Function at 0x411f65
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x760
push ebx
push esi
push edi
lea edi, [ebp - 0x760]
mov ecx, 0x1d8
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x41f01c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xc], 0
and dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x228], ax
push 0x206
push 0
lea eax, [ebp - 0x226]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
and dword [ebp - 0x234], 0
mov esi, esp
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00413f7e
lea eax, [ebp - 0x228]
push eax
call fcn.00411a32
pop ecx
mov esi, esp
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp esi, esp
call fcn.00413f7e
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x41203d
mov esi, esp
push str.QueryFullProcessImageNameW
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00413f7e
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x41203d
mov eax, dword [ebp - 0xc]
jmp 0x4121c3
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
jne 0x41207b
cmp dword [ebp - 0x24c], 0
je 0x412073
mov esi, esp
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00413f7e
mov eax, dword [ebp - 0xc]
jmp 0x4121c3
mov dword [ebp - 0x480], 0x22c
lea eax, [ebp - 0x480]
push eax
push dword [ebp - 0x24c]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4120c1
cmp dword [ebp - 0x24c], 0
je 0x4120b9
mov esi, esp
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00413f7e
mov eax, dword [ebp - 0xc]
jmp 0x4121c3
xor eax, eax
mov word [ebp - 0x690], ax
push 0x206
push 0
lea eax, [ebp - 0x68e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x69c], 0x104
and dword [ebp - 0x18], 0
mov esi, esp
push dword [ebp - 0x478]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.00413f7e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x412135
mov esi, esp
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x690]
push eax
push 0
push dword [ebp - 0x18]
call dword [ebp - 0x234]
cmp esi, esp
call fcn.00413f7e
lea eax, [ebp - 0x690]
push eax
call fcn.00411a32
pop ecx
mov esi, esp
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x690]
push eax
call dword [sym.imp.MSVCR120.dll__wcsicmp]
pop ecx
pop ecx
cmp esi, esp
call fcn.00413f7e
test eax, eax
jne 0x412170
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xc], eax
jmp 0x41218a
lea eax, [ebp - 0x480]
push eax
push dword [ebp - 0x24c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4120c1
cmp dword [ebp - 0x24c], 0
je 0x4121a8
mov esi, esp
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00413f7e
cmp dword [ebp - 0x18], 0
je 0x4121c0
mov esi, esp
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00413f7e
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x4121f5]
call fcn.00413f26
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413fa1
add esp, 0x760
cmp ebp, esp
call fcn.00413f7e
mov esp, ebp
pop ebp
ret