Function at 0x40fc00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5cc
mov eax, dword [0x5e3fe4]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x5ed3e8], 1
mov eax, ecx
push ebx
push esi
push edi
mov dword [ebp - 0x5c4], eax
jne 0x40fe8d
lea esi, [eax + 0xee0]
xor edi, edi
movzx eax, word [esi]
xor ebx, ebx
xor ecx, ecx
test ax, ax
je 0x40fe8d
mov edx, eax
movzx eax, dx
cmp dx, 0x2e
jne 0x40fc56
inc ecx
cmp ecx, 1
jg 0x40fc7e
jmp 0x40fc70
mov edx, eax
test ecx, ecx
jne 0x40fc67
lea edi, [edi + edi*4]
lea edi, [edi - 0x18]
lea edi, [edx + edi*2]
jmp 0x40fc70
lea ebx, [ebx + ebx*4]
lea ebx, [ebx - 0x18]
lea ebx, [edx + ebx*2]
movzx eax, word [esi + 2]
add esi, 2
mov edx, eax
test ax, ax
jne 0x40fc45
cmp edi, 4
jg 0x40fc91
jne 0x40fc8a
cmp ebx, 0xd
jge 0x40fc91
mov edi, 1
jmp 0x40fc96
mov edi, 2
mov esi, dword [ebp - 0x5c4]
mov ecx, esi
push 0x409
mov dword [ebp - 0x5bc], edi
call fcn.004245ad
push 0
push 0
push 0xf0
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x40fccd
lea ebx, [esi + 0xcd8]
jmp 0x40fccf
xor ebx, ebx
mov eax, dword [esi + 0xd4]
xor esi, esi
push esi
push 0xf
mov dword [ebp - 0x5c8], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x5c0], eax
test eax, eax
je 0x40fe8d
push 0x228
lea eax, [ebp - 0x5b4]
push esi
push eax
call fcn.005515b0
add esp, 0xc
mov dword [ebp - 0x5b8], 0x22c
lea eax, [ebp - 0x5b8]
push eax
push dword [ebp - 0x5c0]
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40fe0c
nop
lea eax, [ebp - 0x594]
push str.EXCEL.EXE
push eax
call fcn.0055da38
add esp, 8
test eax, eax
jne 0x40fdd1
test ebx, ebx
jne 0x40fd5d
cmp edi, 1
ja 0x40fd5d
mov esi, dword [ebp - 0x5b0]
jmp 0x40fdcd
mov esi, dword [ebp - 0x5b0]
lea edx, [ebp - 0x188]
mov ecx, esi
call fcn.00401f00
mov edi, eax
test edi, edi
je 0x40fdc7
cmp word [ebp - 0x188], 0
je 0x40fdbe
test ebx, ebx
je 0x40fd9b
lea eax, [ebp - 0x188]
push eax
push ebx
call fcn.0055da38
xor ecx, ecx
add esp, 8
test eax, eax
cmovne esi, ecx
cmp dword [ebp - 0x5bc], 1
jbe 0x40fdc0
test esi, esi
je 0x40fdc0
push dword [ebp - 0x5c8]
mov edx, esi
mov ecx, edi
call fcn.004021b0
add esp, 4
mov esi, eax
jmp 0x40fdc0
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x5bc]
test esi, esi
jne 0x40fe0c
push 0x228
lea eax, [ebp - 0x5b4]
push 0
push eax
call fcn.005515b0
add esp, 0xc
mov dword [ebp - 0x5b8], 0x22c
lea eax, [ebp - 0x5b8]
push eax
push dword [ebp - 0x5c0]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40fd30
push dword [ebp - 0x5c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40fe8d
lea edx, [ebp - 0x88]
mov ecx, esi
call fcn.00401f00
test eax, eax
je 0x40fe34
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 0x88], 0
lea eax, [ebp - 0x88]
push eax
mov ecx, 0x5c3120
mov eax, 0x5c5224
cmove eax, ecx
push eax
lea eax, [ebp - 0x388]
push str.There_are_running_Excel_tasks._r_n___s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x5c4]
lea eax, [ebp - 0x388]
add esp, 0x10
push 2
push eax
call fcn.0040e880
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e183
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054e183
mov esp, ebp
pop ebp
ret