Function at 0x43d398
Capabilities:
Enumerate processes

Disassembly:
push ebp
push ebx
mov edx, 0x97
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x43d39f
call fcn.0055ab90
mov edx, dword [esp + 0x268]
lea ecx, [esp]
call fcn.004f4000
mov dword [section..data], 0x15000d7
mov dword [section..data], 0x15000e3
mov dword [esp + 0xc], 0
mov dword [section..data], 0x15000e4
mov dword [esp + 0x10], 0
mov dword [section..data], 0x15000e7
mov dword [esp + 0x1c], 0
mov dword [section..data], 0x15000e8
mov dword [esp + 0x20], 0
mov dword [section..data], 0x15000eb
mov dword [esp + 0x254], 1
mov dword [section..data], 0x15000ee
mov dword [section..data], 0x15000f0
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push 0x1f4
call fcn.00549990
lea eax, [esp + 0x18]
push eax
call fcn.0055aa30
mov dword [section..data], 0x15000f1
push dword [esp + 0x14]
call fcn.00548f60
mov dword [esp + 0x18], eax
mov dword [section..data], 0x15000f3
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 8]
call fcn.0054ca9e
lea eax, [esp + 8]
push eax
call fcn.0055aa30
mov dword [section..data], 0x15000f4
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 8]
call fcn.0054c962
lea eax, [esp + 0xc]
push eax
call fcn.0055aa30
mov dword [section..data], 0x15000f6
push edx
call fcn.0055a9f0
pop edx
push eax
push 3
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.Filename__
push edx
call fcn.0055aac0
mov edx, dword [esp + 0xc]
push edx
call fcn.0055aac0
mov edx, str._____ExePath__
push edx
call fcn.0055aac0
mov edx, dword [esp + 0x14]
push edx
call fcn.0055aac0
mov edx, str.__ExeFile__
push edx
call fcn.0055aac0
mov edx, dword [esp + 0x10]
push edx
call fcn.0055aac0
mov edx, 0x638cee
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str._GetProcData
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x15000f8
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x10], eax
mov dword [section..data], 0x15000fa
mov ebx, dword [esp + 0x10]
cmp ebx, 0xffffffff
jne 0x43d5cb
mov dword [section..data], 0x15000fb
push 0
mov eax, str.Failed_to_exec_CreateToolhelp32Snapshot___InvalidHandleValue
push eax
mov eax, str._GetProcData
push eax
call fcn.0043d328
mov dword [section..data], 0x15000fc
mov dword [esp + 0x254], 0xfffff7cb
mov dword [section..data], 0x15000fd
jmp 0x43de21
mov dword [section..data], 0x15000fe
mov dword [section..data], 0x1500100
lea ebp, [esp + 0x24]
mov dword [ebp], 0x22c
mov dword [section..data], 0x1500101
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32FirstW
and eax, eax
je 0x43d60a
xor eax, eax
jmp 0x43d60f
mov eax, 1
and eax, eax
je 0x43d733
mov dword [section..data], 0x1500102
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x250], eax
mov dword [section..data], 0x1500103
mov ebx, dword [esp + 0x250]
cmp ebx, 0x12
jne 0x43d672
mov dword [section..data], 0x1500104
push 3
mov eax, str.No_running_processes_detected
push eax
mov eax, str._GetProcData
push eax
call fcn.0043d328
mov dword [section..data], 0x1500105
jmp 0x43de21
mov dword [section..data], 0x1500106
mov dword [section..data], 0x1500108
push edx
call fcn.0055a9f0
pop edx
push eax
push 0
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.Failed_to_get_Process32First____
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
mov eax, dword [esp + 0x264]
cdq
push edx
push eax
call fcn.00548d10
pop eax
mov edx, 0x655306
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x260]
call fcn.0043ca18
pop eax
mov edx, 0x637c34
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str._GetProcData
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x1500109
mov dword [esp + 0x254], 0xfffff7ca
mov dword [section..data], 0x150010a
jmp 0x43de21
mov dword [section..data], 0x150010b
mov dword [section..data], 0x150010d
