Function at 0x43a867
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x238], 0
mov eax, dword [0x462f80]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43a8cc
mov eax, dword [ebp - 8]
mov byte [eax + 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x43a8ae
cmp dword [0x4620a4], 0
je 0x43a904
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0
call dword [0x4620a4]
test eax, eax
je 0x43a8fd
jmp 0x43a904
mov dword [ebp - 4], 0
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x380], 0x128
mov byte [ebp - 0x35c], 0
lea eax, [ebp - 0x380]
push eax
mov eax, dword [ebp - 0x234]
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x43aef9
push 0x47b874
lea eax, [ebp - 0x35c]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x43a969
mov eax, dword [ebp - 0x378]
mov dword [0x462f40], eax
push 0x47b884
lea eax, [ebp - 0x35c]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x43ae2b
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x258], 0
lea eax, [ebp - 0x220]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
cmp dword [0x462124], 0
je 0x43a9c7
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x248]
push eax
mov eax, dword [ebp - 0x378]
push eax
call fcn.0043dde0
add esp, 0x14
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x43adf9
mov dword [ebp - 0x384], 0
mov dword [ebp - 0x230], 0
lea eax, [ebp - 0x230]
push eax
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x230], 0x103
je 0x43aaa5
mov eax, dword [0x462f80]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43aaa0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x378]
cmp dword [eax + 0xc], ecx
jne 0x43aa93
mov eax, dword [ebp - 0x248]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0043b160
add esp, 8
mov dword [ebp - 8], 0
jmp 0x43aa9b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x43aa58
jmp 0x43adf4
mov eax, dword [0x462f80]
mov dword [ebp - 8], eax
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x238], 0
cmp dword [0x462078], 0
je 0x43aaff
lea eax, [ebp - 0x238]
push eax
mov eax, dword [ebp - 0x378]
push eax
call dword [0x462078]
jmp 0x43ab09
mov dword [ebp - 0x238], 0
cmp dword [ebp - 8], 0
je 0x43ab87
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cx, word [eax + 6]
cmp ecx, dword [ebp - 0x238]
jne 0x43ab32
mov dword [ebp - 0x228], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
jne 0x43ab4e
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x378]
cmp dword [eax + 0xc], ecx
jne 0x43ab7a
mov eax, dword [ebp - 8]
mov byte [eax + 4], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 1
jmp 0x43ab82
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x43ab09
cmp dword [ebp - 0x14], 0
jne 0x43adf4
cmp dword [ebp - 0x228], 0
jne 0x43adf4
cmp dword [ebp - 0x18], 0
je 0x43acad
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x18]
mov byte [eax + 4], 1
cmp dword [0x462078], 0
je 0x43abe1
mov eax, dword [ebp - 0x18]
add eax, 6
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
push eax
call dword [0x462078]
jmp 0x43abea
mov eax, dword [ebp - 0x18]
mov word [eax + 6], 0
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
mov edx, dword [eax]
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 8], 0
lea edi, [ebp - 0x220]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 0x18]
add edi, 0x36
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x224]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
add eax, 0xb3a
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x93a
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x73a
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x53a
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x33a
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x2ba
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x236
push eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
push ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043d7fa
add esp, 0x2c
mov eax, dword [ebp - 0x248]
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.0043bf4d
add esp, 8
jmp 0x43adf4
push 0xd92
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 8]
mov byte [eax + 4], 1
cmp dword [0x462078], 0
je 0x43ad12
mov eax, dword [ebp - 8]
add eax, 6
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
push eax
call dword [0x462078]
jmp 0x43ad1b
mov eax, dword [ebp - 8]
mov word [eax + 6], 0
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
add ecx, 0x10
mov edx, dword [eax]
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
lea edi, [ebp - 0x220]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp - 8]
add edi, 0x36
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x22c], 0
je 0x43ad76
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], eax
jmp 0x43ad7e
mov eax, dword [ebp - 8]
mov dword [0x462f80], eax
mov eax, dword [ebp - 0x224]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
add eax, 0xb3a
push eax
mov eax, dword [ebp - 8]
add eax, 0x93a
push eax
mov eax, dword [ebp - 8]
add eax, 0x73a
push eax
mov eax, dword [ebp - 8]
add eax, 0x53a
push eax
mov eax, dword [ebp - 8]
add eax, 0x33a
push eax
mov eax, dword [ebp - 8]
add eax, 0x2ba
push eax
mov eax, dword [ebp - 8]
add eax, 0x236
push eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cx, word [eax + 6]
push ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
push eax
call fcn.0043d7fa
add esp, 0x2c
mov eax, dword [ebp - 0x248]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0043bf4d
add esp, 8
jmp 0x43adf9
mov eax, dword [ebp - 0x258]
push eax
mov eax, dword [ebp - 0x248]
push eax
call fcn.0043e02d
add esp, 8
cmp dword [0x462154], 0
je 0x43ae2b
mov eax, dword [ebp - 0x378]
push eax
call fcn.0043a5bd
add esp, 4
inc dword [ebp - 0x24c]
mov ecx, 0x14
mov eax, dword [ebp - 0x24c]
sub edx, edx
div ecx
test edx, edx
jne 0x43ae50
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x380]
push eax
mov eax, dword [ebp - 0x234]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x43a942
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x43ae8c
mov eax, dword [ebp - 4]
push eax
call dword [0x4620a0]
mov dword [ebp - 4], 0
mov eax, dword [0x462f80]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43aeea
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
je 0x43aedd
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 4]
test ecx, ecx
jne 0x43aedd
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
jne 0x43aedd
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.0043b160
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x43ae9b
mov eax, 1
jmp 0x43af21
cmp dword [0x45e03c], 0
je 0x43af1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_rLAP:Get_PE_Info_Failed___d_
call fcn.00452380
add esp, 8
xor eax, eax
jmp 0x43af21
pop edi
pop esi
pop ebx
leave
ret