Function at 0x405f3d
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
sub esp, 0x128
lea ebp, [esp - 4]
mov eax, dword [0x495180]
xor eax, ebp
mov dword [ebp + 0x128], eax
push 0x48
mov eax, 0x468fd0
call fcn.0044d0b6
push ecx
xor ebx, ebx
mov edi, esp
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], esp
push 2
sub esp, 0x1c
mov esi, ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Kyc6OysjEyYBGQwhGiNyJAUnOjsrJyV3
call fcn.004023a5
push edi
call fcn.004042ec
add esp, 0x24
call fcn.00404f79
pop ecx
cmp al, bl
je 0x405f9c
xor eax, eax
jmp 0x406444
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.Kyc6OysjByEFHn44ACMTIAAJezsrJzo7
call fcn.004023a5
push edi
call fcn.004042ec
add esp, 0x20
mov dword [ebp - 0x28], esp
mov edi, esp
push 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.Cx4HOiwLHzAFGRsMAw4hfgsOBywACzkDAxkDDgMtOQwGCQtzCT0pBQASeggHMyZyCB4HfwALHy0FHi0NDyN_fw
mov dword [ebp - 4], ebx
call fcn.004023a5
push edi
call fcn.004042ec
or dword [ebp - 4], 0xffffffff
add esp, 0x24
call fcn.00405124
pop ecx
pop ecx
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [ebp - 0x14], eax
call fcn.0042af16
mov eax, dword [eax + 4]
push dword [eax + 0x60]
lea ecx, [ebp - 0x18]
call fcn.00404603
push 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.ATMpfAUzOSQFIDkbCRIDMAgkLXwFMzkkBSA5OAYSLnk
mov dword [ebp - 4], 1
call fcn.004023a5
lea eax, [ebp - 0x20]
push eax
call fcn.004042ec
add esp, 0x24
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.00403e79
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401264
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x124
lea eax, [ebp + 4]
push ebx
push eax
mov dword [ebp - 0x2c], ebx
call fcn.0044ca00
add esp, 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
mov dword [ebp], 0x128
call sub.KERNEL32.dll_Process32First
mov edi, 0x496634
call fcn.0042b084
push eax
lea ecx, [ebp - 0x1c]
call fcn.004075fa
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.004040bc
push edi
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.00404065
add esp, 0xc
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 4
call fcn.00403e79
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00401264
mov eax, dword [ebp - 0x18]
push dword [eax - 0xc]
lea ecx, [ebp - 0x1c]
push eax
call fcn.00403e79
push dword [ebp - 0x18]
lea eax, [ebp + 0x24]
push eax
call fcn.0045aba4
pop ecx
pop ecx
test eax, eax
jne 0x406106
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jne 0x40612b
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401264
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x406090
jmp 0x40615a
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401264
mov ecx, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401264
push 0xc
call fcn.00428f96
pop ecx
cmp eax, ebx
je 0x406182
push 0x60
pop ecx
mov byte [eax], bl
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
jmp 0x406184
xor eax, eax
cmp dword [0x4a5318], 3
mov dword [0x496610], eax
jne 0x4061c9
mov eax, dword [0x4a531c]
push dword [eax + 4]
mov ecx, 0x496644
call fcn.00404048
mov eax, dword [0x4a531c]
push dword [eax + 8]
call fcn.0044e964
mov dword [0x496614], eax
mov eax, dword [0x4a531c]
pop ecx
push dword [eax + 4]
mov ecx, 0x496648
call fcn.00404048
lea eax, [ebp - 0x14]
push eax
call fcn.0040448f
pop ecx
mov ecx, eax
mov dword [ebp - 4], 5
call fcn.00403d50
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040397f
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00401264
push ebx
push 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Cx4HOiwLHzAFGRsMAw4hfgsOBykHCzk9CDMtAhoYciEIGQt_BQsLPQASeggHMyZyCB57eS49d3c
