Function at 0x402d50
Capabilities:
Delete file
Enumerate process modules
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x408b9e
push eax
mov eax, 0x15d8
mov dword fs:[0], esp
call fcn.004086d0
push esi
xor esi, esi
lea ecx, [esp + 0x15f0]
mov dword [esp + 0x15e4], esi
call sub.MFC42u.DLL_CString::MakeLower
lea eax, [esp + 0x24]
lea ecx, [esp + 0xe0c]
push eax
push 0x1f4
push ecx
mov dword [esp + 0x28], esi
call sub.PSAPI.DLL_EnumProcesses
mov eax, dword [esp + 0x24]
mov dword [esp + 8], esi
cmp eax, esi
mov dword [esp + 0x10], esi
jbe 0x402fde
push ebx
lea edx, [esp + 0xe10]
push ebp
push edi
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push ecx
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, esi
je 0x402fbb
lea edx, [esp + 0x20]
lea eax, [esp + 0x648]
push edx
push 0x7d0
push eax
push ebx
call sub.PSAPI.DLL_EnumProcessModules
cmp eax, esi
je 0x402fbb
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], esi
cmp eax, esi
jbe 0x402fb0
lea ebp, [esp + 0x648]
mov dword [esp + 0x2c], ebp
mov edx, dword [ebp]
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x3a]
mov word [esp + 0x38], si
push 0x200
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
push ecx
push edx
push ebx
stosw word es:[edi], ax
call sub.PSAPI.DLL_GetModuleBaseNameW
lea eax, [esp + 0x38]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x15f0], 1
call sub.MFC42u.DLL_CString::MakeLower
mov edx, dword [ebp]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x23a]
mov word [esp + 0x238], si
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x23c]
push ecx
push edx
push ebx
stosw word es:[edi], ax
call sub.PSAPI.DLL_GetModuleFileNameExW
mov eax, dword [esp + 0x15f8]
cmp dword [eax + 8], esi
jle 0x402f66
lea ecx, [esp + 0x34]
push esi
push ecx
mov ecx, dword [esp + 0x1600]
call fcn.00401f10
push eax
lea ecx, [esp + 0x1600]
mov byte [esp + 0x15f4], 2
call fcn.0040834e
lea ecx, [esp + 0x34]
mov byte [esp + 0x15f0], 1
call fcn.004082ee
mov eax, dword [esp + 0x15fc]
mov ebp, dword [esp + 0x10]
push eax
mov edi, eax
call dword [sym.imp.MSVCRT.dll_wcslen]
push eax
push edi
push ebp
call dword [sym.imp.MSVCRT.dll_wcsncmp]
add esp, 0x10
test eax, eax
je 0x402f0d
mov edx, dword [esp + 0x15f8]
inc esi
cmp esi, dword [edx + 8]
jl 0x402ea2
jmp 0x402f64
mov ecx, dword [esp + esi*4 + 0x648]
lea eax, [esp + 0x440]
push 0x208
push eax
push ecx
push ebx
call sub.PSAPI.DLL_GetModuleFileNameExW
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x402f60
mov ecx, dword [esp + 0x28]
mov al, byte [esp + 0x1600]
inc ecx
test al, al
mov dword [esp + 0x28], ecx
je 0x402f60
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x440]
xor ebx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc dword [esp + 0x14]
xor esi, esi
mov ecx, dword [esp + 0x15f8]
mov eax, dword [esp + 0x14]
mov byte [esp + 0x15f0], 0
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
cmp eax, edx
jge 0x402fab
call fcn.004082ee
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
inc eax
add ebp, 4
cmp eax, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ebp
jb 0x402e1a
jmp 0x402fb0
call fcn.004082ee
cmp ebx, esi
je 0x402fbb
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edx
jb 0x402dc2
pop edi
pop ebp
pop ebx
lea ecx, [esp + 0x15f0]
mov dword [esp + 0x15e4], 0xffffffff
call fcn.004082ee
mov ecx, dword [esp + 0x15dc]
pop esi
mov dword fs:[0], ecx
add esp, 0x15e4
ret