Function at 0x401e12
Capabilities:
Enumerate processes
Enumerate services
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x404784]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
jne 0x401e33
push str.Syntax_error__tUsage:_tlist___p_s_d__r_n
jmp 0x401f5a
mov esi, dword [sym.imp.MSVCRT.dll__strcmpi]
push eax
push 0x404360
call esi
pop ecx
test eax, eax
pop ecx
jne 0x401ef6
mov edi, 0x128
lea eax, [ebp - 0x240]
push edi
push ebx
push eax
call sub.MSVCRT.dll_memset
mov esi, 0x224
lea eax, [ebp - 0x464]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
push ebx
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401e8d
push str.list_process_failed__r_n
jmp 0x401f5a
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], edi
push eax
push ebx
mov dword [ebp - 0x464], esi
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x401eea
push dword [ebp - 0x238]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push str.__26s__5d_r_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
add esp, 0x18
lea eax, [ebp - 0x240]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
jmp 0x401ea6
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40212d
push dword [0x404784]
push 0x404338
call esi
pop ecx
test eax, eax
pop ecx
jne 0x401fd0
push 4
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x401f55
push ebx
lea ecx, [ebp - 8]
push ebx
push ecx
lea ecx, [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExA]
push ecx
push ebx
push ebx
push 1
push 0x30
push ebx
push eax
call esi
mov eax, dword [ebp - 0x18]
lea edi, [eax + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 0x10], eax
jne 0x401f69
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.list_service_failed__r_n
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x40212d
push ebx
lea ecx, [ebp - 8]
push ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
push edi
push eax
push 1
push 0x30
push ebx
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 8], ebx
jbe 0x401fb9
mov esi, dword [ebp - 0x10]
push dword [esi + 4]
lea eax, [ebp - 0x118]
push dword [esi]
push str.__24s__s_r_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
add esp, 0x18
inc ebx
add esi, 0x2c
cmp ebx, dword [ebp - 8]
jb 0x401f87
push dword [ebp - 0x10]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40212d
push dword [0x404784]
push 0x404310
call esi
pop ecx
test eax, eax
pop ecx
jne 0x40212d
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x118]
push str.Volume_on_this_computer:_r_nVolume_tType_t_tVolume_Name_r_n
push eax
mov byte [ebp - 1], 0x41
call esi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
push edi
call sub.MSVCRT.dll_strcat
add esp, 0x10
cmp dword [ebp - 8], ebx
je 0x40210c
test byte [ebp - 8], 1
je 0x402101
movsx eax, byte [ebp - 1]
push eax
lea eax, [ebp - 0x118]
push str._c:_t
push eax
call esi
lea eax, [ebp - 0x118]
push eax
push edi
call sub.MSVCRT.dll_strcat
mov al, byte [ebp - 1]
add esp, 0x14
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x14]
push 0x4042cc
push eax
mov byte [ebp - 0x13], bl
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
sub eax, ebx
je 0x4020b6
dec eax
je 0x4020af
dec eax
je 0x4020a8
dec eax
je 0x4020a1
dec eax
je 0x40209a
dec eax
je 0x402093
dec eax
jne 0x4020c3
push str.Ramdisk_t_t
jmp 0x4020bb
push str.CD_ROM_t_t
jmp 0x4020bb
push str.Remote_t_t
jmp 0x4020bb
push str.Fixed_t_t
jmp 0x4020bb
push str.Removeable_t_t
jmp 0x4020bb
push str.Invalid_t_t
jmp 0x4020bb
push str.Unkown_t_t
push edi
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push 0x105
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
je 0x4020f1
lea eax, [ebp - 0x220]
push eax
push edi
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x4040b4
push edi
call sub.MSVCRT.dll_strcat
inc dword [ebp - 0xc]
pop ecx
pop ecx
shr dword [ebp - 8], 1
inc byte [ebp - 1]
jmp 0x40201e
push dword [ebp - 0xc]
lea eax, [ebp - 0x118]
push str._r_nTotally__d_volumes_found._r_n
push eax
call esi
lea eax, [ebp - 0x118]
push eax
push edi
call sub.MSVCRT.dll_strcat
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret