Function at 0x402b28
Capabilities:
Print debug messages

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrW]
push str.taskkill.exe
push ebx
call edi
test eax, eax
je 0x402b81
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push dword [esp + 0x18]
push dword [0x40c884]
push str.ACTIVDLL__04x:SkipInject___taskkill.exe__res1___ls___ls
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc eax
jmp 0x402d85
push str.cmd.exe
push ebx
call edi
test eax, eax
je 0x402bac
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push dword [esp + 0x18]
push dword [0x40c884]
push str.ACTIVDLL__04x:SkipInject___cmd.exe__res1___ls___ls
jmp 0x402b5f
push str.totalcmd32.exe
push ebx
call edi
test eax, eax
je 0x402bd7
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push dword [esp + 0x18]
push dword [0x40c884]
push str.ACTIVDLL__04x:SkipInject___totalcmd32.exe__res1___ls___ls
jmp 0x402b5f
push str.totalcmd64.exe
push ebx
call edi
test eax, eax
je 0x402c05
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push dword [esp + 0x18]
push dword [0x40c884]
push str.ACTIVDLL__04x:SkipInject___totalcmd64.exe__res1___ls___ls
jmp 0x402b5f
push ebp
push str.chrome.exe
push ebx
call edi
test eax, eax
jne 0x402c25
push str.msedge.exe
push ebx
call edi
test eax, eax
jne 0x402c25
xor esi, esi
xor ebp, ebp
inc esi
jmp 0x402c2a
xor esi, esi
inc esi
mov ebp, esi
push str.__type
push ebx
call edi
test eax, eax
jne 0x402c48
push str.__annotation
push ebx
call edi
test eax, eax
jne 0x402c48
and dword [esp + 0x10], eax
jmp 0x402c4c
mov dword [esp + 0x10], esi
push str.__typeutility
push ebx
call edi
test eax, eax
jne 0x402c6a
push str.__utility_sub_typenetwork
push ebx
call edi
test eax, eax
jne 0x402c6a
and dword [esp + 0x1c], eax
jmp 0x402c6e
mov dword [esp + 0x1c], esi
test ebp, ebp
je 0x402ccd
cmp dword [esp + 0x10], 0
je 0x402c84
cmp dword [esp + 0x1c], 0
jne 0x402c84
mov edi, esi
jmp 0x402c86
xor edi, edi
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push dword [esp + 0x1c]
mov esi, eax
push edi
push dword [esp + 0x28]
push dword [esp + 0x20]
push dword [0x40c884]
push str.ACTIVDLL__04x:SkipInject___chrome.exe__isSubProcess_x__isNetworkSubProcess_x__res_x___ls___ls
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
jmp 0x402d84
mov ebp, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x100000
push 0x40
call ebp
push ebx
push dword [esp + 0x1c]
mov esi, eax
push 0
push dword [esp + 0x28]
push dword [esp + 0x20]
push dword [0x40c884]
push str.ACTIVDLL__04x:SkipInject___NOT_chrome.exe__isSubProcess_x__isNetworkSubProcess_x__res_x___ls___ls
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.firefox.exe
push ebx
call edi
mov esi, eax
neg esi
push str.__contentproc
sbb esi, esi
push ebx
neg esi
call edi
mov edi, eax
neg edi
sbb edi, edi
neg edi
test esi, esi
je 0x402d42
test edi, edi
je 0x402d42
mov dword [esp + 0x1c], 1
jmp 0x402d47
and dword [esp + 0x1c], 0
push 0x100000
push 0x40
call ebp
push ebx
push dword [esp + 0x1c]
mov ebp, eax
push dword [esp + 0x24]
push edi
push esi
push dword [0x40c884]
push str.ACTIVDLL__04x:SkipInject___isFirefox_x__isContentProc_x__res_x___ls___ls
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
push ebp
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 8