Function at 0x4182d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x4ca578]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.SetupWhitelist_started
push dword [0x504e50]
xor eax, eax
mov edi, ecx
mov dword [ebp - 0xa0c], eax
call fcn.00440eb0
push dword [0x504e50]
call fcn.00440bb0
lea ebx, [edi + 0x515c]
add esp, 0xc
mov dword [ebp - 0xa18], ebx
test ebx, ebx
je 0x41833d
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418323
sub ecx, edx
je 0x41833d
mov dword [ebp - 0xa0c], ebx
mov byte [ebp - 0xa01], 0x7c
jmp 0x418372
cmp dword [edi + 0x454], 0
je 0x418366
push str.SAFE
push 0x67
mov ecx, 0x511be0
call fcn.0040f8a0
mov dword [ebp - 0xa0c], eax
mov byte [ebp - 0xa01], 0xa
jmp 0x418372
mov al, byte [ebp - 0xa01]
mov byte [ebp - 0xa01], al
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
call esi
push eax
push dword [0x504e50]
call fcn.00440170
add esp, 0xc
mov dword [ebp - 0xa08], 0
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
call esi
mov ecx, dword [ebp - 0xa08]
mov dword [edi + ecx*4 + 0xb1f0], eax
inc dword [ebp - 0xa08]
cmp ebx, 0xffffffff
je 0x418490
lea eax, [ebp - 0xa00]
mov dword [ebp - 0xa00], 0x128
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x418489
cmp dword [ebp - 0x9e8], 0
je 0x418474
push 0x419c00
push 4
lea eax, [ebp - 0xa08]
push eax
lea esi, [edi + 0xb1f0]
lea eax, [ebp - 0x9e8]
push esi
push eax
call fcn.00453654
add esp, 0x14
test eax, eax
je 0x418474
push 0x419c00
push 4
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0x9f8]
push esi
push eax
call fcn.00453654
add esp, 0x14
test eax, eax
jne 0x418474
mov ecx, dword [ebp - 0xa08]
mov eax, dword [ebp - 0x9f8]
push 0
mov dword [edi + ecx*4 + 0xb1f0], eax
push dword [ebp - 0x9f8]
inc dword [ebp - 0xa08]
push dword [0x504e50]
call fcn.00440170
add esp, 0xc
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0xa00]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4183e0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.after_AddSafeProcess
push dword [0x504e50]
call fcn.00440eb0
mov esi, dword [ebp - 0xa0c]
add esp, 8
test esi, esi
je 0x41865a
push str.safeList_not_equal_to_null
push dword [0x504e50]
call fcn.00440eb0
movsx eax, byte [ebp - 0xa01]
mov ebx, esi
push eax
push esi
mov dword [ebp - 0xa14], eax
call fcn.004554f3
add esp, 0x10
mov dword [ebp - 0xa08], eax
test eax, eax
je 0x418540
mov ecx, eax
sub ecx, ebx
cmp byte [eax - 1], 0xd
lea eax, [ebp - 0x108]
lea esi, [ecx - 1]
cmovne esi, ecx
push esi
push ebx
push 0x104
push eax
call fcn.00454892
add esp, 0x10
cmp esi, 0x104
jae 0x41866b
mov eax, dword [ebp - 0xa08]
push dword [ebp - 0xa14]
inc eax
mov byte [ebp + esi - 0x108], 0
push eax
mov dword [ebp - 0xa10], eax
call fcn.004554f3
add esp, 8
mov dword [ebp - 0xa08], eax
jmp 0x41855d
push ebx
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0044a958
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xa10], eax
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418566
sub ecx, edx
je 0x418588
lea eax, [ebp - 0x108]
push eax
push 0
push dword [0x504e50]
call fcn.00440170
add esp, 0xc
xor esi, esi
push esi
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418600
lea eax, [ebp - 0xa00]
mov dword [ebp - 0xa00], 0x128
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4185f9
nop word [eax + eax]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x9dc]
push eax
call fcn.004555a7
add esp, 8
test eax, eax
jne 0x4185e8
mov eax, dword [ebp - 0x9f8]
mov dword [ebp + esi*4 - 0x8d8], eax
inc esi
lea eax, [ebp - 0xa00]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4185c0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
test esi, esi
jle 0x41862f
nop word [eax + eax]
mov ecx, dword [edi + 0xafcc]
mov eax, dword [ebp + edx*4 - 0x8d8]
inc edx
mov dword [edi + ecx*4 + 0xa7fc], eax
inc dword [edi + 0xafcc]
cmp edx, esi
jl 0x418610
mov ebx, dword [ebp - 0xa10]
test ebx, ebx
je 0x418644
mov eax, dword [ebp - 0xa08]
jmp 0x4184e0
cmp dword [ebp - 0xa18], 0
jne 0x41865a
mov eax, dword [ebp - 0xa0c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00444ab5
mov esp, ebp
pop ebp
ret
call fcn.00444ed2
int3