Function at 0x4032dd
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x76c
push ebx
push esi
push edi
lea edi, [ebp - 0x76c]
mov ecx, 0x1db
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x40e020]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xc], 0
and dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x228], ax
push 0x206
push 0
lea eax, [ebp - 0x226]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
and dword [ebp - 0x234], 0
mov esi, esp
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00408d80
lea eax, [ebp - 0x228]
push eax
call fcn.0040166b
pop ecx
mov esi, esp
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp esi, esp
call fcn.00408d80
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x4033b5
mov esi, esp
push str.QueryFullProcessImageNameW
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00408d80
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x4033b5
mov eax, dword [ebp - 0xc]
jmp 0x40356d
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
jne 0x4033f3
cmp dword [ebp - 0x24c], 0
je 0x4033eb
mov esi, esp
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00408d80
mov eax, dword [ebp - 0xc]
jmp 0x40356d
mov dword [ebp - 0x480], 0x22c
lea eax, [ebp - 0x480]
push eax
push dword [ebp - 0x24c]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x403439
cmp dword [ebp - 0x24c], 0
je 0x403431
mov esi, esp
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00408d80
mov eax, dword [ebp - 0xc]
jmp 0x40356d
xor eax, eax
mov word [ebp - 0x690], ax
push 0x206
push 0
lea eax, [ebp - 0x68e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x69c], 0x104
and dword [ebp - 0x18], 0
mov esi, esp
push dword [ebp - 0x478]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.00408d80
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4034ad
mov esi, esp
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x690]
push eax
push 0
push dword [ebp - 0x18]
call dword [ebp - 0x234]
cmp esi, esp
call fcn.00408d80
lea eax, [ebp - 0x690]
push eax
call fcn.0040166b
pop ecx
mov esi, esp
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x690]
push eax
call dword [sym.imp.MSVCR120.dll__wcsicmp]
pop ecx
pop ecx
cmp esi, esp
call fcn.00408d80
test eax, eax
jne 0x40351a
and dword [ebp - 0x6a8], 0
mov esi, esp
lea eax, [ebp - 0x6a8]
push eax
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp esi, esp
call fcn.00408d80
test eax, eax
je 0x40351a
mov eax, dword [ebp - 0x6a8]
cmp eax, dword [ebp + 0xc]
jne 0x40351a
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xc], eax
jmp 0x403534
lea eax, [ebp - 0x480]
push eax
push dword [ebp - 0x24c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x403439
cmp dword [ebp - 0x24c], 0
je 0x403552
mov esi, esp
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00408d80
cmp dword [ebp - 0x18], 0
je 0x40356a
mov esi, esp
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00408d80
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x40359d]
call fcn.00408d28
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408da3
add esp, 0x76c
cmp ebp, esp
call fcn.00408d80
mov esp, ebp
pop ebp
ret