Function at 0x4016e2
Capabilities:
Enumerate process modules
Execute command
Get process image filename
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, 0x2764
call fcn.00402830
sub esp, eax
lea edx, [ebp - 0x2048]
mov eax, 0
mov ecx, 0x400
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], 0
mov dword [esp], 0
call sym._time
mov dword [ebp - 0x14], eax
mov dword [esp], 0
call sym._time
mov dword [ebp - 0x24], eax
mov dword [esp], 0
call sym._time
mov dword [ebp - 0x204c], eax
mov eax, dword [ebp - 0x204c]
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._difftime
fld qword [0x4063c8]
fxch st(1)
fucompp
fnstsw ax
sahf
jbe 0x4017e8
mov dword [esp], str.Inactivity_detected._Performing_a_self_reset...
call sym._puts
mov dword [esp + 4], 0x406190
mov dword [esp], str.reset_log.txt
call sym._fopen
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x4017be
lea eax, [ebp - 0x204c]
mov dword [esp], eax
call sym._ctime
mov dword [esp + 8], eax
mov dword [esp + 4], str.Inactivity_detected_at__s._Performing_a_self_reset..._n
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0
lea eax, [ebp - 0x2048]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x10], 0
jmp 0x401c55
mov eax, dword [ebp - 0x204c]
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._difftime
fld qword [0x4063d0]
fxch st(1)
fucompp
fnstsw ax
sahf
jbe 0x4018a5
mov dword [esp], str.Periodic_reset_triggered.
call sym._puts
mov dword [esp + 4], 0x406190
mov dword [esp], str.reset_log.txt
call sym._fopen
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x401869
lea eax, [ebp - 0x204c]
mov dword [esp], eax
call sym._ctime
mov dword [esp + 8], eax
mov dword [esp + 4], str.Periodic_reset_triggered_at__s._n
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x204c]
mov dword [ebp - 0x24], eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0
lea eax, [ebp - 0x2048]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x204c]
mov dword [ebp - 0x14], eax
jmp 0x401c55
lea eax, [ebp - 0x1048]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1000
lea eax, [ebp - 0x1044]
mov dword [esp], eax
call sym._EnumProcesses_12
sub esp, 0xc
test eax, eax
jne 0x4018e6
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.EnumProcesses_failed___lu_._n
call sym._printf
jmp 0x401c55
mov eax, dword [ebp - 0x1048]
shr eax, 2
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], 0
jmp 0x401be6
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x1044]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x401937
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x2048]
cmp eax, dword [ebp - 0x2c]
jne 0x401933
mov dword [ebp - 0x1c], 1
jmp 0x40193f
add dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jb 0x40191b
cmp dword [ebp - 0x1c], 0
jne 0x401be2
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x411
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x401be2
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x2550]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._GetProcessImageFileNameA_12
sub esp, 0xc
test eax, eax
je 0x401bac
lea eax, [ebp - 0x2550]
mov dword [esp], eax
call sym._ConvertDevicePathToDriveLetter
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x244c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2550]
mov dword [esp], eax
call sym._GetFileDescriptionForProcessName
mov dword [esp + 4], 0x406232
mov dword [esp], str.C:Program_Files__x86__trinetra_agent_sharedprocess.txt
call sym._fopen
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x401ba1
jmp 0x401b6e
mov dword [esp + 4], 0x40626d
lea eax, [ebp - 0x2750]
mov dword [esp], eax
call sym._strcspn
mov byte [ebp + eax - 0x2750], 0
lea eax, [ebp - 0x2750]
mov dword [esp + 4], eax
lea eax, [ebp - 0x244c]
mov dword [esp], eax
call sym.__stricmp
test eax, eax
jne 0x401b6e
mov dword [esp + 4], str.SystemApps
lea eax, [ebp - 0x2550]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x401b95
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._TerminateProcess_8
sub esp, 8
mov dword [esp + 4], 0x406190
mov dword [esp], str.C:Program_Files__x86__trinetra_agent_active_response_blocked_software.log
call sym._fopen
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x401aa9
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x15
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_open_file._n
call sym._fwrite
jmp 0x401ad1
lea eax, [ebp - 0x2750]
mov dword [esp + 8], eax
mov dword [esp + 4], str._software_:__s_has_been_blocked_by_Trinetra__n
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._fclose
mov dword [esp], 0
call sym._time
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x2650]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2750]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x401b1d
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._difftime
fld qword [0x4063d8]
fxch st(1)
fucompp
fnstsw ax
sahf
ja 0x401b39
lea eax, [ebp - 0x2650]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2750]
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x401b95
mov dword [esp], str.cmd__c___C:Program_Files__x86__trinetra_agent_active_response_bincommunicate.exe__notification__This_software_has_been_blocked_by_Trinetra__
call sym._system
lea eax, [ebp - 0x2750]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2650]
mov dword [esp], eax
call sym._strcpy
mov dword [esp], 0
call sym._time
mov dword [ebp - 0x18], eax
jmp 0x401b95
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x2750]
mov dword [esp], eax
call sym._fgets
test eax, eax
jne 0x4019f0
jmp 0x401b96
nop
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x204c]
mov dword [ebp - 0x14], eax
jmp 0x401bc1
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.GetProcessImageFileName_failed___lu_._n
call sym._printf
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x2048], edx
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x28]
jb 0x4018fe
mov dword [esp], 0x1f4
call sym._Sleep_4
sub esp, 4
mov eax, dword [ebp - 0x204c]
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._difftime
fld qword [0x4063c8]
fxch st(1)
fucompp
fnstsw ax
sahf
ja 0x401c49
mov eax, dword [ebp - 0x204c]
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._difftime
fld qword [0x4063d0]
fxch st(1)
fucompp
fnstsw ax
sahf
jbe 0x401c50
call sym._MonitorProcessCreation
jmp 0x401c55
jmp 0x40172b
mov edi, dword [ebp - 4]
leave
ret