Function at 0x403d20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f434
mov eax, dword fs:[0]
push eax
sub esp, 0x4cc
mov eax, dword [0x455014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
xor eax, eax
movq qword [ebp - 0x1c], xmm0
push str.ResourceMonitor.exe
lea ecx, [ebp - 0x4d8]
mov dword [ebp - 0x4c8], 0
mov dword [ebp - 0x4c4], 7
mov word [ebp - 0x4d8], ax
call fcn.0040d400
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c0]
push 0xb
xor eax, eax
mov dword [ebp - 0x4b0], 0
push str.Perfmon.exe
mov dword [ebp - 0x4ac], 7
mov word [ebp - 0x4c0], ax
call fcn.0040d400
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4a8]
push 0xb
xor eax, eax
mov dword [ebp - 0x498], 0
push str.Procmon.exe
mov dword [ebp - 0x494], 7
mov word [ebp - 0x4a8], ax
call fcn.0040d400
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x490]
push 0xb
xor eax, eax
mov dword [ebp - 0x480], 0
push str.Procexp.exe
mov dword [ebp - 0x47c], 7
mov word [ebp - 0x490], ax
call fcn.0040d400
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x478]
push 0xc
xor eax, eax
mov dword [ebp - 0x468], 0
push str.Eventvwr.exe
mov dword [ebp - 0x464], 7
mov word [ebp - 0x478], ax
call fcn.0040d400
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x460]
push 0xd
xor eax, eax
mov dword [ebp - 0x450], 0
push str.Wireshark.exe
mov dword [ebp - 0x44c], 7
mov word [ebp - 0x460], ax
call fcn.0040d400
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x448]
push 0xb
xor eax, eax
mov dword [ebp - 0x438], 0
push str.Dbgview.exe
mov dword [ebp - 0x434], 7
mov word [ebp - 0x448], ax
call fcn.0040d400
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x430]
push 0xd
xor eax, eax
mov dword [ebp - 0x420], 0
push str.Procmon64.exe
mov dword [ebp - 0x41c], 7
mov word [ebp - 0x430], ax
call fcn.0040d400
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x418]
push 0xe
xor eax, eax
mov dword [ebp - 0x408], 0
push str.Procmon64a.exe
mov dword [ebp - 0x404], 7
mov word [ebp - 0x418], ax
call fcn.0040d400
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x400]
push 0xb
xor eax, eax
mov dword [ebp - 0x3f0], 0
push str.Tcpview.exe
mov dword [ebp - 0x3ec], 7
mov word [ebp - 0x400], ax
call fcn.0040d400
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3e8]
push 0x11
xor eax, eax
mov dword [ebp - 0x3d8], 0
push str.ProcessHacker.exe
mov dword [ebp - 0x3d4], 7
mov word [ebp - 0x3e8], ax
call fcn.0040d400
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3d0]
push 0x10
xor eax, eax
mov dword [ebp - 0x3c0], 0
push str.ProcessLasso.exe
mov dword [ebp - 0x3bc], 7
mov word [ebp - 0x3d0], ax
call fcn.0040d400
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3b8]
push 0xe
xor eax, eax
mov dword [ebp - 0x3a8], 0
push str.SmartSniff.exe
mov dword [ebp - 0x3a4], 7
mov word [ebp - 0x3b8], ax
call fcn.0040d400
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3a0]
push 0xe
xor eax, eax
mov dword [ebp - 0x390], 0
push str.CaptureBAT.exe
mov dword [ebp - 0x38c], 7
mov word [ebp - 0x3a0], ax
call fcn.0040d400
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x388]
push 0xb
xor eax, eax
mov dword [ebp - 0x378], 0
push str.Fiddler.exe
mov dword [ebp - 0x374], 7
mov word [ebp - 0x388], ax
call fcn.0040d400
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x370]
push 0xe
xor eax, eax
mov dword [ebp - 0x360], 0
push str.NetLimiter.exe
mov dword [ebp - 0x35c], 7
mov word [ebp - 0x370], ax
call fcn.0040d400
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x358]
push 0xc
xor eax, eax
mov dword [ebp - 0x348], 0
push str.ApateDNS.exe
mov dword [ebp - 0x344], 7
mov word [ebp - 0x358], ax
call fcn.0040d400
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x340]
push 0xa
xor eax, eax
mov dword [ebp - 0x330], 0
