Function at 0x401899
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push edi
mov dword [ebp - 0x234], 0
cmp dword [ebp - 0x234], 0
je 0x4018b6
mov dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 0
je 0x4018c9
mov dword [ebp - 0x23c], 0
cmp dword [ebp - 0x23c], 0
je 0x4018dc
mov dword [ebp - 0x240], 0
cmp dword [ebp - 0x240], 0
je 0x4018ef
mov dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 0
je 0x401902
mov dword [ebp - 0x248], 0
cmp dword [ebp - 0x248], 0
je 0x401915
mov dword [ebp - 0x24c], 0
cmp dword [ebp - 0x24c], 0
je 0x401928
mov dword [ebp - 0x250], 0
cmp dword [ebp - 0x250], 0
je 0x40193b
mov dword [ebp - 0x254], 0
cmp dword [ebp - 0x254], 0
je 0x40194e
mov dword [ebp - 0x258], 0
cmp dword [ebp - 0x258], 0
je 0x401961
mov dword [ebp - 0x25c], 0
cmp dword [ebp - 0x25c], 0
je 0x401974
mov dword [ebp - 0x260], 0
cmp dword [ebp - 0x260], 0
je 0x401987
mov dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 0
je 0x40199a
mov dword [ebp - 0x268], 0
cmp dword [ebp - 0x268], 0
je 0x4019ad
mov dword [ebp - 0x26c], 0
cmp dword [ebp - 0x26c], 0
je 0x4019c0
mov dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 0
je 0x4019d3
mov dword [ebp - 0x274], 0
cmp dword [ebp - 0x274], 0
je 0x4019e6
mov dword [ebp - 0x278], 0
cmp dword [ebp - 0x278], 0
je 0x4019f9
mov dword [ebp - 0x27c], 0
cmp dword [ebp - 0x27c], 0
je 0x401a0c
mov dword [ebp - 0x280], 0
cmp dword [ebp - 0x280], 0
je 0x401a1f
mov dword [ebp - 0x284], 0
cmp dword [ebp - 0x284], 0
je 0x401a32
mov dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 0
je 0x401a45
mov dword [ebp - 0x28c], 0
cmp dword [ebp - 0x28c], 0
je 0x401a58
mov dword [ebp - 0x290], 0
cmp dword [ebp - 0x290], 0
je 0x401a6b
mov dword [ebp - 0x294], 0
cmp dword [ebp - 0x294], 0
je 0x401a7e
mov dword [ebp - 0x298], 0
cmp dword [ebp - 0x298], 0
je 0x401a91
mov dword [ebp - 0x29c], 0
cmp dword [ebp - 0x29c], 0
je 0x401aa4
mov dword [ebp - 0x2a0], 0
cmp dword [ebp - 0x2a0], 0
je 0x401ab7
mov dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0
je 0x401aca
mov dword [ebp - 0x2a8], 0
cmp dword [ebp - 0x2a8], 0
je 0x401add
mov dword [ebp - 0x2ac], 0
cmp dword [ebp - 0x2ac], 0
je 0x401af0
mov dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0
je 0x401b03
mov dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 0
je 0x401b16
mov dword [ebp - 0x2b8], 0
cmp dword [ebp - 0x2b8], 0
je 0x401b29
mov dword [ebp - 0x2bc], 0
cmp dword [ebp - 0x2bc], 0
je 0x401b3c
mov dword [ebp - 0x2c0], 0
cmp dword [ebp - 0x2c0], 0
je 0x401b4f
mov dword [ebp - 0x2c4], 0
cmp dword [ebp - 0x2c4], 0
je 0x401b62
mov dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0
je 0x401b75
mov dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 0
je 0x401b88
mov dword [ebp - 0x2d0], 0
cmp dword [ebp - 0x2d0], 0
je 0x401b9b
mov dword [ebp - 0x2d4], 0
cmp dword [ebp - 0x2d4], 0
je 0x401bae
mov dword [ebp - 0x2d8], 0
cmp dword [ebp - 0x2d8], 0
je 0x401bc1
mov dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0
je 0x401bd4
mov dword [ebp - 0x2e0], 0
cmp dword [ebp - 0x2e0], 0
je 0x401be7
mov dword [ebp - 0x2e4], 0
cmp dword [ebp - 0x2e4], 0
je 0x401bfa
mov dword [ebp - 0x2e8], 0
cmp dword [ebp - 0x2e8], 0
je 0x401c0d
mov dword [ebp - 0x2ec], 0
cmp dword [ebp - 0x2ec], 0
je 0x401c20
mov dword [ebp - 0x2f0], 0
cmp dword [ebp - 0x2f0], 0
je 0x401c33
mov dword [ebp - 0x2f4], 0
cmp dword [ebp - 0x2f4], 0
je 0x401c46
mov dword [ebp - 0x2f8], 0
cmp dword [ebp - 0x2f8], 0
je 0x401c59
mov dword [ebp - 0x2fc], 0
cmp dword [ebp - 0x2fc], 0
je 0x401c6c
mov dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 0
je 0x401c7f
mov dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 0
je 0x401c92
mov dword [ebp - 0x308], 0
cmp dword [ebp - 0x308], 0
je 0x401ca5
mov dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0
je 0x401cb8
mov dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0
je 0x401ccb
mov dword [ebp - 0x314], 0
cmp dword [ebp - 0x314], 0
je 0x401cde
mov dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 0
je 0x401cf1
mov dword [ebp - 0x228], 0x128
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x401d1d
mov eax, 0
jmp 0x401dbb
lea edi, [ebp - 0x228]
push edi
push dword [ebp - 0x230]
call sub.KERNEL32.DLL_Process32First
mov dword [ebp - 0x22c], eax
jmp 0x401dad
lea edi, [ebp - 0x204]
push edi
lea edi, [ebp - 0xff]
push edi
call sub.CRTDLL.DLL_strcpy
add esp, 8
lea edi, [ebp - 0xff]
push edi
call sub.KERNEL32.DLL_lstrlenA
push eax
lea edi, [ebp - 0xff]
push edi
call fcn.0040185e
add esp, 8
lea edi, [ebp - 0xff]
push edi
call fcn.004021e8
add esp, 4
mov edi, eax
push str.explorer.exe
push edi
call sub.CRTDLL.DLL_strcmp
add esp, 8
cmp eax, 0
jne 0x401d95
mov eax, dword [ebp - 0x220]
jmp 0x401dbb
lea edi, [ebp - 0x228]
push edi
push dword [ebp - 0x230]
call sub.KERNEL32.DLL_Process32Next
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
jne 0x401d37
mov eax, 0
pop edi
leave
ret