Function at 0x401450
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0040a600
mov eax, dword [0x433050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.ZwQuerySystemInformation
push str.ntdll.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.NtQueryObject
mov ebx, eax
push str.ntdll.dll
mov dword [ebp - 0x1428], ebx
call edi
push eax
call esi
push 0x80
mov dword [ebp - 0x1434], eax
lea eax, [ebp - 0x84]
push 0
push eax
mov dword [ebp - 0x1420], 0
mov dword [ebp - 0x1418], 0
call fcn.0040b4a0
push 0x200
lea eax, [ebp - 0x284]
push 0
push eax
call fcn.0040b4a0
call fcn.004083f0
push 0x190
lea eax, [ebp - 0x1414]
push 0
push eax
call fcn.0040b4a0
push 0x228
lea eax, [ebp - 0x4ac]
mov dword [ebp - 0x4b0], 0x22c
push 0
push eax
call fcn.0040b4a0
add esp, 0x30
xor esi, esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
je 0x4018bc
lea eax, [ebp - 0x4b0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40157b
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x48c]
push eax
push 0x42f8d0
call fcn.0040de5f
add esp, 8
test eax, eax
jne 0x401567
mov eax, dword [ebp - 0x4a8]
mov dword [ebp + esi*4 - 0x1414], eax
inc esi
lea eax, [ebp - 0x4b0]
push eax
push edi
call ebx
test eax, eax
jne 0x401541
mov ebx, dword [ebp - 0x1428]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4018bc
test ebx, ebx
je 0x4018bc
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x1000
push 0x1000
push 0
call edi
mov dword [ebp - 0x1424], eax
test eax, eax
je 0x4018bc
lea ecx, [ebp - 0x1420]
push ecx
push 0x1000
push eax
push 0x10
call ebx
test eax, eax
jns 0x401630
cmp eax, 0xc0000004
jne 0x4018a9
push 0x8000
push 0
push dword [ebp - 0x1424]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 0x1420]
add eax, eax
cmp eax, 0x4000000
ja 0x4018a9
push 4
push 0x1000
push eax
push 0
call edi
mov ecx, eax
mov dword [ebp - 0x1424], ecx
test ecx, ecx
je 0x4018bc
mov eax, dword [ebp - 0x1420]
push 0
add eax, eax
push eax
push ecx
push 0x10
call ebx
test eax, eax
js 0x4018a9
mov eax, dword [ebp - 0x1424]
xor ecx, ecx
mov dword [ebp - 0x1428], ecx
cmp dword [eax], ecx
jbe 0x4018a9
lea ecx, [eax + 4]
mov dword [ebp - 0x1430], ecx
mov edx, ecx
mov dword [ebp - 0x142c], ecx
xor eax, eax
test esi, esi
jle 0x40166e
movzx ecx, word [ecx]
cmp ecx, dword [ebp + eax*4 - 0x1414]
je 0x4016ce
inc eax
cmp eax, esi
jl 0x401660
xor eax, eax
test eax, eax
je 0x401808
movzx eax, word [edx]
movzx ebx, word [edx + 6]
push eax
push 0
push 0x1fffff
mov dword [ebp - 0x141c], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4016d5
push 2
push 0
push 0
lea eax, [ebp - 0x141c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
neg eax
push edi
sbb eax, eax
and dword [ebp - 0x141c], eax
call ebx
jmp 0x4016db
mov eax, 1
jmp 0x401670
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x141c]
test edi, edi
je 0x401802
lea eax, [ebp - 0x1418]
push eax
push 0x200
lea eax, [ebp - 0x284]
push eax
push 1
push edi
call dword [ebp - 0x1434]
test eax, eax
js 0x4017ff
lea eax, [ebp - 0x1418]
push eax
push 0x80
lea eax, [ebp - 0x84]
push eax
push 2
push edi
call dword [ebp - 0x1434]
test eax, eax
js 0x4017ff
push 0x800
lea eax, [ebp - 0x1284]
push 0
push eax
call fcn.0040b4a0
push 0x800
lea eax, [ebp - 0xa84]
push 0
push eax
call fcn.0040b4a0
movzx eax, word [ebp - 0x84]
shr eax, 1
push eax
push dword [ebp - 0x80]
lea eax, [ebp - 0x1284]
push eax
call fcn.0040df60
movzx eax, word [ebp - 0x284]
shr eax, 1
push eax
push dword [ebp - 0x280]
lea eax, [ebp - 0xa84]
push eax
call fcn.0040df60
add esp, 0x30
lea eax, [ebp - 0x1284]
mov ecx, str.Mutant
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4017c6
test dx, dx
je 0x4017c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4017c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4017a0
xor eax, eax
jmp 0x4017cb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4017ff
lea eax, [ebp - 0xa84]
push str._WeChat_
push eax
call fcn.0040ab9f
add esp, 8
test eax, eax
je 0x4017ff
lea eax, [ebp - 0xa84]
push str._Instance_Identity_Mutex_Name
push eax
call fcn.0040ab9f
add esp, 8
test eax, eax
jne 0x40183a
push edi
call ebx
mov edx, dword [ebp - 0x142c]
mov ecx, dword [ebp - 0x1428]
add edx, 0x10
mov eax, dword [ebp - 0x1424]
inc ecx
add dword [ebp - 0x1430], 0x10
mov dword [ebp - 0x1428], ecx
mov dword [ebp - 0x142c], edx
cmp ecx, dword [eax]
jae 0x4018a9
mov ecx, dword [ebp - 0x1430]
jmp 0x401657
push edi
call ebx
mov ecx, dword [ebp - 0x1428]
mov eax, dword [ebp - 0x1424]
add ecx, ecx
mov dword [ebp - 0x141c], 0
movzx edi, word [eax + ecx*8 + 0xa]
movzx eax, word [eax + ecx*8 + 4]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40189c
push 1
push 0
push 0
lea eax, [ebp - 0x141c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
neg eax
push esi
sbb eax, eax
and dword [ebp - 0x141c], eax
call ebx
mov eax, dword [ebp - 0x141c]
test eax, eax
je 0x4018a9
push eax
call ebx
push 0x8000
push 0
push dword [ebp - 0x1424]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409864
mov esp, ebp
pop ebp
ret