Function at 0x410330
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49793b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xec
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x18], esi
call fcn.004213c0
push 4
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], edi
call fcn.00421f60
mov dword [ebp - 0x64], vtable.btkXArray_class_btkNMSRecord__.0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00422100
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x94]
lea ebx, [esi + 0xe8]
push ecx
mov ecx, ebx
call fcn.0040f6b0
mov dword [ebp - 0x14], eax
cmp eax, edi
jbe 0x410437
mov edx, dword [ebp - 0x5c]
mov esi, dword [edx + edi*4]
mov ecx, esi
call fcn.00420d90
test al, al
je 0x410428
mov ecx, esi
call fcn.00420db0
test al, al
jne 0x410428
push str.btkProcessJob
mov ecx, esi
call fcn.00420f40
test al, al
je 0x410403
push str.btkProcessJob
mov ecx, esi
call fcn.00420fd0
push eax
call fcn.0040c635
add esp, 4
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x410403
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebx + 0x10]
xor eax, eax
test ecx, ecx
jbe 0x410428
mov edx, dword [ebx + 8]
nop
cmp dword [edx + eax*4], esi
je 0x41041c
inc eax
cmp eax, ecx
jb 0x410410
jmp 0x410428
mov edx, dword [ebx]
push 1
push eax
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
inc edi
cmp edi, dword [ebp - 0x14]
jb 0x4103a7
mov esi, dword [ebp - 0x18]
xor edi, edi
lea ecx, [ebp - 0x24]
add esi, 0x198
mov dword [ebp - 0x38], 0x4a085c
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x40], vtable.btkXArrayBase_struct_nmsdProcess___class_btkXArrayImpl__class_btkIterImpl_::Iter.1.0
mov dword [ebp - 0x24], vtable.btkXArrayBase_struct_nmsdProcess___class_btkXArrayImpl__class_btkIterImpl_::Iter.0
mov dword [ebp - 0x28], edi
fldz
fstp qword [ebp - 0x20]
mov byte [ebp - 4], 2
mov byte [ebp - 0xd], 0
call dword [vtable.btkXArrayBase_struct_nmsdProcess___class_btkXArrayImpl__class_btkIterImpl_::Iter.0]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
test al, al
jne 0x41060c
lea ebx, [ebx]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov esi, dword [eax]
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
call fcn.0041a480
mov ecx, esi
call fcn.004209a0
test al, al
je 0x410536
fld qword [esi + 0x78]
mov ecx, dword [ebx + 0x10]
fadd qword [ebp - 0x20]
mov edx, dword [esi + 0x80]
xor eax, eax
mov byte [ebp - 0xd], 1
fstp qword [ebp - 0x20]
test ecx, ecx
jbe 0x4104f8
mov edi, dword [ebx + 8]
cmp dword [edi + eax*4], edx
je 0x4104ec
inc eax
cmp eax, ecx
jb 0x4104e0
jmp 0x4104f8
mov edx, dword [ebx]
push 1
push eax
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
mov edi, dword [esi + 0x80]
test edi, edi
je 0x410512
mov ecx, edi
call fcn.00421b50
push edi
call fcn.00466620
add esp, 4
mov ecx, esi
call fcn.00420560
lea ecx, [esi + 0x1c]
call fcn.004200e0
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push 1
mov ecx, esi
call eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x410490
cmp byte [ebp - 0xd], 0
je 0x41060c
fldz
mov esi, dword [ebp - 0x18]
fld qword [ebp - 0x20]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x4105ae
fsubr qword [esi + 0x190]
sub esp, 8
lea ecx, [ebp - 0xf8]
fst qword [esi + 0x190]
fstp qword [esp]
push 0x49efd8
push ecx
call fcn.00475440
mov ecx, dword [esi + 0xe4]
add esp, 0x10
lea edx, [ebp - 0xf8]
push edx
push str.CPULoad
call fcn.00421060
jmp 0x4105b0
fstp st(0)
mov eax, dword [esi + 0x1a8]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040f630
add esp, 8
mov eax, dword [eax]
mov ecx, dword [esi + 0xe4]
push eax
push str.ServicesRunning
mov byte [ebp - 4], 3
call fcn.00421060
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 4
test eax, eax
je 0x4105fc
cmp byte [eax], 0
jne 0x4105f1
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x4105fc
lea ecx, [ebp - 0x14]
call fcn.0041a380
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test eax, eax
je 0x41060c
lea ecx, [ebp - 0x14]
call fcn.0041a380
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x40], vtable.btkIterBase_struct_nmsdProcess__.0
mov byte [ebp - 4], 0
call fcn.004220e0
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.00421b50
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret