Function at 0x41e26b
Capabilities:
Terminate process

Disassembly:
push 0x48
mov eax, 0x5b4cff
call fcn.00580e6b
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
call fcn.0044884e
mov byte [ebp - 4], 1
lea eax, [ebp - 0x54]
push eax
call fcn.004220fa
mov esi, dword [ebp - 0x48]
pop ecx
cmp esi, dword [ebp - 0x44]
jbe 0x41e2a3
call fcn.0057451a
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], esi
mov ebx, str.Helper::KillInProcs2
mov esi, dword [ebp - 0x44]
cmp dword [ebp - 0x48], esi
jbe 0x41e2be
call fcn.0057451a
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41e2ca
cmp eax, dword [ebp - 0x54]
je 0x41e2cf
call fcn.0057451a
cmp dword [ebp - 0x30], esi
je 0x41e473
push dword [ebp + 8]
lea esi, [ebp - 0x34]
call fcn.0043c532
add eax, 0x10
push eax
call fcn.00408642
test eax, eax
jne 0x41e335
push str.vbui.exe
lea eax, [ebp - 0x18]
push eax
call fcn.00408561
mov byte [ebp - 4], 2
xor edi, edi
inc edi
or dword [ebp - 0x14], edi
call fcn.0043c532
mov edx, eax
add edx, 0x10
lea eax, [ebp - 0x18]
call fcn.00471ba0
test al, al
jne 0x41e338
call fcn.0043c532
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x41e338
mov byte [ebp - 0xd], 1
jmp 0x41e33c
xor edi, edi
inc edi
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], edi
test byte [ebp - 0x14], 1
je 0x41e351
and dword [ebp - 0x14], 0xfffffffe
lea ecx, [ebp - 0x18]
call fcn.004085a2
cmp byte [ebp - 0xd], 0
je 0x41e463
cmp dword [0x6af38c], edi
jl 0x41e39a
lea esi, [ebp - 0x34]
call fcn.0043c532
add eax, 0x10
push dword [eax]
lea eax, [ebp - 0x20]
push eax
call fcn.00470550
mov byte [ebp - 4], 3
push dword [eax]
push str.S_PRE_PROC:__s
push ebx
push edi
call fcn.00532962
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00408461
lea esi, [ebp - 0x34]
call fcn.0043c532
push dword [eax]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x41e463
cmp dword [0x6af38c], edi
jl 0x41e3f4
call fcn.0043c532
add eax, 0x10
push dword [eax]
lea eax, [ebp - 0x24]
push eax
call fcn.00470550
mov byte [ebp - 4], 4
push dword [eax]
push str.S_OPEN_PROC:__s
push ebx
push edi
call fcn.00532962
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00408461
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x6af38c], edi
mov dword [ebp - 0x28], eax
jl 0x41e44f
lea esi, [ebp - 0x34]
call fcn.0043c532
add eax, 0x10
push dword [eax]
lea eax, [ebp - 0x2c]
push eax
call fcn.00470550
pop ecx
pop ecx
mov esi, eax
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x28]
push dword [esi]
push str.S_POST_PROC:__s___i___i
push ebx
push edi
call fcn.00532962
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00408461
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edi, [ebp - 0x3c]
lea esi, [ebp - 0x34]
call fcn.00426d1e
jmp 0x41e2b1
mov byte [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
call fcn.00426c53
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004085a2
call fcn.00580f43
ret