Function at 0x42d390
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47c0d1
mov eax, dword fs:[0]
push eax
sub esp, 0x498
mov eax, dword [0x4a8800]
xor eax, esp
mov dword [esp + 0x490], eax
push ebx
push esi
push edi
mov eax, dword [0x4a8800]
xor eax, esp
push eax
lea eax, [esp + 0x4a8]
mov dword fs:[0], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
push ecx
push eax
mov dword [esp + 0x24], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x294]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [esp + 0x260], 7
mov dword [esp + 0x25c], 0
mov word [esp + 0x24c], ax
cmp word [esp + 0x294], ax
jne 0x42d439
xor ecx, ecx
jmp 0x42d452
lea ecx, [esp + 0x294]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42d443
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x298]
push eax
lea ecx, [esp + 0x254]
call fcn.00422d00
push 1
push 0xffffffffffffffff
push 0x4950f8
lea ecx, [esp + 0x258]
mov dword [esp + 0x4bc], 0
call fcn.0042a830
cmp eax, 0xffffffff
je 0x42d52e
push 1
push 0xffffffffffffffff
push 0x4950f8
lea ecx, [esp + 0x258]
call fcn.0042a830
push dword [esp + 0x25c]
inc eax
lea ecx, [esp + 0x250]
push eax
lea eax, [esp + 0x26c]
push eax
call fcn.00428c00
mov esi, eax
lea eax, [esp + 0x24c]
cmp eax, esi
je 0x42d515
cmp dword [esp + 0x260], 8
jb 0x42d4e8
push dword [esp + 0x24c]
call fcn.0045a050
add esp, 4
xor eax, eax
mov dword [esp + 0x260], 7
push esi
lea ecx, [esp + 0x250]
mov dword [esp + 0x260], 0
mov word [esp + 0x250], ax
call fcn.00422a40
cmp dword [esp + 0x278], 8
jb 0x42d52e
push dword [esp + 0x264]
call fcn.0045a050
add esp, 4
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x264], ebx
mov dword [esp + 0x268], edi
mov dword [esp + 0x26c], ebx
xor eax, eax
mov dword [esp + 0x290], 7
mov dword [esp + 0x28c], edi
mov word [esp + 0x27c], ax
mov byte [esp + 0x4b0], 2
cmp dword [esp + 0x10], eax
je 0x42d6f7
cmp word [esp + 0x40], 0
jne 0x42d581
xor ecx, ecx
jmp 0x42d59f
lea ecx, [esp + 0x40]
lea edx, [ecx + 2]
jmp 0x42d590
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42d590
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x284]
call fcn.00422d00
push 5
push 0
push str.Sunny
lea ecx, [esp + 0x288]
call fcn.0042a750
cmp eax, 0xffffffff
je 0x42d69c
cmp dword [esp + 0x260], 8
lea eax, [esp + 0x24c]
push dword [esp + 0x25c]
cmovae eax, dword [esp + 0x250]
lea ecx, [esp + 0x280]
push eax
push dword [esp + 0x294]
push 0
call fcn.00422af0
test eax, eax
je 0x42d69c
push dword [esp + 0x24]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x42d69c
lea eax, [esp + 0x14]
cmp eax, edi
jae 0x42d668
cmp ebx, eax
ja 0x42d668
mov esi, eax
sub esi, ebx
sar esi, 2
cmp edi, dword [esp + 0x26c]
jne 0x42d65d
push ecx
lea ecx, [esp + 0x268]
call fcn.0042fcf0
mov edi, dword [esp + 0x268]
mov ebx, dword [esp + 0x264]
test edi, edi
je 0x42d692
mov eax, dword [ebx + esi*4]
mov dword [edi], eax
jmp 0x42d692
cmp edi, dword [esp + 0x26c]
jne 0x42d68c
push ecx
lea ecx, [esp + 0x268]
call fcn.0042fcf0
mov edi, dword [esp + 0x268]
mov ebx, dword [esp + 0x264]
test edi, edi
je 0x42d692
mov dword [edi], esi
add edi, 4
mov dword [esp + 0x268], edi
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x42d575
cmp ebx, edi
je 0x42d6f7
mov eax, edi
xor ecx, ecx
sub eax, ebx
mov esi, ebx
add eax, 3
shr eax, 2
cmp ebx, edi
cmova eax, ecx
mov dword [esp + 0x10], eax
test eax, eax
je 0x42d6f7
xor ebx, ebx
mov edi, eax
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
lea esi, [esi + 4]
cmp ebx, edi
jne 0x42d6d6
mov ebx, dword [esp + 0x264]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x290], 8
jb 0x42d71a
push dword [esp + 0x27c]
call fcn.0045a050
add esp, 4
xor eax, eax
mov dword [esp + 0x290], 7
mov dword [esp + 0x28c], 0
mov word [esp + 0x27c], ax
test ebx, ebx
je 0x42d747
push ebx
call fcn.0045a050
add esp, 4
cmp dword [esp + 0x260], 8
jb 0x42d760
push dword [esp + 0x24c]
call fcn.0045a050
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x4a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x490]
xor ecx, esp
call fcn.0045b1f5
mov esp, ebp
pop ebp
ret