Function at 0x414b12
Capabilities:
Enumerate processes
Get disk information
Terminate process

Disassembly:
push 0x650
mov eax, 0x4512c1
call fcn.0043364b
mov edi, ecx
mov dword [ebp - 0x654], edi
xor ecx, ecx
xor eax, eax
push 0x206
mov word [ebp - 0x420], ax
push ecx
lea eax, [ebp - 0x41e]
push eax
mov dword [ebp - 0x658], ecx
mov ebx, ecx
call fcn.00435650
xor eax, eax
push 0x228
push eax
mov dword [ebp - 0x64c], eax
lea eax, [ebp - 0x648]
push eax
call fcn.00435650
add esp, 0x18
xor esi, esi
push 0x46d258
lea ecx, [ebp - 0x650]
mov dword [ebp - 0x65c], esi
call fcn.00404e8e
mov dword [ebp - 4], esi
cmp dword [0x4714a4], esi
jne 0x414bcf
cmp dword [0x4714a0], esi
jne 0x414bcf
push str.Psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x414bc9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetModuleFileNameExW
push edi
call esi
push 0x460a8c
push edi
mov dword [0x4714a4], eax
call esi
mov dword [0x4714a0], eax
xor esi, esi
mov edi, dword [ebp - 0x654]
call fcn.004147b6
test eax, eax
je 0x414cc0
push 0x46d258
lea ecx, [ebp - 0x654]
call fcn.00404e8e
xor eax, eax
mov byte [ebp - 4], 1
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.00435650
movzx eax, word [edi]
push eax
lea eax, [ebp - 0x654]
push 0x460afc
push eax
call fcn.00410566
mov esi, dword [ebp - 0x654]
add esp, 0x18
lea eax, [ebp - 0x218]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x658]
jne 0x414c45
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x650]
call fcn.0041047c
push 1
push 0x45f318
lea ecx, [ebp - 0x650]
call fcn.0040553d
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x658]
jne 0x414c82
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x414cb1
add edi, 6
mov ecx, edi
call fcn.0040192d
push eax
push edi
lea ecx, [ebp - 0x650]
call fcn.0040553d
xor eax, eax
lea ecx, [esi - 0x10]
mov byte [ebp - 4], al
call fcn.0040390b
jmp 0x414cd4
mov ecx, edi
call fcn.0040192d
push eax
push edi
lea ecx, [ebp - 0x650]
call fcn.0041047c
xor eax, eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, dword [ebp - 0x650]
mov edi, eax
cmp edi, 0xffffffff
je 0x414df9
lea eax, [ebp - 0x64c]
push eax
push edi
mov dword [ebp - 0x64c], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x414df2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x658], eax
mov ecx, dword [ebp - 0x644]
cmp ecx, eax
je 0x414dcb
test ecx, ecx
je 0x414dcb
cmp ecx, 4
je 0x414dcb
push ecx
xor eax, eax
push eax
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x414dcb
call fcn.004147b6
test eax, eax
je 0x414d73
mov eax, dword [0x4714a0]
test eax, eax
je 0x414d73
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push ebx
call eax
jmp 0x414d8e
mov eax, dword [0x4714a4]
test eax, eax
je 0x414dc0
push 0x104
lea ecx, [ebp - 0x420]
push ecx
xor ecx, ecx
push ecx
push ebx
call eax
test eax, eax
je 0x414dc0
cmp eax, dword [esi - 0xc]
jbe 0x414dc0
push dword [esi - 0xc]
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.0042ef73
add esp, 0xc
test eax, eax
jne 0x414dc0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x414dc0
inc dword [ebp - 0x65c]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ebx, eax
lea eax, [ebp - 0x64c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
mov eax, dword [ebp - 0x658]
jne 0x414d1c
test ebx, ebx
je 0x414df2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.0040390b
mov eax, dword [ebp - 0x65c]
call fcn.004335fa
ret