Function at 0x401710
Capabilities:
Enumerate process modules
Enumerate processes
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c8
mov eax, dword [0x423680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x48]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
push ebx
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 0x6b8], esi
push esi
push dword [eax + 8]
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x48], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [ebp - 0x6b4]
test eax, eax
je 0x401c33
nop dword [eax]
add ebx, dword [ebp - 0x48]
mov dword [ebp - 0x6c4], ebx
cmp ebx, 0xc
jb 0x401c0b
xor edx, edx
lea eax, [esi + edx]
mov edi, 0x5786
cmp word [eax + 2], di
je 0x4017a9
lea ecx, [edx + 0xc]
cmp ecx, ebx
ja 0x4017a9
mov esi, 0xc
sub esi, dword [ebp - 0x6b8]
inc eax
inc edx
cmp word [eax + 2], di
je 0x4017a3
lea ecx, [esi + eax]
cmp ecx, ebx
jbe 0x401794
mov esi, dword [ebp - 0x6b8]
mov ecx, dword [eax + 8]
lea edi, [edx + 0xc]
and ecx, 0xffffff
add edi, ecx
mov dword [ebp - 0x6c8], edi
cmp edi, ebx
ja 0x401965
movzx eax, word [eax]
cmp eax, 0x3fb
ja 0x4018bf
je 0x40184b
mov edi, dword [ebp - 0x6b4]
cmp eax, 0x22
jne 0x401947
mov ax, word [esi]
xorps xmm0, xmm0
mov word [ebp - 0x44], ax
mov eax, 0x5786
mov word [ebp - 0x42], ax
movlpd qword [ebp - 0x3c], xmm0
mov eax, dword [ebp - 0x3c]
and eax, 0x2000000
movlpd qword [ebp - 0x34], xmm0
or eax, 0x1000000
movlpd qword [ebp - 0x2c], xmm0
push 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x4c]
push eax
push 0xc
lea eax, [ebp - 0x44]
movlpd qword [ebp - 0x24], xmm0
push eax
push dword [edi + 8]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x40], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x401947
push dword [esi + 0xc]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x401865
xor edi, edi
jmp 0x40187c
push 0x424264
push esi
call fcn.004037c0
add esp, 8
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x6b8]
push 0
mov eax, dword [esi + 8]
and eax, 0x2000000
mov dword [esi], 0x578603fb
or eax, 0x1000004
mov dword [esi + 4], 0
mov dword [esi + 8], eax
lea eax, [ebp - 0x50]
push eax
mov dword [esi + 0xc], edi
mov edi, dword [ebp - 0x6b4]
push 0x10
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x401947
sub eax, 0x3fc
cmp eax, 5
ja case.0x4018c9.1021
jmp dword [eax*4 + 0x401c58]
mov ax, word [esi]
xor ecx, ecx
mov edi, dword [ebp - 0x6b4]
xorps xmm0, xmm0
mov word [ebp - 0x44], ax
mov eax, 0x5786
mov word [ebp - 0x42], ax
mov eax, dword [0x424230]
push 0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x54]
push eax
push 0x10
mov dword [ebp - 0x40], ecx
lea eax, [ebp - 0x44]
and ecx, 0x2000000
movlpd qword [ebp - 0x34], xmm0
push eax
push dword [edi + 8]
or ecx, 0x1000004
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x401947
or dword [0x424010], 1
mov edi, dword [ebp - 0x6b4]
test byte [0x424010], 1
mov edx, dword [ebp - 0x6c8]
jne 0x401c3c
lea eax, [edx + 0xc]
cmp eax, ebx
jbe 0x401774
cmp edx, ebx
jae 0x401c03
test edx, edx
je 0x401c05
sub ebx, edx
lea eax, [esi + edx]
push ebx
push eax
push esi
call fcn.004068e0
add esp, 0xc
jmp 0x401c05
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x6c0], eax
cmp eax, 0xffffffff
je case.0x4018c9.1021
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x288], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x401b09
push 0x800
call fcn.00408de7
mov edi, eax
add esp, 4
mov dword [ebp - 0x6bc], edi
test edi, edi
je 0x401b09
push 0x800
push 0
push edi
call fcn.00406780
mov cx, word [esi]
mov eax, 0x5786
mov word [edi + 2], ax
add esp, 0xc
mov word [edi], cx
mov ebx, 0xc
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [edi + 8]
and eax, 0x2000000
or eax, 0x1000000
mov dword [edi + 8], eax
push dword [ebp - 0x280]
xor edi, edi
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x401a4c
lea eax, [ebp - 0x6b0]
mov dword [ebp - 0x6b0], 0x428
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x401ab3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x6bc]
lea eax, [ebp - 0x288]
push eax
push dword [ebp - 0x6c0]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401a14
mov edi, dword [ebp - 0x6b4]
lea ecx, [ebx - 0xc]
xor ecx, dword [esi + 8]
push eax
lea eax, [ebp - 0x58]
and ecx, 0xffffff
xor dword [esi + 8], ecx
push eax
push ebx
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.00408dcc
mov ebx, dword [ebp - 0x6c4]
add esp, 4
push dword [ebp - 0x6c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x6b8]
jmp 0x401947
lea eax, [ebp - 0x690]
push 0x41b378
push eax
call fcn.00408ef0
add esp, 8
test eax, eax
je 0x401ade
lea eax, [ebp - 0x6b0]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x401ab3
jmp 0x401ae3
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x401a4c
mov esi, dword [ebp - 0x6bc]
mov eax, dword [ebp - 0x280]
mov dword [ebx + esi], eax
add ebx, 4
jmp 0x401a52
push dword [ebp - 0x6c0]
mov edi, dword [ebp - 0x6b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x6b8]
jmp 0x401947
mov ecx, dword [ebp - 0x6b8]
xorps xmm0, xmm0
mov edi, dword [ebp - 0x6b4]
mov esi, dword [esi + 0xc]
movlpd qword [ebp - 0x3c], xmm0
mov ax, word [ecx]
mov word [ebp - 0x44], ax
mov eax, 0x5786
mov word [ebp - 0x42], ax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
and eax, 0x2000000
movlpd qword [ebp - 0x34], xmm0
or eax, 0x1000000
movlpd qword [ebp - 0x2c], xmm0
push 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x5c]
push eax
push 0xc
lea eax, [ebp - 0x44]
movlpd qword [ebp - 0x24], xmm0
push eax
push dword [edi + 8]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x401bdd
mov eax, dword [0x424010]
test al, 2
jne 0x401bd2
test al, 0x10
jne 0x401bbd
mov eax, dword [0x424228]
test eax, eax
je 0x401bbd
cmp dword [0x424234], 0
jne 0x401bbd
push 0
call eax
mov eax, dword [0x424010]
and esi, 1
add esi, esi
and eax, 0xfffffffd
or esi, eax
mov dword [0x424010], esi
mov esi, dword [ebp - 0x6b8]
jmp 0x401947
test byte [0x424010], 2
je 0x401bd2
mov eax, dword [0x42422c]
test eax, eax
je 0x401bf1
call eax
and dword [0x424010], 0xfffffffd
mov esi, dword [ebp - 0x6b8]
jmp 0x401947
xor ebx, ebx
mov edi, dword [ebp - 0x6b4]
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0
push eax
mov eax, dword [ebp + 0x10]
sub eax, ebx
push eax
lea eax, [esi + ebx]
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401760
push edi
call fcn.00401670
add esp, 4
push edi
call fcn.00401670
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004056d3
mov esp, ebp
pop ebp
ret