Function at 0x4152d0
Capabilities:
Enumerate processes
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x43d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x44c], 0x104
mov dword [ebp - 0x450], 0
mov dword [ebp - 0xc], 0x6c6c754e
mov dword [ebp - 8], 0x74666f73
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov ebx, eax
lea eax, [ebp - 0x444]
push 0
push eax
call fcn.00418c40
add esp, 0xc
mov dword [ebp - 0x448], 0x22c
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4155db
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x41537a
cmp dword [ebp - 0x440], ebx
je 0x415374
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x415358
jmp 0x41537a
mov edi, dword [ebp - 0x430]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4155db
push edi
push ebx
push str.id_u__u
call fcn.0040f530
add esp, 0xc
push edi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4153bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Failed_to_OpenProcess_for__u__u
jmp 0x4155e8
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x4153ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Failed_to_QueryFullProcessImageName_for__u__u
jmp 0x4155e8
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
lea eax, [ebp - 0x218]
push eax
push str.PPath:__ls_
call fcn.0040f530
add esp, 8
lea eax, [ebp - 0x218]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x45c], esi
cmp esi, 0xffffffff
jne 0x41545c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_file__u
call fcn.0040f530
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417710
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
shr eax, 0xa
push eax
push ecx
push str.PSize:__u__uKB_
mov dword [ebp - 0x44c], ecx
call fcn.0040f530
add esp, 0xc
cmp dword [ebp - 0x44c], 0x800000
jb 0x4155a2
push 0x100000
call fcn.0041c36a
mov ebx, eax
add esp, 4
mov dword [ebp - 0x450], ebx
test ebx, ebx
je 0x4155a2
push 0
lea eax, [ebp - 0x44c]
push eax
push 0x100000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41550d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_readfile__u
call fcn.0040f530
push 0
push str.Lunch_main_process__d
call fcn.0040f530
add esp, 0x10
push esi
call edi
mov eax, dword [ebp - 0x450]
xor ebx, ebx
push eax
call fcn.0041bffb
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417710
mov esp, ebp
pop ebp
ret
mov edi, 0x10
mov esi, ebx
sub edi, ebx
xor ebx, ebx
mov dword [ebp - 0x454], edi
nop
test ebx, ebx
jne 0x415594
cmp dword [esi], 0x6d783f3c
jne 0x415587
cmp dword [esi + 4], 0x6576206c
jne 0x415587
xor edx, edx
mov eax, esi
nop dword [eax]
lea ecx, [edi + eax]
cmp ecx, 0x100000
jge 0x415587
mov ecx, dword [eax]
lea edi, [ebp - 0xc]
cmp ecx, dword [edi]
mov edi, dword [ebp - 0x454]
jne 0x41556b
mov ecx, dword [eax + 4]
lea edi, [ebp - 0xc]
cmp ecx, dword [edi + 4]
mov edi, dword [ebp - 0x454]
je 0x415577
inc edx
inc eax
cmp edx, 0x400
jl 0x415540
jmp 0x415587
mov dword [ebp - 0x458], 1
mov ebx, dword [ebp - 0x458]
add esi, 0x10
lea eax, [esi + edi]
cmp eax, 0x100000
jl 0x415520
mov esi, dword [ebp - 0x45c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4155a4
xor ebx, ebx
push ebx
push str.Lunch_main_process__d
call fcn.0040f530
add esp, 8
push esi
call edi
mov eax, dword [ebp - 0x450]
test eax, eax
je 0x4155c8
push eax
call fcn.0041bffb
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417710
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.Failed_to_get_parent_process_id_for__u__u
call fcn.0040f530
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00417710
mov esp, ebp
pop ebp
ret