Function at 0x43ee50
Capabilities:
Enumerate processes
Hash data with crc32
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d081
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x49cf34]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
push edi
push 2
mov dword [ebp - 0x2c8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x2d4], 0x5e853e99
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x2d0], esi
cmp esi, edi
je 0x43f113
cmp esi, 0xffffffff
je 0x43f113
push 0x228
lea eax, [ebp - 0x2c0]
push edi
push eax
call fcn.0044fd70
add esp, 0xc
lea ecx, [ebp - 0x2c4]
push ecx
push esi
mov dword [ebp - 0x2c4], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x43f0f3
push 0xfde9
lea eax, [ebp - 0x2a0]
lea edx, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], edx
call fcn.0043d600
mov edx, dword [0x49ceb4]
mov eax, dword [edx + 0xc]
mov esi, dword [ebp - 0x98]
mov ecx, 0x49ceb4
mov byte [ebp - 4], 1
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x2cc], edi
mov byte [ebp - 4], 2
test esi, esi
je 0x43ef62
test esi, 0xffff0000
jne 0x43ef66
movzx esi, si
push 0
push esi
call fcn.00405ce0
add esp, 8
test eax, eax
je 0x43ef8c
push esi
push eax
lea ecx, [ebp - 0x2cc]
call fcn.0043dac0
jmp 0x43ef86
xor eax, eax
jmp 0x43ef79
mov eax, esi
lea edx, [eax + 1]
jmp 0x43ef70
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43ef70
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x2cc]
call fcn.0043db80
mov edi, dword [ebp - 0x2cc]
mov eax, dword [ebp - 0x98]
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 4
cmp eax, ecx
je 0x43efa9
push eax
call fcn.004506e8
add esp, 4
mov esi, dword [edi - 0xc]
test esi, esi
jns 0x43efba
push 0x80070057
call fcn.00402e40
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x43efdd
push esi
lea ecx, [ebp - 0x2cc]
call fcn.0043d870
mov edi, dword [ebp - 0x2cc]
lea edx, [esi + 1]
push edx
push edi
call fcn.00450fdf
add esp, 8
cmp eax, 0x50
ja case.0x43effa.1
movzx eax, byte [eax + 0x43f178]
jmp dword [eax*4 + 0x43f168]
push 0x8007000e
call fcn.00402e40
cmp esi, dword [edi - 8]
jg case.0x43effa.22
mov eax, edi
mov dword [edi - 0xc], esi
mov byte [esi + edi], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43f020
sub eax, edx
mov edx, eax
mov ecx, edi
or eax, 0xffffffff
mov esi, edx
dec edx
test esi, esi
je 0x43f04f
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x45e930]
inc ecx
jmp 0x43f030
not eax
mov ebx, eax
xor esi, esi
cmp esi, 1
jge 0x43f0ac
lea eax, [ebp - 0x2d4]
cmp dword [eax + esi*4], ebx
jne 0x43f0a9
mov ecx, dword [ebp - 0x2bc]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2c8], eax
test eax, eax
je 0x43f0a9
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp - 0x2c8], 0xffffffff
je 0x43f0a9
mov edx, dword [ebp - 0x2c8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2c8], 0
inc esi
jmp 0x43f055
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43f0cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2c4]
push ecx
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43eeeb
mov esi, dword [ebp - 0x2d0]
mov edi, dword [ebp - 0x2c8]
test esi, esi
je 0x43f113
cmp esi, 0xffffffff
je 0x43f113
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2d0], 0
mov esi, dword [ebp - 0x2d0]
test edi, edi
je 0x43f123
cmp edi, 0xffffffff
je 0x43f123
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x43f133
cmp esi, 0xffffffff
je 0x43f133
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044fd61
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402e40
mov eax, 0x43f15f
ret