Function at 0x401231
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
mov dword [0x40307c], 0x128
push 0x40307c
push eax
call sub.kernel32.dll_Process32First
jmp 0x401304
push dword [0x403084]
push 8
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
mov dword [0x4031a4], 0x224
push 0x4031a4
push eax
call sub.kernel32.dll_Module32First
jmp 0x4012f3
push 0
push 0x4031c4
call fcn.004011ff
mov ebx, eax
push str.freecell.exe
push ebx
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x4012e6
mov eax, dword [0x4031ac]
mov dword [0x403070], eax
push 0
push str.Success_
push str.All_Appears_Good
push 0
call sub.user32.dll_MessageBoxA
mov eax, dword [0x4031b8]
mov dword [0x403078], eax
push dword [0x403070]
push 1
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [0x403070], eax
call fcn.004013d2
leave
ret
push 0x4031a4
push dword [ebp - 4]
call sub.kernel32.dll_Module32Next
test eax, eax
jne 0x401284
push 0x40307c
push dword [ebp - 8]
call sub.kernel32.dll_Process32Next
test eax, eax
jne 0x40125d
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
leave
ret

Function at 0x4013d2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
lea eax, [0x40131e]
lea ebx, [fcn.004013d2]
sub ebx, eax
push 0x40
push 0x1000
push ebx
push 0
push dword [0x403070]
call sub.kernel32.dll_VirtualAllocEx
push eax
mov dword [0x40303c], eax
mov ecx, eax
pushal
mov eax, 0x40131e
mov ebx, 0x401330
sub ebx, eax
add ecx, ebx
mov dword [0x4033cc], ecx
popal
mov eax, 0x40131e
mov ebx, 0x40133a
sub ebx, eax
add ecx, ebx
mov dword [0x4033d0], ecx
lea eax, [0x40131e]
lea ebx, [fcn.004013d2]
sub ebx, eax
push ebx
push ebx
push 0
call sub.kernel32.dll_GlobalAlloc
pop ebx
push eax
push ebx
push eax
push 0x40131e
call fcn.00401580
pop esi
push esi
mov ecx, 0x40131e
mov edx, 0x401330
sub edx, ecx
pop eax
pop ebx
push ebx
push eax
add ebx, edx
mov edx, ebx
mov eax, 0x40131e
mov ebx, 0x4013c5
sub ebx, eax
add esi, ebx
mov dword [esi], edx
mov eax, 0x40131e
mov ebx, fcn.004013d2
sub ebx, eax
pop esi
pop eax
push eax
push 0x4033c8
push ebx
push esi
push eax
push dword [0x403070]
call sub.kernel32.dll_WriteProcessMemory
mov eax, dword [0x403078]
add eax, 0x1af9
push 0x4033c8
push 7
push 0x403048
push eax
push dword [0x403070]
call sub.kernel32.dll_ReadProcessMemory
pop eax
mov ebx, 0x40131e
mov ecx, 0x4013a3
sub ecx, ebx
add eax, ecx
push 0x4033c8
push 7
push 0x403048
push eax
push dword [0x403070]
call sub.kernel32.dll_WriteProcessMemory
mov eax, dword [0x403078]
add eax, 0x1af9
push 0x4033c8
push 7
push 0x40303b
push eax
push dword [0x403070]
call sub.kernel32.dll_WriteProcessMemory
leave
ret

Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret