumProcesses_failed.__GetLastError_returns:__d
push str.ChpqWmiExModule::KillHpqWmiex
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
test edi, edi
je 0x423cf2
jg 0x423a63
mov ebx, edi
jmp 0x423cf2
movzx ebx, di
or ebx, 0x80070000
jmp 0x423cf2
mov eax, dword [ebp - 0x286c]
mov ebx, 1
shr eax, 2
mov dword [ebp - 0x2874], eax
mov dword [ebp - 0x2868], ebx
test eax, eax
je 0x423cf2
xor esi, esi
nop word [eax + eax]
mov edi, dword [ebp + esi*4 - 0x2834]
push edi
push str.dwEnumeratedPID:__d
push str.ChpqWmiExModule::KillHpqWmiex
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
test edi, edi
je 0x423cdf
push edi
cmp dword [ebp + 8], edi
je 0x423cc5
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x287c], ebx
test ebx, ebx
je 0x423c9b
cmp ebx, 0xffffffff
je 0x423c9b
push 0x618
lea eax, [ebp - 0x834]
push 0
push eax
call fcn.0048b3f0
add esp, 0xc
lea eax, [ebp - 0x834]
push 0x30c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
push dword [ebp - 0x287c]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
test ebx, ebx
jne 0x423b71
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Could_not_retrieve_process_file_name_for_process_ID___d._Error:__d
push str.ChpqWmiExModule::KillHpqWmiex
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x18
mov ebx, dword [ebp - 0x2868]
test ebx, ebx
js 0x423cec
jmp 0x423cdf
lea eax, [ebp - 0x834]
push 0x30c
push eax
call fcn.0048ed73
lea eax, [ebp - 0x834]
push 0x50c040
push eax
call fcn.0048affe
add esp, 0x10
test eax, eax
je 0x423b5e
lea eax, [ebp - 0x834]
push eax
push str.Found_hpqwmiex_at:__s
push str.ChpqWmiExModule::KillHpqWmiex
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
lea eax, [ebp - 0x21c]
push 0x208
push 0
push eax
call fcn.0048b3f0
add esp, 0xc
lea eax, [ebp - 0x21c]
push edi
push str._F__PID__d
push 0x104
push eax
call fcn.00430140
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
push str.TaskKill_Params:__s
push str.ChpqWmiExModule::KillHpqWmiex
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x2864]
push eax
call fcn.0041c410
push str.TASKKILL
lea ecx, [ebp - 0x284c]
mov byte [ebp - 4], 4
call fcn.0041c410
sub esp, 0xc
mov byte [ebp - 4], 5
lea edx, [ebp - 0x2864]
lea ecx, [ebp - 0x284c]
call fcn.0044c7d0
add esp, 0xc
lea ecx, [ebp - 0x284c]
mov edi, eax
call fcn.004029a0
lea ecx, [ebp - 0x2864]
mov byte [ebp - 4], 0
call fcn.004029a0
xor ebx, ebx
mov eax, 0x80004005
test edi, edi
cmove ebx, eax
push ebx
push str.TaskKill_result:_0x_08lX
push str.ChpqWmiExModule::KillHpqWmiex
push 2
mov dword [ebp - 0x2868], ebx
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
jmp 0x423b64
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.No_process_handle_retrieved_for_process_ID___d._Error:__d
push str.ChpqWmiExModule::KillHpqWmiex
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
mov ebx, dword [ebp - 0x2868]
add esp, 0x18
jmp 0x423cdf
push str.Skipping_my_own_process_ID___d.
push str.ChpqWmiExModule::KillHpqWmiex
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
inc esi
cmp esi, dword [ebp - 0x2874]
jb 0x423aa0
mov esi, dword [ebp - 0x2870]
push ebx
push str.hr:_0x_08lX
push str.ChpqWmiExModule::KillHpqWmiex
push 1
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
test esi, esi
je 0x423d23
mov ecx, esi
call fcn.00478c00
push 0x28
push esi
call fcn.00475d73
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004756da
mov esp, ebp
pop ebp
ret 4