Function at 0x4088b0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4349d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x154
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x24], esi
je 0x408b88
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], 0x128
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x38], eax
mov al, byte [esp + 0x13]
push ebx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2c], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov cl, byte [esp + 0x13]
mov dword [esp + 0x16c], ebx
mov byte [esp + 0x14], cl
push ebx
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea edx, [esp + 0x3c]
mov byte [esp + 0x16c], 1
push edx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x408b1a
lea edi, [esp + 0x60]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x2c]
push ebp
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x408993
mov edi, dword [esp + 0x2c]
mov ecx, ebp
mov eax, ecx
lea esi, [esp + 0x60]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Eos_unsigned_int_]
mov esi, dword [esp + 0x174]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x4089d8
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Eos_unsigned_int_]
cmp dword [esp + 0x178], ebx
je 0x408a4e
mov ebp, dword [esp + 0x18]
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
cmp ebp, ebx
mov esi, eax
je 0x4089f2
mov esi, ebp
mov edi, dword [esp + 0x2c]
cmp edi, ebx
je 0x4089fc
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x408a20
cmp cl, bl
je 0x408a1c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x408a20
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4089fc
xor eax, eax
jmp 0x408a25
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ebx
sete cl
mov eax, ecx
cmp eax, ebx
jne 0x408aa4
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x3c]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x408b16
jmp 0x40894f
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x44]
cmp eax, edx
je 0x408a32
mov ebp, dword [esp + 0x18]
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
cmp ebp, ebx
mov esi, eax
je 0x408a6b
mov esi, ebp
mov edi, dword [esp + 0x2c]
cmp edi, ebx
je 0x408a75
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x408a99
cmp cl, bl
je 0x408a95
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x408a99
add eax, 2
add esi, 2
cmp cl, bl
jne 0x408a75
xor eax, eax
jmp 0x408a9e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x408aa4
jmp 0x408a32
cmp ebp, ebx
mov byte [esp + 0x16c], bl
je 0x408ad0
mov al, byte [ebp - 1]
lea ecx, [ebp - 1]
cmp al, bl
je 0x408ac3
cmp al, 0xff
je 0x408ac3
dec al
mov byte [ecx], al
jmp 0x408acc
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
cmp edi, ebx
mov dword [esp + 0x16c], 0xffffffff
je 0x408b0f
mov al, byte [edi - 1]
cmp al, bl
je 0x408b05
cmp al, 0xff
je 0x408b05
dec al
mov byte [edi - 1], al
mov eax, 1
jmp 0x408b8a
dec edi
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 1
jmp 0x408b8a
mov esi, dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
mov byte [esp + 0x16c], bl
cmp eax, ebx
je 0x408b4d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x408b44
cmp al, 0xff
je 0x408b44
dec al
mov byte [ecx], al
jmp 0x408b4d
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
mov dword [esp + 0x16c], 0xffffffff
je 0x408b88
mov al, byte [ecx - 1]
cmp al, bl
je 0x408b7e
cmp al, 0xff
je 0x408b7e
dec al
mov byte [ecx - 1], al
jmp 0x408b88
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x160
ret