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
lea ebp, [esp + 0x34]
lea eax, [ebp + 0x24]
push eax
call fcn.0055a830
call fcn.004f4332
add dword [esp], edx
call fcn.005498b0
call fcn.0055ab20
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x10]
call fcn.005498b0
call fcn.004f4360
mov edx, eax
pop ecx
push ecx
call fcn.004f4360
mov ecx, eax
call fcn.004f4370
je 0x43da75
mov dword [section..data], 0x150010e
lea ebp, [esp + 0x24]
push dword [ebp + 8]
pop eax
mov dword [esp + 0xc], eax
mov dword [section..data], 0x150010f
push edx
call fcn.0055a9f0
pop edx
push eax
push 3
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.Detected_process__
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
mov eax, dword [esp + 0x20]
cdq
push edx
push eax
call fcn.00548d10
pop eax
mov edx, 0x638cee
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str._GetProcData
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x1500111
push dword [esp + 8]
mov edx, 0x6355da
pop ecx
call fcn.004f4370
jne 0x43da07
mov dword [section..data], 0x1500113
lea eax, [esp + 0x258]
push eax
push dword [esp + 8]
push dword [esp + 0x14]
call fcn.0043dedf
mov dword [esp + 0x250], eax
mov dword [section..data], 0x1500114
mov ebx, dword [esp + 0x250]
cmp ebx, 1
jge 0x43d92f
mov dword [section..data], 0x1500115
push edx
call fcn.0055a9f0
pop edx
push eax
push 0
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.Getting_fullpath_from_pid_failed____
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x260]
call fcn.0043cb75
pop eax
mov edx, 0x638cee
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str._GetProcData
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x1500116
push dword [esp + 0x250]
pop eax
mov dword [esp + 0x254], eax
mov dword [section..data], 0x1500117
jmp 0x43de21
mov dword [section..data], 0x1500118
mov dword [section..data], 0x150011a
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
lea ebp, [esp + 0x260]
push dword [ebp]
call fcn.005498b0
call fcn.0055ab20
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0xc]
call fcn.005498b0
call fcn.004f4360
mov edx, eax
pop ecx
push ecx
call fcn.004f4360
mov ecx, eax
call fcn.004f4370
je 0x43d9f1
mov dword [section..data], 0x150011b
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x43d9bf
mov ebx, dword [esp + 0x270]
cmp ebx, 1
jne 0x43d9bf
mov eax, 1
jmp 0x43d9c1
xor eax, eax
and eax, eax
je 0x43d9d4
mov dword [section..data], 0x150011c
jmp 0x43de21
mov dword [section..data], 0x150011d
mov dword [section..data], 0x150011e
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x150011f
mov dword [section..data], 0x1500120
jmp 0x43da6b
mov dword [section..data], 0x1500120
mov dword [section..data], 0x1500121
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x43da39
mov ebx, dword [esp + 0x270]
cmp ebx, 1
jne 0x43da39
mov eax, 1
jmp 0x43da3b
xor eax, eax
and eax, eax
je 0x43da4e
mov dword [section..data], 0x1500122
jmp 0x43de21
mov dword [section..data], 0x1500123
mov dword [section..data], 0x1500125
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x1500126
mov dword [section..data], 0x1500127
mov dword [section..data], 0x1500129
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32NextW
and eax, eax
je 0x43de04
mov dword [section..data], 0x150012a
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
lea ebp, [esp + 0x34]
lea eax, [ebp + 0x24]
push eax
call fcn.0055a830
call fcn.004f4332
add dword [esp], edx
call fcn.005498b0
call fcn.0055ab20
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x10]
call fcn.005498b0
call fcn.004f4360
mov edx, eax
pop ecx
push ecx
call fcn.004f4360
mov ecx, eax
call fcn.004f4370
je 0x43ddeb
mov dword [section..data], 0x150012b
lea ebp, [esp + 0x24]