call fcn.004023a5
lea eax, [ebp - 0x1c]
push eax
call fcn.004042ec
add esp, 0x24
push dword [eax]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 8
call fcn.00403861
cmp eax, 0xffffffff
jle 0x40625a
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Kyc6OysncgYFICUFATBOCh4OjsrJyV3
call fcn.004023a5
lea eax, [ebp - 0x20]
push eax
call fcn.004042ec
add esp, 0x24
mov byte [ebp - 4], 9
mov dword [ebp - 0x24], 1
jmp 0x406288
push 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Cx4HOiwLHzAFGRsMAw4hfgsOCyYpLSEvCTMTOQl5fi0IGHoaCQglEwgzKQYNCQxlCw56PgMLAH8IMx88DiMccwseBzosCx8wBRkbDAMOJnk
call fcn.004023a5
lea eax, [ebp - 0x28]
push eax
call fcn.004042ec
add esp, 0x24
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x24], 2
push eax
lea ecx, [ebp - 0x18]
call fcn.0040397f
mov dword [ebp - 4], 0xb
test byte [ebp - 0x24], 2
je 0x4062ad
mov ecx, dword [ebp - 0x28]
and dword [ebp - 0x24], 0xfffffffd
add ecx, 0xfffffff0
call fcn.00401264
test byte [ebp - 0x24], 1
je 0x4062be
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401264
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00401264
push ecx
mov dword [ebp - 0x10], esp
mov edi, esp
push 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.ATMpfAUzOSQFIDklByMcYQsIJnwsLQ8wARspDgcyB3IIGHszAhtAAgzKQ0aGHNyCCAHKBoLHwMAEn4LDQgHcggzByIAMiUwLCA9Gw4kfjANIyl8BTM5JAUgOTgGEi55
call fcn.004023a5
push edi
call fcn.004042ec
add esp, 0x24
mov ecx, esi
call fcn.00405e58
or dword [0x496614], eax
push 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Cx4HOiwLHzAFGRsMAw4hfgsOBywGLX4gCDM9OhobOQsOMAceCQsufywtIQYCLSklCBs5Hg8JISEsLSkOLxsHPQkyLSICIgsoDzMLOgc9cjgLPTkPAy0PMAESPQwHMCEhCBkLfwULCzACAiF3
call fcn.004023a5
lea eax, [ebp - 0x14]
push eax
call fcn.004042ec
add esp, 0x20
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
lea eax, [ebp - 0x18]
push eax
push ecx
mov byte [ebp - 4], 0xf
call fcn.00404065
add esp, 0xc
mov ecx, esi
call fcn.00405e58
mov ecx, dword [ebp - 0x14]
or dword [0x496614], eax
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00401264
push 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.ATMpfAUzOSQFIDkHBhkhfggzCHwaCw8FAx49CAcJenwLMwMeAwsLBQMdDwgHMgckCCAEZQMbDxAaHn44ADAlfQEzKXwFPXd3
call fcn.004023a5
lea eax, [ebp - 0x14]
push eax
call fcn.004042ec
add esp, 0x20
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
lea eax, [ebp - 0x18]
push eax
push ecx
mov byte [ebp - 4], 0x10
call fcn.00404065
add esp, 0xc
mov ecx, esi
call fcn.00405e58
mov ecx, dword [ebp - 0x14]
or dword [0x496614], eax
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00401264
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
lea ecx, [ebp - 0x54]
call fcn.0042a122
mov dword [ebp - 0x54], 0x471a38
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x54]
push eax
mov ecx, esi
call fcn.00429694
mov ecx, esi
call fcn.00429abf
push ebx
call fcn.0042fc7e
pop ecx
push 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Cx4HOiwLHzAFGRsMAw4hfgsOBywAPS0QCQ0PDgk9OXMBGQcoDi0pMxonHwQDPS5lCw56BgMJISEsIC0LBwkccwseBzosCx8wBRkbCw8jJnk
call fcn.004023a5
lea eax, [ebp - 0x10]
push eax
call fcn.004042ec
add esp, 0x24
push dword [eax]
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.0042f1a8
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x11
call fcn.00401264
mov ecx, esi
mov byte [esi + 0xa4], 1
call fcn.0040340a
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xe
call fcn.0042a166
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401264
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00401264
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x128]
xor ecx, ebp
call fcn.0044d0a7
add ebp, 0x12c
leave
ret