Function at 0x72a350
Capabilities:
Enumerate processes

Disassembly:
push 0x5c4
mov eax, 0x7b1230
call fcn.00772fd1
push 0x5b
pop ecx
mov esi, str.8EAsafPCYxRTWWs16pLxSTChjkURKPEA0MOtwjpm2k0CquknXgJlM7uVkTEFzoi2764jjNiFh8I6ad5dSWuM0JwKczSM3jzw6DDYsFnrLG0LzAZ9NPpwgsNK1eTpyuVAAGQv4pKENmhBS5H9PaUGvdmbpeKiVOgjKpcgIe4je4pdGDa6BJJuqbUGNUwBxeTPz2HZ8XiskrJvLrMzSzUk1bpXDTRU7jDGHnzGD0MlQvW4ZHK9J0yG1jcGTo4vsNlu632RcxusLiAovui0ErHD6D26azwRISlXsjqprMhWQLEHJdwnQlOTQKu3HNwQXUWsSn5wNEtd6kPDaaMgwiqzxGYZ11H4m1bnYxVeVw6Z2XgcHR
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x180]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x79
pop ecx
mov dword [ebp - 0x5d0], eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x5cc], eax
mov dword [ebp - 0x5c8], eax
movsb byte es:[edi], byte [esi]
mov esi, str.3sgWZTtfsduhUQrpC48u6ECVyiYEtbp8sDkZwGBiiYo1mrjhOJAVqdi0E6NJC9MgFmAqD4UL0Qp6YGZgnyXII6BvKjHOHU8AVcasGrjWquUOgs1YdbRSWJN6XXgekqQPF8NsN2oVIHLguqI3oF7yTzYXXEEGeJA7zsnUBHDSzjS3LIg6wnjHbUUw3r5k17mykhWtgXRXXRo6FfT12GPJipQIUNK1VZYM8CwSKb8BV6VbzafzUTJWz2MsoeDsDlO6EPX3qPQwmTTtbvx7bZlhjtQYppmbgWrwDj0yRs5pZKkH0VlGTfetcn1Zg5etcNdv1TVFabta84IbF9rChZg4NuD6Dp9N9cecUSI02SZC7wsr6ef9qec5XSYWG9LOb6ptCDkr2olVM1fe1nhlvdq7CHsDVQS5hQurHsfImY1Z3QqCJGI7P7qBFh9Y55kTUn2DOMX275OQhpLD0SQlCP0j3PfGWEvMEBwV1OGm
lea edi, [ebp - 0x368]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x380]
lea eax, [ebp - 0x180]
push eax
call fcn.00405a50
lea eax, [ebp - 0x380]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x5d0]
call fcn.004082f0
xor edi, edi
mov byte [ebp - 4], 0
push 0
inc edi
lea ecx, [ebp - 0x380]
push edi
call fcn.004096c0
lea eax, [ebp - 0x368]
push eax
lea ecx, [ebp - 0x380]
call fcn.00405a50
lea eax, [ebp - 0x380]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x5d0]
call fcn.004082f0
push 0
push edi
lea ecx, [ebp - 0x380]
mov byte [ebp - 4], 0
call fcn.004096c0
test ebx, ebx
jne 0x72a41f
xor esi, esi
jmp 0x72a54c
push ebx
lea ecx, [ebp - 0x398]
call fcn.004026c0
lea eax, [ebp - 0x398]
mov byte [ebp - 4], 3
push eax
call fcn.007371fa
mov dword [esp], 0x22c
lea eax, [ebp - 0x5c4]
xor ebx, ebx
push ebx
push eax
call fcn.0074fc20
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x72a53d
lea eax, [ebp - 0x5c4]
mov dword [ebp - 0x5c4], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x72a529
xor eax, eax
mov dword [ebp - 0x36c], 7
mov dword [ebp - 0x370], ebx
mov word [ebp - 0x380], ax
cmp word [ebp - 0x5a0], ax
jne 0x72a4a9
mov eax, ebx
jmp 0x72a4b6
lea eax, [ebp - 0x5a0]
push eax
call fcn.0075fe99
pop ecx
push eax
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x380]
call fcn.00402820
lea eax, [ebp - 0x380]
mov byte [ebp - 4], 4
push eax
call fcn.007371fa
cmp dword [ebp - 0x384], 8
lea eax, [ebp - 0x398]
pop ecx
push dword [ebp - 0x388]
cmovae eax, dword [ebp - 0x398]
lea ecx, [ebp - 0x380]
push eax
push dword [ebp - 0x370]
push ebx
call fcn.00425b30
test eax, eax
je 0x72a55f
push ebx
push edi
lea ecx, [ebp - 0x380]
mov byte [ebp - 4], 3
call fcn.00402760
lea eax, [ebp - 0x5c4]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x72a483
call fcn.006f280e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push ebx
push edi
lea ecx, [ebp - 0x398]
call fcn.00402760
lea ecx, [ebp - 0x5d0]
call fcn.006ec102
mov eax, esi
call fcn.00772f7b
ret
call fcn.006f1e29
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x5bc]
lea ecx, [ebp - 0x380]
push ebx
push edi
call fcn.00402760
jmp 0x72a53f