Function at 0x4199f0
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4710f0
mov eax, dword fs:[0]
push eax
mov eax, 0x2032c
call fcn.00463770
mov eax, dword [0x490240]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x202c0]
mov dword [ebp - 0x20308], edi
mov dword [ebp - 0x2031c], edi
call fcn.00417ee0
push 0
push 2
mov dword [ebp - 4], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x202e0], eax
mov byte [ebp - 4], 1
cmp eax, 0xffffffff
jne 0x419a71
mov ecx, edi
call fcn.00417ee0
lea ecx, [ebp - 0x202c0]
call fcn.004186e0
jmp 0x41a692
lea ecx, [ebp - 0x20290]
mov dword [ebp - 0x20290], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41a538
mov edi, 0xa
nop word [eax + eax]
push dword [ebp - 0x20288]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x202dc], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x41a500
cmp eax, 0xffffffff
je 0x41a500
lea ecx, [ebp - 0x20300]
mov dword [ebp - 0x20300], 0xffff
push ecx
lea ecx, [ebp - 0x20010]
push ecx
push 0
push eax
call dword [0x477604]
xorps xmm0, xmm0
mov dword [ebp - 0x20018], 0
lea esi, [ebp - 0x20010]
mov dword [ebp - 0x20014], 0
movups xmmword [ebp - 0x20028], xmm0
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x419b16
sub esi, ecx
sar esi, 1
cmp esi, 0x7ffffffe
ja 0x41a6be
cmp esi, 7
ja 0x419b6b
mov dword [ebp - 0x20018], esi
lea eax, [ebp - 0x20010]
add esi, esi
mov dword [ebp - 0x20014], 7
push esi
push eax
lea eax, [ebp - 0x20028]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x20028], ax
jmp 0x419bd0
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x419b7e
mov eax, 0x7ffffffe
jmp 0x419b84
cmp eax, 0xa
cmovb eax, edi
mov dword [ebp - 0x20294], eax
lea eax, [ebp - 0x20294]
push eax
lea eax, [ebp - 0x20028]
push eax
call fcn.00404480
mov ecx, dword [ebp - 0x20294]
mov edi, eax
mov dword [ebp - 0x20018], esi
lea eax, [ebp - 0x20010]
add esi, esi
mov dword [ebp - 0x20028], edi
push esi
push eax
push edi
mov dword [ebp - 0x20014], ecx
call sub.msvcrt.dll_memcpy
add esp, 0x14
xor eax, eax
mov word [edi + esi], ax
cmp dword [ebp - 0x20014], 7
lea esi, [ebp - 0x20028]
mov edi, dword [ebp - 0x20018]
xorps xmm0, xmm0
cmova esi, dword [ebp - 0x20028]
mov byte [ebp - 4], 5
mov dword [ebp - 0x202c8], 0
mov dword [ebp - 0x202c4], 0
movups xmmword [ebp - 0x202d8], xmm0
cmp edi, 0x7ffffffe
ja 0x41a6be
cmp edi, 7
ja 0x419c3a
mov edx, 7
mov dword [ebp - 0x202c8], edi
mov dword [ebp - 0x202c4], edx
movups xmm1, xmmword [esi]
movups xmmword [ebp - 0x202d8], xmm1
jmp 0x419cae
mov eax, edi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x419c4d
mov eax, 0x7ffffffe
jmp 0x419c58
cmp eax, 0xa
mov ecx, 0xa
cmovb eax, ecx
mov dword [ebp - 0x20294], eax
lea eax, [ebp - 0x20294]
push eax
lea eax, [ebp - 0x202d8]
push eax
call fcn.00404480
mov ecx, dword [ebp - 0x20294]
mov dword [ebp - 0x202c4], ecx
lea ecx, [edi*2 + 2]
push ecx
push esi
push eax
mov dword [ebp - 0x202d8], eax
mov dword [ebp - 0x202c8], edi
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x202c4]
add esp, 0x14
mov edi, dword [ebp - 0x202c8]
movups xmm1, xmmword [ebp - 0x202d8]
cmp edx, 7
movd esi, xmm1
lea ecx, [ebp - 0x202d8]
mov byte [ebp - 4], 6
seta al
lea edx, [ebp - 0x202d8]
cmova ecx, esi
test al, al
je 0x419cd4
lea eax, [esi + edi*2]
jmp 0x419cdd
lea eax, [edx + edi*2]
lea esi, [ebp - 0x202d8]
mov dword [ebp - 0x20294], eax
cmp esi, eax
je 0x419d13
sub ecx, esi
mov dword [ebp - 0x202a0], ecx
mov edi, ecx
movzx eax, word [esi]
push eax
call sub.msvcrt.dll_tolower
mov word [edi + esi], ax
add esp, 4
add esi, 2
cmp esi, dword [ebp - 0x20294]
jne 0x419cf1
movups xmm1, xmmword [ebp - 0x202d8]
movq xmm0, qword [ebp - 0x202c8]
xor eax, eax
movups xmmword [ebp - 0x20040], xmm1
mov dword [ebp - 0x202c8], 0
movq qword [ebp - 0x20030], xmm0
mov dword [ebp - 0x202c4], 7
mov word [ebp - 0x202d8], ax
cmp dword [ebp - 0x2002c], 7
lea ecx, [ebp - 0x20040]
movd eax, xmm1
seta byte [ebp - 0x20299]
mov byte [ebp - 4], 7
cmova ecx, eax
mov dword [ebp - 0x20304], eax
mov eax, dword [ebp - 0x20030]
mov dword [ebp - 0x20298], ecx
cmp eax, 0xa
jb 0x419e08