push dword [ebp + 8]
pop eax
mov dword [esp + 0xc], eax
mov dword [section..data], 0x150012c
push edx
call fcn.0055a9f0
pop edx
push eax
push 3
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.Detected_process__
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
mov eax, dword [esp + 0x20]
cdq
push edx
push eax
call fcn.00548d10
pop eax
mov edx, str.__for_file__
push edx
call fcn.0055aac0
mov edx, dword [esp + 0x10]
push edx
call fcn.0055aac0
mov edx, 0x638cee
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str._GetProcData
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x150012e
push dword [esp + 8]
mov edx, 0x6355da
pop ecx
call fcn.004f4370
jne 0x43dd7f
mov dword [section..data], 0x1500130
lea eax, [esp + 0x258]
push eax
push dword [esp + 8]
push dword [esp + 0x14]
call fcn.0043dedf
mov dword [esp + 0x250], eax
mov dword [section..data], 0x1500131
mov ebx, dword [esp + 0x250]
cmp ebx, 1
jge 0x43dca6
mov dword [section..data], 0x1500132
push edx
call fcn.0055a9f0
pop edx
push eax
push 0
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.Getting_fullpath_from_pid_failed____
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x260]
call fcn.0043cb75
pop eax
mov edx, 0x638cee
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str._GetProcData
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x1500133
push dword [esp + 0x250]
pop eax
mov dword [esp + 0x254], eax
mov dword [section..data], 0x1500134
jmp 0x43de04
mov dword [section..data], 0x1500135
mov dword [section..data], 0x1500137
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
lea ebp, [esp + 0x260]
push dword [ebp]
call fcn.005498b0
call fcn.0055ab20
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0xc]
call fcn.005498b0
call fcn.004f4360
mov edx, eax
pop ecx
push ecx
call fcn.004f4360
mov ecx, eax
call fcn.004f4370
je 0x43dd69
mov dword [section..data], 0x1500138
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x150013a
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x43dd4a
mov ebx, dword [esp + 0x270]
cmp ebx, dword [esp + 0x20]
jne 0x43dd4a
mov eax, 1
jmp 0x43dd4c
xor eax, eax
and eax, eax
je 0x43dd5f
mov dword [section..data], 0x150013b
jmp 0x43de04
mov dword [section..data], 0x150013c
mov dword [section..data], 0x150013e
mov dword [section..data], 0x150013f
jmp 0x43dde1
mov dword [section..data], 0x150013f
mov dword [section..data], 0x1500140
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x1500142
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x43ddc5
mov ebx, dword [esp + 0x270]
cmp ebx, dword [esp + 0x20]
jne 0x43ddc5
mov eax, 1
jmp 0x43ddc7
xor eax, eax
and eax, eax
je 0x43ddd7
mov dword [section..data], 0x1500143
jmp 0x43de04
mov dword [section..data], 0x1500144
mov dword [section..data], 0x1500146
mov dword [section..data], 0x1500147
mov dword [section..data], 0x1500148
jmp 0x43da7f
mov dword [section..data], 0x150014a
push dword [esp + 0x10]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x150014c
mov dword [section..data], 0x150014e
mov ebx, dword [esp + 0x254]
cmp ebx, 1
jge 0x43de4a
mov dword [section..data], 0x150014f
mov eax, dword [esp + 0x254]
jmp 0x43de9f
mov dword [section..data], 0x1500150
mov dword [section..data], 0x1500152
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x43de79
mov dword [section..data], 0x1500153
mov eax, dword [esp + 0xc]
jmp 0x43de9f
mov dword [section..data], 0x1500154
mov dword [section..data], 0x1500156
mov eax, dword [esp + 0x20]
jmp 0x43de9f
push dword [esp + 0x14]
call fcn.0055abf0
push dword [esp + 8]
call fcn.0055abf0
push dword [esp]
call fcn.0055abf0
lea edx, [esp + 0x258]
push 0x66db18
push edx
call fcn.005233dd
push dword [esp + 4]
call fcn.0055abf0
add esp, 0x25c
pop ebx
pop ebp
ret 0xc