push str.WinHex.exe
mov dword [ebp - 0x32c], 7
mov word [ebp - 0x340], ax
call fcn.0040d400
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x328]
push 8
xor eax, eax
mov dword [ebp - 0x318], 0
push str.PEiD.exe
mov dword [ebp - 0x314], 7
mov word [ebp - 0x328], ax
call fcn.0040d400
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x310]
push 0xb
xor eax, eax
mov dword [ebp - 0x300], 0
push str.OllyDbg.exe
mov dword [ebp - 0x2fc], 7
mov word [ebp - 0x310], ax
call fcn.0040d400
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2f8]
push 0xa
xor eax, eax
mov dword [ebp - 0x2e8], 0
push str.x64dbg.exe
mov dword [ebp - 0x2e4], 7
mov word [ebp - 0x2f8], ax
call fcn.0040d400
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x2e0]
push 0x10
xor eax, eax
mov dword [ebp - 0x2d0], 0
push str.SysInspector.exe
mov dword [ebp - 0x2cc], 7
mov word [ebp - 0x2e0], ax
call fcn.0040d400
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x2c8]
push 0xd
xor eax, eax
mov dword [ebp - 0x2b8], 0
push str.CurrPorts.exe
mov dword [ebp - 0x2b4], 7
mov word [ebp - 0x2c8], ax
call fcn.0040d400
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x2b0]
push 0x10
xor eax, eax
mov dword [ebp - 0x2a0], 0
push str.NetworkMiner.exe
mov dword [ebp - 0x29c], 7
mov word [ebp - 0x2b0], ax
call fcn.0040d400
mov byte [ebp - 4], 0x17
push 0xb
xor eax, eax
mov dword [ebp - 0x288], 0
push str.RegShot.exe
lea ecx, [ebp - 0x298]
mov dword [ebp - 0x284], 7
mov word [ebp - 0x298], ax
call fcn.0040d400
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x280]
push 0xa
xor eax, eax
mov dword [ebp - 0x270], 0
push str.WinDbg.exe
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
call fcn.0040d400
mov dword [ebp - 4], 0x19
push 0x270
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.0041e133
mov esi, eax
add esp, 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x264], eax
lea ecx, [esi + 0x270]
mov dword [ebp - 0x14], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x28], xmm0
lea edi, [ebp - 0x4d8]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0x1b
nop
push edi
mov ecx, esi
call fcn.0040afe0
add esi, 0x18
lea eax, [ebp - 0x268]
add edi, 0x18
mov dword [ebp - 0x24], esi
cmp edi, eax
jne 0x4042f0
push ecx
mov edx, esi
mov ecx, esi
call fcn.00411a90
add esp, 4
mov dword [ebp - 0x18], esi
push 0x402f00
push 0x1a
push 0x18
lea eax, [ebp - 0x4d8]
mov byte [ebp - 4], 0x1d
push eax
call fcn.0041e163
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x264], eax
cmp esi, eax
je 0x40443e
nop
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x260], edi
cmp edi, 0xffffffff
je 0x404429
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x404422
nop dword [eax + eax]
lea eax, [ebp - 0x230]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4043a0
mov ecx, dword [esi + 0x10]
sub eax, edx
sar eax, 1
mov edi, esi
cmp dword [esi + 0x14], 8
jb 0x4043bc
mov edi, dword [esi]
cmp ecx, eax
jne 0x404406
lea eax, [ebp - 0x230]
mov dword [ebp - 0x268], eax
test ecx, ecx
je 0x40446e
movzx edx, word [edi]
movzx esi, word [ebp - 0x230]
cmp dx, si
jb 0x404400
sub edi, eax
cmp dx, si
ja 0x404400
cmp ecx, 1
je 0x40446e
movzx edx, word [edi + eax + 2]
add eax, 2
dec ecx
movzx esi, word [eax]
cmp dx, si
jae 0x4043e8
mov esi, dword [ebp - 0x25c]
mov edi, dword [ebp - 0x260]
lea eax, [ebp - 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x404390
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x18
mov dword [ebp - 0x25c], esi
cmp esi, dword [ebp - 0x264]
jne 0x404350
mov byte [ebp - 0x255], 0
lea ecx, [ebp - 0x1c]
call fcn.0040d250
mov al, byte [ebp - 0x255]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041df22
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x255], 1
jmp 0x404445