Function at 0x432160
Capabilities:
Enumerate processes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x441004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x228
xor esi, esi
mov dword [ebp - 0x244], edx
lea eax, [ebp - 0x234]
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x250], edi
push esi
push eax
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x248], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x244]
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
mov dword [eax], ebx
cmp dword [0x441604], ebx
je 0x4321d7
push edi
push 0x42be68
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x10
push 0
push 2
call dword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x24c], eax
cmp eax, 0xffffffff
jne 0x43227b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x432205
movzx ebx, bx
or ebx, 0x80070000
lea edx, [ebp - 0x23c]
mov dword [ebp - 0x23c], esi
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], esi
je 0x43266c
push 0x42be90
push dword [ebp - 0x23c]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], esi
je 0x43266c
push 0x281
push 0x42b744
push 0x42b77c
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ffc0
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x238]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_Process32FirstW]
test eax, eax
jne 0x43230a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x4322a2
movzx ebx, bx
or ebx, 0x80070000
lea edx, [ebp - 0x23c]
mov dword [ebp - 0x23c], esi
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], esi
je 0x43264c
push 0x42beb4
push dword [ebp - 0x23c]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], esi
je 0x43264c
push 0x283
push 0x42b744
push 0x42b77c
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x14
jmp 0x43264c
mov dword [ebp - 0x23c], ebx
mov edi, 1
cmp dword [0x441604], ebx
je 0x43233b
push dword [ebp - 0x230]
lea eax, [ebp - 0x214]
push eax
push 0x42bed8
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x250]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4323d9
cmp dword [0x441604], ebx
je 0x432372
push 0x42bef8
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0xc
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x248], esi
jb 0x4323b4
cmp edi, esi
jbe 0x4323b4
cmp dword [ebp - 0x240], ebx
jne 0x43246a
push 4
push edi
call dword [sym.imp.msvcrt.dll_calloc]
mov esi, eax
add esp, 8
mov dword [ebp - 0x240], esi
test esi, esi
je 0x43267f
mov esi, edi
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x23c]
inc edi
mov edx, dword [ebp - 0x258]
inc dword [ebp - 0x248]
mov dword [ecx + eax], edx
add ecx, 4
mov dword [ebp - 0x23c], ecx
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x24c]
call dword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_Process32NextW]
test eax, eax
jne 0x432315
mov edi, dword [ebp - 0x248]
test edi, edi
jne 0x4324d9
push 0x42bf10
push 0xc
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0xc
mov dword [ebp - 0x23c], edi
mov ebx, 0x80070002
lea edx, [ebp - 0x23c]
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], edi
je 0x43264c
push 0x42bf24
push dword [ebp - 0x23c]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], edi
je 0x43264c
push 0x294
jmp 0x4322ef
mov eax, esi
mov ecx, edi
shr eax, 1
sub ecx, esi
cmp ecx, eax
jbe 0x432478
mov eax, ecx
add esi, eax
cmp edi, esi
jb 0x432480
mov esi, edi
push 4
push esi
call dword [sym.imp.msvcrt.dll_calloc]
add esp, 8
mov dword [ebp - 0x254], eax
test eax, eax
je 0x43267f
mov ecx, dword [ebp - 0x23c]
push ecx
push dword [ebp - 0x240]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_memmove_s]
add esp, 0x10
mov ecx, eax
call fcn.00434eb0
push dword [ebp - 0x240]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x254]
add esp, 4
mov dword [ebp - 0x240], eax
jmp 0x4323ba
cmp edi, 1
jbe 0x432638
mov eax, dword [0x441180]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4422c4]
mov ecx, 0x441180
call esi
add eax, 0x10
xor ebx, ebx
mov dword [ebp - 0x244], eax
mov eax, dword [0x441180]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4422c4]
mov ecx, 0x441180
call esi
add eax, 0x10
mov dword [ebp - 0x23c], eax
cmp ebx, edi
jae 0x432689
mov eax, dword [ebp - 0x240]
push dword [eax + ebx*4]
lea eax, [ebp - 0x23c]
push 0x42bf40
push eax
call fcn.00434420
add esp, 0xc
lea eax, [ebp - 0x23c]
lea ecx, [ebp - 0x244]
push eax
call fcn.00433980
mov ecx, dword [ebp - 0x23c]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x43258b
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4422c4]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x248]
inc ebx
cmp ebx, edi
jb 0x432504
mov esi, dword [ebp - 0x244]
push esi
push 0x42bf48
push 0xc
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x10
mov dword [ebp - 0x244], 0
mov ebx, 0x80070057
lea edx, [ebp - 0x244]
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], 0
je 0x432612
push 0x42bfa4
push dword [ebp - 0x244]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x432612
push 0x2a1
push 0x42b744
push 0x42b77c
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x14
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43264c
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4422c4]
mov ecx, edi
call esi
jmp 0x43264c
test edi, edi
je 0x432689
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x244]
mov eax, dword [eax]
mov dword [ecx], eax
push dword [ebp - 0x24c]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x43266c
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ffc0
mov esp, ebp
pop ebp
ret
mov ecx, 0x8007000e
call fcn.00435870
mov ecx, 0x80070057
call fcn.00435870
int3