Function at 0x401fd0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40dacb
mov eax, dword fs:[0]
push eax
sub esp, 0x660
mov eax, dword [0x41207c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push 2
mov dword [ebp - 0x664], eax
mov dword [ebp - 0x660], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x65c], esi
cmp esi, 0xffffffff
je 0x402048
lea ecx, [ebp - 0x658]
push ecx
push esi
mov dword [ebp - 0x658], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x402050
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x402239
xor edx, edx
lea eax, [ebp - 0x634]
mov word [ebp - 0x42c], dx
mov dword [ebp - 0x418], 7
mov dword [ebp - 0x41c], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402072
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x634]
lea esi, [ebp - 0x42c]
call fcn.00403780
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x418]
mov esi, dword [ebp - 0x42c]
mov eax, esi
cmp ecx, 8
jae 0x402133
lea eax, [ebp - 0x42c]
mov ebx, eax
mov edi, dword [ebp - 0x41c]
lea ebx, [ebx + edi*2]
cmp ecx, 8
jae 0x4020c9
lea esi, [ebp - 0x42c]
cmp esi, ebx
je 0x4020f4
mov edi, eax
sub edi, esi
movzx eax, word [esi]
push eax
call fcn.00404f95
mov word [edi + esi], ax
add esi, 2
add esp, 4
cmp esi, ebx
jne 0x4020d1
mov edi, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0x418]
mov edx, edi
cmp edi, 0xc
jb 0x402100
mov edx, 0xc
cmp ecx, 8
mov ecx, dword [ebp - 0x42c]
jae 0x402111
lea ecx, [ebp - 0x42c]
mov eax, str.POWERPNT.EXE
test edx, edx
je 0x402142
lea ebx, [ebx]
mov si, word [ecx]
cmp si, word [eax]
jne 0x40213a
add ecx, 2
add eax, 2
dec edx
jne 0x402120
jmp 0x402142
mov ebx, esi
jmp 0x4020b5
sbb eax, eax
and eax, 0xfffffffe
inc eax
jne 0x402154
cmp edi, 0xc
jae 0x40214c
or eax, 0xffffffff
jmp 0x402154
xor eax, eax
cmp edi, 0xc
setne al
test eax, eax
sete al
test al, al
jne 0x40219f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x418], 8
jb 0x40217c
mov edx, dword [ebp - 0x42c]
push edx
call fcn.004044b8
add esp, 4
mov ecx, dword [ebp - 0x65c]
lea eax, [ebp - 0x658]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x402226
xor edi, edi
jmp 0x402050
mov edx, dword [ebp - 0x650]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40220e
lea eax, [ebp - 0x66c]
push eax
push 4
lea ecx, [ebp - 0x668]
push ecx
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40220e
mov eax, dword [ebp - 0x668]
push 0x200
lea edx, [ebp - 0x410]
push edx
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x40220e
mov ecx, dword [ebp - 0x664]
push ecx
lea eax, [ebp - 0x410]
call fcn.00402ad0
mov dword [ebp - 0x660], 1
cmp dword [ebp - 0x418], 8
jb 0x402226
mov edx, dword [ebp - 0x42c]
push edx
call fcn.004044b8
add esp, 4
mov eax, dword [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x660]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004042bb
mov esp, ebp
pop ebp
ret