Function at 0x4050f7
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
push edi
mov dword [ebp - 0x200], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0xb8], 0
mov ecx, 0xb
mov esi, str.TenSafe_E02514DF_DCC4_4d49_A86A_60B555ED6D5E
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xb
mov esi, str.TenSafe_43CB8550_243D_4d2a_A3CD_DB436C2C1EDF
lea edi, [ebp - 0xb4]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xc
mov esi, str.TenSafeEvent_7216EFBD_BC98_4169_A8DA_4535E7DF2B4A
lea edi, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [str.QQLogin.exe]
mov dword [ebp - 0x1f8], eax
mov ecx, dword [0x44c2e8]
mov dword [ebp - 0x1f4], ecx
mov edx, dword [0x44c2ec]
mov dword [ebp - 0x1f0], edx
mov eax, dword [str.Client.exe]
mov dword [ebp - 0x1ec], eax
mov ecx, dword [0x44c2f4]
mov dword [ebp - 0x1e8], ecx
mov dx, word [0x44c2f8]
mov word [ebp - 0x1e4], dx
mov al, byte [0x44c2fa]
mov byte [ebp - 0x1e2], al
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x1e0], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x1dc]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1e0], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405207
mov dword [ebp - 0x80], 0xffffffff
jmp 0x4055a6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1e0]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x40525d
mov eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 8]
jne 0x405245
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x10], ecx
jmp 0x40525d
lea edx, [ebp - 0x1e0]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x84], eax
jmp 0x405226
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40528c
mov dword [ebp - 0x80], 0xffffffff
jmp 0x4055a4
lea edx, [ebp - 0x1e0]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x405339
mov ecx, dword [ebp - 0x1d8]
cmp ecx, dword [ebp - 0x10]
jne 0x40531e
lea edx, [ebp - 0x1f8]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x1f8]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4052eb
mov dword [ebp - 0x7c], 1
lea edx, [ebp - 0x1ec]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x40531c
mov dword [ebp - 0x44], 1
jmp 0x405339
lea edx, [ebp - 0x1e0]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x84], eax
jmp 0x4052a2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x7c], 0
jne 0x405354
cmp dword [ebp - 0x44], 0
jne 0x405354
jmp 0x4055a2
cmp dword [ebp - 0x7c], 0
je 0x405415
lea edx, [ebp - 0x78]
push edx
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0x200]
mov dword [ecx + 0x1a4], eax
mov edx, dword [ebp - 0x200]
cmp dword [edx + 0x1a4], 0
jne 0x40538e
jmp 0x4055a0
xor eax, eax
test eax, eax
jne 0x40537a
lea ecx, [ebp - 0x40]
push ecx
push 0x20008
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edx, dword [ebp - 0x200]
mov dword [edx + 0x19c], eax
mov eax, dword [ebp - 0x200]
cmp dword [eax + 0x19c], 0
jne 0x4053cb
jmp 0x40559e
xor ecx, ecx
test ecx, ecx
jne 0x4053b7
push 0
push 0
push 0
push 0xf001f
mov edx, dword [ebp - 0x200]
mov eax, dword [edx + 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x200]
mov dword [ecx + 0x1a0], eax
mov edx, dword [ebp - 0x200]
cmp dword [edx + 0x1a0], 0
jne 0x40540f
jmp 0x40559c
xor eax, eax
test eax, eax
jne 0x4053fb
cmp dword [ebp - 0x44], 0
je 0x4054d9
lea ecx, [ebp - 0x78]
push ecx
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 0x200]
mov dword [edx + 0x1a4], eax
mov eax, dword [ebp - 0x200]
cmp dword [eax + 0x1a4], 0
jne 0x40544f
jmp 0x40559a
xor ecx, ecx
test ecx, ecx
jne 0x40543b
lea edx, [ebp - 0xb4]
push edx
push 0x20008
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 0x200]
mov dword [ecx + 0x19c], eax
mov edx, dword [ebp - 0x200]
cmp dword [edx + 0x19c], 0
jne 0x40548f
jmp 0x405598
xor eax, eax
test eax, eax
jne 0x40547b
push 0
push 0
push 0
push 0xf001f
mov ecx, dword [ebp - 0x200]
mov edx, dword [ecx + 0x19c]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x200]
mov dword [ecx + 0x1a0], eax
mov edx, dword [ebp - 0x200]
cmp dword [edx + 0x1a0], 0
jne 0x4054d3
jmp 0x405596
xor eax, eax
test eax, eax
jne 0x4054bf
push 0
mov ecx, dword [ebp - 0x200]
mov edx, dword [ecx + 0x1a4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
je 0x405502
jmp 0x405594
xor eax, eax
test eax, eax
jne 0x4054f4
push 0x20008
push 0
mov ecx, dword [ebp - 0x200]
mov edx, dword [ecx + 0x1a0]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x200]
mov ecx, dword [eax + 0x1a0]
mov dword [ebp - 0xb8], ecx
mov edx, dword [ebp - 0xb8]
mov dword [edx], 0x20008
mov eax, dword [ebp - 0xb8]
add eax, 4
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0xb8]
mov dword [ecx], 8
mov edx, dword [ebp - 0x200]
mov eax, dword [edx + 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [ebp - 0x80], 1
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
jne 0x40558f
mov ecx, dword [ebp - 0x200]
call fcn.004055ae
mov eax, dword [ebp - 0x80]
jmp 0x4055a8
jmp 0x40557e
jmp 0x40557e
jmp 0x40557e
jmp 0x40557e
jmp 0x40557e
jmp 0x40557e
jmp 0x40557e
jmp 0x40557e
jmp 0x40557e
jmp 0x40557e
pop edi
pop esi
mov esp, ebp
pop ebp
ret