Function at 0x406da0
Capabilities:
Create process on windows
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
mov eax, dword [0x40c350]
sub esp, 0x768
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, dword [esp + 0x778]
cmp eax, 0xffffffff
push edi
jne 0x406dd1
push ebx
push 0x3e8
push 0x16
push esi
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x40c350], eax
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push 2
push esi
call ebp
push 5
push esi
call ebp
mov eax, dword [0x40eaa4]
cmp eax, 0xdeadbeef
je 0x406ef1
cmp byte [0x40e8a4], bl
jne 0x406e09
cmp byte [0x40e9a4], bl
jne 0x406e09
cmp eax, ebx
je 0x406ef1
push 4
push str.Sizzle
push str.Do_you_want_to_disconnect_the_phone_connection_and_exit_the_dialer_application_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x406eec
cmp dword [0x40eaa4], ebx
jne 0x406ee1
mov eax, 0xc
mov edi, 1
push 7
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x64], ebx
mov word [esp + 0x6a], bx
mov dword [esp + 0x6c], ebx
call ebp
lea eax, [esp + 0x30]
push 0x40f5c0
push eax
push ebx
push ebx
push ebx
lea ecx, [esp + 0x38]
push edi
lea edx, [esp + 0x30]
push ecx
push edx
push 0x40e8a4
push 0x40e9a4
mov dword [0x40f5c0], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x406ef1
mov eax, dword [0x40c350]
cmp eax, 0xffffffff
jne 0x406ece
push ebx
push 0x3e8
push 0x16
push esi
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x406ed6
cmp eax, 0x64
jle 0x406edb
sub eax, 0x64
mov dword [0x40c350], eax
mov dword [0x40eaa4], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x768
ret
cmp eax, 6
jne 0x406ee1
cmp dword [0x40c350], 0xffffffff
je 0x406f03
push 0x16
push esi
call dword [sym.imp.USER32.dll_KillTimer]
push ebx
push 2
mov dword [esp + 0x7c], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x406f76
lea eax, [esp + 0x74]
push eax
push edi
call sub.KERNEL32.dll_Process32First
lea ecx, [esp + 0x98]
push 0x40eabc
push ecx
call fcn.00402b50
add esp, 8
test eax, eax
je 0x406f4a
lea edx, [esp + 0x74]
lea eax, [esp + 0x74]
test edx, edx
jne 0x406f5b
lea eax, [esp + 0x74]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x406f25
jmp 0x406f76
mov ecx, dword [eax + 8]
push ecx
push 1
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, 0xffffffff
je 0x406f76
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
push esi
call ebp
mov eax, dword [0x40c358]
cmp eax, 0xffffffff
je 0x406f8a
push eax
call sub.WSOCK32.dll_closesocket
mov eax, dword [0x40c354]
cmp eax, 0xffffffff
je 0x406f9a
push eax
call sub.WSOCK32.dll_closesocket
mov eax, dword [0x40c35c]
cmp eax, 0xffffffff
je 0x406faa
push eax
call sub.WSOCK32.dll_closesocket
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebp
push 0x40dfd8
call fcn.00401000
push esi
call fcn.00403ae0
add esp, 8
push 0x3e8
call ebp
mov eax, dword [0x40eab8]
xor esi, esi
cmp eax, ebx
je 0x407039
xor edi, edi
cmp eax, ebx
jle 0x407099
mov edx, dword [0x40dec8]
mov eax, dword [edx + edi*4]
push eax
mov eax, dword [0x40e8a0]
lea ecx, [eax + eax*4]
mov edx, dword [ecx*4 + 0x40dfe0]
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x40702d
push esi
lea eax, [esp + 0x34]
push str.sizzle_d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
push ebx
call sub.RASAPI32.dll_RasDeleteEntryA
inc esi
mov eax, dword [0x40eab8]
inc edi
cmp edi, eax
jl 0x406fe6
jmp 0x407099
mov eax, dword [0x40dfdc]
xor edi, edi
cmp eax, ebx
jle 0x407099
mov eax, dword [0x40dec8]
mov ecx, dword [0x40e8a0]
mov edx, dword [eax + edi*4]
push edx
mov edx, dword [eax + ecx*4]
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x40708f
push str.sizzle
push ebx
call sub.RASAPI32.dll_RasDeleteEntryA
push esi
lea eax, [esp + 0x34]
push str.sizzle_d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
push ebx
call sub.RASAPI32.dll_RasDeleteEntryA
inc esi
mov eax, dword [0x40dfdc]
inc edi
cmp edi, eax
jl 0x407044
mov edx, 0x40ecd4
test edx, edx
je 0x407118
cmp byte [0x40ecd4], bl
je 0x407118
mov edi, 0x4d4
mov dword [0x40e844], 0xe10
push edi
call sub.MFC42.DLL_operatornew
mov esi, eax
mov eax, dword [0x40e844]
add esp, 4
cmp eax, ebx
jle 0x407118
mov edx, dword [0x40e844]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
dec edx
push eax
push ecx
mov dword [0x40e844], edx
push esi
mov dword [esi], 0x19c
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], ebx
call sub.RASAPI32.dll_RasEnumConnectionsA
test eax, eax
jne 0x407109
mov edx, dword [esp + 0x10]
mov eax, dword [0x40ebc4]
cmp edx, eax
jae 0x40711f
push 0x3e8
call ebp
cmp dword [0x40e844], ebx
jg 0x4070cd
push ebx
call dword [sym.imp.MSVCRT.dll_exit]
push 0x4e20
call ebp
push ebx
mov ecx, 0x40e848
call fcn.004021a0
mov eax, dword [0x40e89c]
mov ecx, dword [0x40dec0]
push 0x40ecd4
push 0x40eb00
push eax
push 0x40e84c
push ecx
lea edx, [esp + 0x1b0]
push str._s:_s:_10d:_s:probs:_s_n
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x1b8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x1c
repne scasb al, byte es:[edi]
not ecx
push ebx
lea eax, [esp + 0x1a0]
push ecx
push eax
mov ecx, 0x40e848
mov byte [0x40ecd4], bl
call fcn.00402250
push 0xea60
call ebp
lea edi, [esp + 0x19c]
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x1a4]
push ecx
mov ecx, 0x40e848
call fcn.00402250
push ebx
call ebp
push 0x1f4
call ebp
push ebx
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xcc]
mov ecx, esi
call sub.MFC42.DLL_CWnd::Default
pop esi
ret