Function at 0x4032c7
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
push 0x28
call fcn.0041a90a
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
add ebx, 0x24
push ebx
push 0x108
call fcn.0041a90a
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x42f498
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40334c
push 6
call fcn.0041a910
add esp, 4
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x40336f
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x40336b
imul eax, dword [ebx]
jmp 0x403360
mov ecx, eax
test ecx, ecx
je 0x40339a
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
add ebx, 0x24
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.0041a904
add esp, 4
pop ebx
call fcn.0041a904
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x403375
call fcn.0041a904
add esp, 4
mov eax, 0x42f484
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
je 0x40386b
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0x128
mov dword [ebp - 0x10], esp
mov eax, dword [ebp - 8]
push eax
push 0x124
call fcn.0041a90a
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop ebx
add ebx, 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Process32First]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x403472
push 6
call fcn.0041a910
add esp, 4
push eax
mov ebx, dword [ebp - 0x14]
push ebx
mov edi, dword [ebp - 0x18]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
push edi
push 1
mov eax, 2
call fcn.0041ab20
add esp, 4
pop edi
pop ebx
push ebx
push edi
mov edi, dword [edi]
mov ecx, dword [edi]
add edi, 4
test ecx, ecx
je 0x403503
mov eax, dword [edi]
add edi, 4
dec ecx
je 0x403501
imul eax, dword [edi]
jmp 0x4034f6
mov ecx, eax
cmp ecx, 0x100
jle 0x403510
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop ebx
add edi, 4
add ebx, 0x100
call fcn.0041a904
add esp, 4
pop eax
test eax, eax
je 0x403849
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.0040328e
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x42f490]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00402dec
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0xc]
cmp eax, 0
jge 0x403576
push 0xa
call fcn.0041a910
add esp, 4
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
call fcn.004032a7
push ecx
shl ecx, 2
add ecx, 8
push ecx
call fcn.0041a90a
add esp, 4
mov edi, eax
mov dword [edi], 1
add edi, 4
pop ecx
push eax
push ecx
lea esi, [ebp - 0x10]
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.004032a7
pop edx
mov eax, ecx
cmp ecx, edx
jle 0x4035b7
mov ecx, edx
sub eax, ecx
sub edx, ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ebx, esi
mov ecx, eax
test ecx, ecx
je 0x4035f4
push edi
push edx
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
add ebx, 0x24
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.0041a904
add esp, 4
pop ebx
call fcn.0041a904
add esp, 4
pop ebx
pop ecx
add ebx, 4
dec ecx
jne 0x4035cd
pop edx
pop edi
test edx, edx
je 0x40364e
mov ebx, edi
push edx
push ebx
push 0x28
call fcn.0041a90a
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
add ebx, 0x24
push ebx
push 0x108
call fcn.0041a90a
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x42f498
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
pop ebx
pop edx
add ebx, 4
dec edx
jne 0x4035fe
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.0041a904
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov ecx, dword [ebx]
inc ecx
shl ecx, 2
add ebx, ecx
push ebx
mov eax, dword [ebp - 0xc]
dec eax
pop ebx
shl eax, 2
add ebx, eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 8]
push eax
push 0x28
call fcn.0041a90a
add esp, 4
pop esi
mov edi, eax
push eax
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
push esi
push edi
push eax
push eax
mov ebx, eax
call fcn.004032a7
pop eax
sub ebx, eax
add ecx, ebx
push ecx
call fcn.0041a90a
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
pop eax
push eax
mov ebx, dword [ebp - 0x10]
mov ebx, dword [ebx]
push ebx
add ebx, 0x24
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.0041a904
add esp, 4
pop ebx
call fcn.0041a904
add esp, 4
pop eax
mov ebx, dword [ebp - 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x14], esp
mov eax, dword [ebp - 8]
push eax
push 0x124
call fcn.0041a90a
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop ebx
add ebx, 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Process32Next]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40378b
push 6
call fcn.0041a910
add esp, 4
push eax
mov ebx, dword [ebp - 0x18]
push ebx
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
push edi
push 1
mov eax, 2
call fcn.0041ab20
add esp, 4
pop edi
pop ebx
push ebx
push edi
mov edi, dword [edi]
mov ecx, dword [edi]
add edi, 4
test ecx, ecx
je 0x40381c
mov eax, dword [edi]
add edi, 4
dec ecx
je 0x40381a
imul eax, dword [edi]
jmp 0x40380f
mov ecx, eax
cmp ecx, 0x100
jle 0x403829
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop ebx
add edi, 4
add ebx, 0x100
call fcn.0041a904
add esp, 4
pop eax
test eax, eax
jne 0x403530
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40386b
push 6
call fcn.0041a910
add esp, 4
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.0040328e
jmp 0x40387a
push eax
mov ebx, dword [ebp - 8]
push ebx
add ebx, 0x24
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.0041a904
add esp, 4
pop ebx
call fcn.0041a904
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4