Function at 0x40e3b0
Capabilities:
Enumerate processes
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x48bcb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x674
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x276]
mov word [esp + 0x274], bx
mov word [esp + 0x47c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x47e]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x17]
stosw word es:[edi], ax
mov al, byte [esp + 0x17]
mov byte [esp + 0x1d], cl
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c], al
call fcn.004113c0
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x30]
push eax
mov dword [esp + 0x690], ebx
mov ecx, dword [eax]
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.004103d0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ebp, ebp
xor esi, esi
push esi
push 0x4b0b98
lea eax, [esp + 0x484]
push 0x208
push eax
call fcn.0040c760
lea ecx, [esp + 0x28]
push ecx
call fcn.0040e770
mov eax, dword [eax]
add esp, 0x14
lea edx, [esp + 0x274]
push eax
push 0x104
push edx
lea eax, [esp + 0x488]
push 0x4b9760
push eax
push str.rname
call edi
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString
cmp word [esp + 0x274], bx
je 0x40e54b
lea ecx, [esp + 0x274]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::CString_2
push str..exe
lea ecx, [esp + 0x14]
mov byte [esp + 0x690], 1
call fcn.0043613e
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::MakeLower
lea edx, [esp + 0x10]
lea ecx, [esp + 0x30]
push edx
call fcn.00436102
lea eax, [esp + 0x10]
lea ecx, [esp + 0x34]
push eax
mov byte [esp + 0x690], 2
call fcn.00436102
lea ecx, [esp + 0x30]
lea edx, [esp + 0x40]
push ecx
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x694], 3
call fcn.00410180
lea ecx, [esp + 0x34]
mov byte [esp + 0x68c], 4
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x68c], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
inc ebp
mov byte [esp + 0x68c], bl
call sub.MFC42u.DLL_CString::CString
inc esi
cmp esi, 0x18
jl 0x40e449
cmp ebp, ebx
jne 0x40e5a4
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x694], 0xffffffff
call fcn.0045c380
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.004103d0
mov eax, dword [esp + 0x20]
push eax
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], ebx
push ecx
jmp 0x40e749
lea ecx, [esp + 0x38]
call fcn.00422430
push ebx
push 2
mov byte [esp + 0x694], 5
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40e701
lea edx, [esp + 0x48]
mov ecx, 0x8a
xor eax, eax
lea edi, [esp + 0x4c]
push edx
push ebp
rep stosd dword es:[edi], eax
mov dword [esp + 0x50], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x40e6fa
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x68c], 6
call sub.MFC42u.DLL_CString::MakeLower
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.004020c0
add esp, 8
lea edx, [esp + 0x10]
mov byte [esp + 0x68c], 7
push edx
push eax
lea eax, [esp + 0x20]
push eax
call sub.MFC42u.DLL_operator_1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x68c], 9
call sub.MFC42u.DLL_CString::CString
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x20]
call fcn.00411720
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], eax
cmp eax, ecx
je 0x40e682
mov eax, dword [eax + 0xc]
mov edx, dword [esp + 0x10]
push eax
push edx
call edi
add esp, 8
cmp eax, ebx
jl 0x40e682
lea eax, [esp + 0x40]
jmp 0x40e68e
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
cmp dword [eax], esi
je 0x40e6c3
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call fcn.00436102
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x3c]
push eax
call fcn.00422750
cmp eax, ebx
je 0x40e6c3
mov ecx, dword [esp + 0x50]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00422700
lea edx, [esp + 0x48]
push edx
push ebp
call sub.KERNEL32.dll_Process32NextW
lea ecx, [esp + 0x18]
mov esi, eax
mov byte [esp + 0x68c], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x68c], 5
call sub.MFC42u.DLL_CString::CString
cmp esi, ebx
jne 0x40e5f6
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x38]
mov byte [esp + 0x68c], bl
call fcn.00422460
mov eax, dword [esp + 0x20]
mov dword [esp + 0x68c], 0xffffffff
push eax
mov ecx, dword [eax]
lea eax, [esp + 0x40]
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.004103d0
mov ecx, dword [esp + 0x20]
push ecx
call sub.MFC42u.DLL_operatordelete
mov edx, dword [esp + 0x28]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], ebx
push edx
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [esp + 0x68c]
add esp, 8
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x680
ret