Function at 0x41c8c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x448004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x44c], 0x104
mov dword [ebp - 0x450], 0
mov dword [ebp - 0xc], 0x6c6c754e
mov dword [ebp - 8], 0x74666f73
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov ebx, eax
lea eax, [ebp - 0x444]
push 0
push eax
call fcn.00420f90
add esp, 0xc
mov dword [ebp - 0x448], 0x22c
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x41cbcb
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x41c96a
cmp dword [ebp - 0x440], ebx
je 0x41c964
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41c948
jmp 0x41c96a
mov edi, dword [ebp - 0x430]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x41cbcb
push edi
push ebx
push str.id_u__u
call fcn.00414ac0
add esp, 0xc
push edi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41c9af
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Failed_to_OpenProcess_for__u__u
jmp 0x41cbd8
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x41c9dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Failed_to_QueryFullProcessImageName_for__u__u
jmp 0x41cbd8
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
lea eax, [ebp - 0x218]
push eax
push str.PPath:__ls_
call fcn.00414ac0
add esp, 8
lea eax, [ebp - 0x218]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x45c], esi
cmp esi, 0xffffffff
jne 0x41ca4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_file__u
call fcn.00414ac0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
shr eax, 0xa
push eax
push ecx
push str.PSize:__u__uKB_
mov dword [ebp - 0x44c], ecx
call fcn.00414ac0
add esp, 0xc
cmp dword [ebp - 0x44c], 0x800000
jb 0x41cb92
push 0x100000
call fcn.0042442e
mov ebx, eax
add esp, 4
mov dword [ebp - 0x450], ebx
test ebx, ebx
je 0x41cb92
push 0
lea eax, [ebp - 0x44c]
push eax
push 0x100000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41cafd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_readfile__u
call fcn.00414ac0
push 0
push str.Lunch_main_process__d
call fcn.00414ac0
add esp, 0x10
push esi
call edi
mov eax, dword [ebp - 0x450]
xor ebx, ebx
push eax
call fcn.0042422d
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
mov edi, 0x10
mov esi, ebx
sub edi, ebx
xor ebx, ebx
mov dword [ebp - 0x454], edi
nop
test ebx, ebx
jne 0x41cb84
cmp dword [esi], 0x6d783f3c
jne 0x41cb77
cmp dword [esi + 4], 0x6576206c
jne 0x41cb77
xor edx, edx
mov eax, esi
nop dword [eax]
lea ecx, [edi + eax]
cmp ecx, 0x100000
jge 0x41cb77
mov ecx, dword [eax]
lea edi, [ebp - 0xc]
cmp ecx, dword [edi]
mov edi, dword [ebp - 0x454]
jne 0x41cb5b
mov ecx, dword [eax + 4]
lea edi, [ebp - 0xc]
cmp ecx, dword [edi + 4]
mov edi, dword [ebp - 0x454]
je 0x41cb67
inc edx
inc eax
cmp edx, 0x400
jl 0x41cb30
jmp 0x41cb77
mov dword [ebp - 0x458], 1
mov ebx, dword [ebp - 0x458]
add esi, 0x10
lea eax, [esi + edi]
cmp eax, 0x100000
jl 0x41cb10
mov esi, dword [ebp - 0x45c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41cb94
xor ebx, ebx
push ebx
push str.Lunch_main_process__d
call fcn.00414ac0
add esp, 8
push esi
call edi
mov eax, dword [ebp - 0x450]
test eax, eax
je 0x41cbb8
push eax
call fcn.0042422d
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.Failed_to_get_parent_process_id_for__u__u
call fcn.00414ac0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret