Function at 0x401eb2
Capabilities:
Create thread
Enumerate processes
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401ef1
mov dword [esp], str.ERROR:_Failed_to_list_processes____possibly_in_a_debugger
call sym._puts
mov eax, 1
jmp 0x402251
mov dword [ebp - 0x148], 0x128
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32First_8
sub esp, 8
test eax, eax
sete al
test al, al
je 0x401f32
mov dword [esp], str.ERROR:_Failed_to_list_processes____possibly_in_a_debugger
call sym._puts
mov eax, 1
jmp 0x402251
mov eax, dword [0x41b020]
test eax, eax
je 0x401f4e
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.DEBUG:_Searching_for_process__s_n
call sym._printf
mov dword [ebp - 0xc], 0
mov eax, dword [0x41b020]
test eax, eax
je 0x401f77
lea eax, [ebp - 0x148]
add eax, 0x24
mov dword [esp + 4], eax
mov dword [esp], str.DEBUG:_Found_running_process__s_n
call sym._printf
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x148]
add eax, 0x24
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x401fb6
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.DEBUG:_Found_process__s_with_PID__d_n
call sym._printf
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32Next_8
sub esp, 8
test eax, eax
setne al
test al, al
jne 0x401f55
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
cmp dword [ebp - 0xc], 0
jne 0x40200e
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.WARNING:_Failed_to_find_process__s_n
call sym._printf
mov eax, 1
jmp 0x402251
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x402054
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.WARNING:_Cannot_access_process__d_n
call sym._printf
mov eax, 1
jmp 0x402251
mov dword [esp], 0x41867b
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40208b
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.WARNING:_Process__d_has_no_kernel32.dll_n
call sym._printf
mov eax, 1
jmp 0x402251
mov eax, dword [0x41b020]
test eax, eax
je 0x4020ae
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.DEBUG:_Injecting__d_bytes_of_code_into_process__d_n
call sym._printf
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x3000
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call eax
sub esp, 0x14
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40210c
call sym.lastError__
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.WARNING:_Cannot_allocate_memory_inside_process__d:__s_n
call sym._printf
mov eax, 1
jmp 0x402251
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x402168
call sym.lastError__
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.WARNING:_Cannot_write_to_memory_inside_process__d:__s_n
call sym._printf
mov eax, 1
jmp 0x402251
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call eax
sub esp, 0x1c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4021cf
call sym.lastError__
mov dword [esp + 4], eax
mov dword [esp], str.ERROR:_Failed_to_create_remote_thread:__s_n
call sym._printf
mov eax, 1
jmp 0x402251
mov eax, dword [0x41b020]
test eax, eax
je 0x4021f2
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], str.DEBUG:_CreateRemoteThread_done:_0x_x____d_n
call sym._printf
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
call eax
sub esp, 8
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.INFO:_Injection_into__s__PID__d__successful_n
call sym._printf
mov eax, 0
leave
ret