Function at 0x401175
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x25cc
push ebp
mov ebp, esp
call fcn.004088b0
mov eax, dword [0x421130]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
push str.Entering_EnumProcesses_PsApi...
xor esi, esi
push esi
push esi
push esi
push esi
mov dword [ebp - 0x25cc], eax
call fcn.00401a3b
sub esp, 0xfffffff0
mov edi, 0x2501
push eax
push edi
call fcn.00401ce5
push 0x1f9c
push esi
lea eax, [ebp - 0x2388]
push eax
mov dword [ebp - 0x238c], esi
call fcn.004087d0
push 0x3e6
xor eax, eax
mov word [ebp - 0x3ec], ax
lea eax, [ebp - 0x3ea]
push esi
push eax
call fcn.004087d0
sub esp, 0xffffffdc
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x25c4], eax
cmp eax, esi
jne 0x401208
xor eax, eax
jmp 0x401415
push ebx
push str.SucessFully_Loaded_PSAPI.DLL
push esi
push esi
push esi
push esi
call fcn.00401a3b
add esp, 0x10
push eax
push edi
call fcn.00401ce5
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
push str.EnumProcesses
push dword [ebp - 0x25c4]
call ebx
push str.EnumProcessModules
push dword [ebp - 0x25c4]
mov dword [ebp - 0x25c0], eax
call ebx
push str.GetModuleFileNameExW
push dword [ebp - 0x25c4]
mov dword [ebp - 0x25bc], eax
call ebx
cmp dword [ebp - 0x25c0], esi
je 0x4013fe
cmp dword [ebp - 0x25bc], esi
je 0x4013fe
cmp eax, esi
je 0x4013fe
lea ebx, [ebp - 0x25c8]
lea eax, [ebp - 0x238c]
push ebx
push 0x1fa0
push eax
call dword [ebp - 0x25c0]
or eax, eax
jne 0x4012c6
push str.Error_in_EnumProcesses
push esi
push esi
push esi
push esi
call fcn.00401a3b
add esp, 0x10
push eax
push edi
call fcn.00401ce5
add esp, 0xc
push dword [ebp - 0x25c4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x401412
shr dword [ebp - 0x25c8], 2
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x25c0], ebx
or eax, 0xffffffff
cmp ebx, eax
je 0x401414
lea eax, [ebp - 0x25b8]
push eax
push ebx
mov dword [ebp - 0x25b8], 0x22c
call sub.KERNEL32.dll_Process32FirstW
or eax, eax
jne 0x401312
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x401414
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
call section..text
or eax, eax
push dword [ebp - 0x25b0]
push esi
je 0x40132f
push 0x1400
jmp 0x401334
push 0x400
call ebx
mov dword [ebp - 0x25bc], eax
lea eax, [ebp - 0x3ec]
push 0x41b390
push eax
call fcn.0040888a
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x25b0]
push dword [ebp - 0x25bc]
call fcn.00401072
add esp, 0x14
cmp dword [ebp - 0x25bc], esi
je 0x40137c
push dword [ebp - 0x25bc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x3ec]
push esi
push eax
lea eax, [ebp - 0x2594]
push eax
push esi
call dword [ebp - 0x25cc]
mov dword [ebp - 0x25bc], eax
cmp eax, esi
jne 0x4013b6
lea eax, [ebp - 0x25b8]
push eax
push dword [ebp - 0x25c0]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401318
cmp dword [ebp - 0x25c0], esi
je 0x4013ca
push dword [ebp - 0x25c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x25c4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x25bc], esi
je 0x401412
push str.Exiting__EnumProcesses_PsApi
push esi
push esi
push esi
push esi
call fcn.00401a3b
sub esp, 0xfffffff0
push eax
push edi
call fcn.00401ce5
xor eax, eax
add esp, 0xc
inc eax
jmp 0x401414
push dword [ebp - 0x25c4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040884a
leave
ret 0xc