Function at 0x403560
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov byte [ebp - 0x150], 0
xor eax, eax
mov dword [ebp - 0x14f], eax
mov dword [ebp - 0x14b], eax
mov dword [ebp - 0x147], eax
mov dword [ebp - 0x143], eax
mov dword [ebp - 0x13f], eax
mov dword [ebp - 0x13b], eax
mov dword [ebp - 0x137], eax
mov word [ebp - 0x133], ax
mov byte [ebp - 0x131], al
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
jne 0x4035f8
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
xor al, al
jmp 0x403aaf
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov dword [ebp - 0x130], 0x128
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x154]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x403675
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x403aaf
mov dword [ebp - 0x15c], 0
mov dword [ebp - 4], 0
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00403410
add esp, 4
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov dword [ebp - 0x15c], str.1__teaqptv_cvc
mov edx, dword [ebp - 0x15c]
movsx eax, byte [edx]
test eax, eax
je 0x403a3d
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov ecx, dword [ebp - 0x15c]
add ecx, 2
mov dword [ebp - 0x178], ecx
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
lea edx, [ebp - 0x150]
test edx, edx
je 0x403732
cmp dword [ebp - 0x178], 0
jne 0x40374f
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
jmp 0x403808
mov dword [ebp - 0x174], 0
jmp 0x40376a
mov eax, dword [ebp - 0x174]
add eax, 1
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x178]
add ecx, dword [ebp - 0x174]
movsx edx, byte [ecx]
test edx, edx
je 0x4037ca
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov eax, dword [ebp - 0x178]
add eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x174]
mov dl, byte [eax]
mov byte [ebp + ecx - 0x150], dl
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
jmp 0x40375b
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov eax, dword [ebp - 0x174]
mov byte [ebp + eax - 0x150], 0
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x17c], ecx
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov edx, dword [ebp - 0x17c]
movsx eax, byte [edx]
test eax, eax
jne 0x403897
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov ecx, dword [ebp - 0x17c]
lea edx, [ebp - 0x150]
sub ecx, edx
mov dword [ebp - 0x180], ecx
jmp 0x4038c0
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov eax, dword [ebp - 0x17c]
add eax, 1
mov dword [ebp - 0x17c], eax
jmp 0x403844
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x158], ecx
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov dword [ebp - 0x160], 0
jmp 0x4038ff
mov edx, dword [ebp - 0x160]
add edx, 1
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x158]
jge 0x40392d
mov ecx, dword [ebp - 0x160]
movsx edx, byte [ebp + ecx - 0x150]
add edx, 2
mov eax, dword [ebp - 0x160]
mov byte [ebp + eax - 0x150], dl
jmp 0x4038f0
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x10c]
push edx
call fcn.00407c48
add esp, 8
test eax, eax
jne 0x403984
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov eax, dword [ebp - 0x15c]
mov al, byte [eax]
jmp 0x403aaf
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x184], ecx
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
jne 0x4039f9
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov ecx, dword [ebp - 0x184]
sub ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x188], ecx
jmp 0x403a22
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov edx, dword [ebp - 0x184]
add edx, 1
mov dword [ebp - 0x184], edx
jmp 0x4039a8
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x15c]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x15c], edx
jmp 0x4036cf
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x154]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403686
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 0x74
mov al, 0xfc
mov al, 0xf3
mov al, 0xf4
mov al, 0x37
mov al, 0x75
mov al, 0x88
mov al, 0x47
mov al, 0xc7
mov al, 0x86
mov al, 0x48
mov al, 0x9f
xor al, al
mov esp, ebp
pop ebp
ret