Function at 0x300874cf
Capabilities:
Enumerate processes
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x7884
call fcn.30004a38
mov eax, dword [0x3003fd00]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x787c], 0xffffffff
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x104a
push esi
lea eax, [ebp - 0x1050]
push ebx
push eax
mov dword [ebp - 0x7870], ebx
mov dword [ebp - 0x7874], ebx
call fcn.3000235e
push esi
lea eax, [ebp - 0x209c]
push ebx
push eax
call fcn.3000235e
push esi
lea eax, [ebp - 0x5180]
push ebx
push eax
call fcn.3000235e
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push ebx
push 2
mov edi, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x7884], ebx
je 0x300877a7
lea eax, [ebp - 0x7444]
push eax
push ebx
mov dword [ebp - 0x7444], 0x22c
mov dword [ebp - 0x786c], 0x428
call sub.KERNEL32.dll_Process32FirstW
jmp 0x30087588
lea eax, [ebp - 0x7444]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
cmp dword [ebp - 0x743c], edi
jne 0x3008757b
push dword [ebp - 0x742c]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x786c]
push ecx
push eax
mov dword [ebp - 0x787c], eax
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x300877a7
push 0x46
mov edi, 0x825
push edi
lea eax, [ebp - 0x1050]
push eax
push 0
push 0
push 5
call dword [sym.imp.MSO.dll_Ordinal_6281]
test eax, eax
je 0x30087731
mov ebx, dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push edi
lea eax, [ebp - 0x4134]
push eax
lea eax, [ebp - 0x1050]
push eax
call ebx
test eax, eax
je 0x30087731
push edi
lea eax, [ebp - 0x30e8]
push eax
lea eax, [ebp - 0x764c]
push eax
call ebx
test eax, eax
je 0x30087731
lea eax, [ebp - 0x4134]
push eax
lea eax, [ebp - 0x30e8]
push eax
call fcn.30005632
test eax, eax
jne 0x3008778f
mov ebx, dword [sym.imp.MSO.dll_Ordinal_1358]
lea eax, [ebp - 0x7874]
push eax
push 0x20019
push 0x3008781c
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x300876a7
and dword [ebp - 0x7878], eax
lea eax, [ebp - 0x7880]
push eax
lea eax, [ebp - 0x209c]
push eax
lea eax, [ebp - 0x7878]
push eax
push 0x3008787c
push dword [ebp - 0x7874]
mov dword [ebp - 0x7880], esi
call dword [sym.imp.MSO.dll_Ordinal_1342]
test eax, eax
jne 0x300877a7
push edi
lea eax, [ebp - 0x61cc]
push eax
lea eax, [ebp - 0x209c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x30087731
lea eax, [ebp - 0x61cc]
push eax
lea eax, [ebp - 0x30e8]
push eax
call fcn.30005632
test eax, eax
jne 0x3008778f
lea eax, [ebp - 0x7874]
push eax
push 0x20019
push 0x300878a0
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x30087740
and dword [ebp - 0x7880], eax
lea eax, [ebp - 0x7878]
push eax
lea eax, [ebp - 0x5180]
push eax
lea eax, [ebp - 0x7880]
push eax
push 0x300878dc
push dword [ebp - 0x7874]
mov dword [ebp - 0x7878], esi
call dword [sym.imp.MSO.dll_Ordinal_1342]
test eax, eax
jne 0x300877a7
push edi
lea eax, [ebp - 0x7218]
push eax
lea eax, [ebp - 0x5180]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x30087740
mov dword [ebp - 0x7870], 0x8000ffff
jmp 0x300877c1
push edi
lea eax, [ebp - 0x7218]
push eax
push 0x300878f4
call dword [sym.imp.MSO.dll_Ordinal_6873]
lea eax, [ebp - 0x7218]
push eax
lea eax, [ebp - 0x30e8]
push eax
call fcn.30005632
test eax, eax
jne 0x3008778f
push eax
push 0xffffffffffffffff
push eax
push 3
push eax
push 0x200
push 0x10089
call fcn.3009e0b1
add esp, 0x1c
mov dword [ebp - 0x7870], 0x80070057
jmp 0x300877c1
push 0x100
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
test eax, eax
jne 0x300877c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x300877bb
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x7870], eax
cmp dword [ebp - 0x7874], 0
je 0x300877d6
push dword [ebp - 0x7874]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7884], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x300877ed
push dword [ebp - 0x7884]
call esi
cmp dword [ebp - 0x787c], 0xffffffff
je 0x300877fe
push dword [ebp - 0x787c]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x7870]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.300023ac
leave
ret