add eax, 0xfffffff7
mov edx, ecx
lea eax, [ecx + eax*2]
mov dword [ebp - 0x20294], eax
nop
mov ecx, eax
mov esi, 0
sub ecx, edx
sar ecx, 1
je 0x419db4
cmp word [edx], 0x3a
je 0x419db2
cmp ecx, 1
je 0x419db4
add edx, 2
dec ecx
cmp word [edx], 0x3a
jne 0x419da3
mov esi, edx
mov edx, esi
test edx, edx
je 0x419e08
mov esi, 0x47ccc8
mov eax, edx
sub eax, esi
mov edi, 0xa
mov dword [ebp - 0x202a0], eax
nop
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x419dec
add esi, 2
sub edi, 1
je 0x419df7
mov eax, dword [ebp - 0x202a0]
jmp 0x419dd0
mov eax, dword [ebp - 0x20294]
add edx, 2
jmp 0x419d90
sub edx, dword [ebp - 0x20298]
sar edx, 1
cmp edx, 0xffffffff
jne 0x41a423
push 0
push str.microsoft
lea ecx, [ebp - 0x20040]
call fcn.00419910
cmp eax, 0xffffffff
jne 0x41a423
push 0
push str.windowsapps
lea ecx, [ebp - 0x20040]
call fcn.00419910
cmp eax, 0xffffffff
jne 0x41a423
mov eax, dword [ebp - 0x20018]
lea esi, [ebp - 0x20028]
cmp dword [ebp - 0x20014], 7
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x20028]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x419e77
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x419e66
push edx
lea eax, [ebp - 0x20028]
push eax
lea eax, [ebp - 0x20328]
push eax
lea ecx, [ebp - 0x202c0]
call fcn.00417d90
mov eax, dword [eax + 4]
test eax, eax
je 0x419ea4
cmp eax, dword [ebp - 0x202bc]
jne 0x41a1a2
mov dword [ebp - 0x202ec], 0
mov dword [ebp - 0x202e8], 0
mov dword [ebp - 0x202e4], 0
lea eax, [ebp - 0x20028]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x20064]
call fcn.0040b440
lea eax, [ebp - 0x202ec]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x2004c]
call fcn.00417f90
cmp dword [ebp - 0x20050], 7
lea edx, [ebp - 0x20064]
mov eax, dword [ebp - 0x20064]
mov esi, 0x811c9dc5
cmova edx, eax
mov dword [ebp - 0x20298], eax
mov eax, dword [ebp - 0x20054]
xor ecx, ecx
mov byte [ebp - 4], 0xb
lea edi, [eax + eax]
test edi, edi
je 0x419f33
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x419f22
push esi
lea eax, [ebp - 0x20064]
push eax
lea eax, [ebp - 0x202f4]
push eax
lea ecx, [ebp - 0x202c0]
call fcn.00417d90
cmp dword [ebp - 0x202f0], 0
jne 0x41a0b4
cmp dword [ebp - 0x202b8], 0x5d1745d
je 0x41a6b4
lea eax, [ebp - 0x202bc]
mov dword [ebp - 0x20310], eax
push 0x2c
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x2030c], 0
call fcn.004637bf
add esp, 4
mov dword [ebp - 0x20294], eax
lea ecx, [ebp - 0x20064]
mov dword [ebp - 0x2030c], eax
push ecx
lea ecx, [eax + 8]
call fcn.0040b440
mov edx, dword [ebp - 0x20044]
xor eax, eax
mov ecx, dword [ebp - 0x20048]
xor edi, edi
mov dword [ebp - 0x20298], edx
mov edx, dword [ebp - 0x20294]
mov dword [ebp - 0x202a0], eax
mov dword [ebp - 0x20044], eax
mov dword [ebp - 0x20048], eax
mov eax, dword [ebp - 0x2004c]
mov dword [edx + 0x20], eax
lea eax, [edx + 8]
mov edx, dword [ebp - 0x20298]
mov dword [ebp - 0x2004c], edi
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 0x202b8]
inc eax
mov byte [ebp - 4], 0xd
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x47cde0]
mov eax, dword [ebp - 0x202a4]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x47cde0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebp - 0x202c0]
seta al
test al, al
je 0x41a083
lea ecx, [ebp - 0x202c0]
call fcn.00419570
mov eax, dword [ebp - 0x20294]
lea ecx, [ebp - 0x202c0]
push esi
add eax, 8
push eax
lea eax, [ebp - 0x20330]
push eax
call fcn.00417d90
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x202f4], ecx
mov dword [ebp - 0x202f0], eax
jmp 0x41a089
mov ecx, dword [ebp - 0x202f4]
push dword [ebp - 0x20294]
mov dword [ebp - 0x2030c], 0
push ecx
push esi
lea ecx, [ebp - 0x202c0]
call fcn.00419510
mov esi, dword [ebp - 0x20064]
mov eax, dword [ebp - 0x202a0]
jmp 0x41a0c6
mov eax, dword [ebp - 0x20044]
mov edi, dword [ebp - 0x2004c]
mov esi, dword [ebp - 0x20298]
mov byte [ebp - 4], 9
test edi, edi
je 0x41a102
sub eax, edi
sar eax, 2
lea ecx, [eax*4]
mov eax, edi
cmp ecx, 0x1000
jb 0x41a0f8
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a6af
push ecx
push edi
call fcn.004637ef
add esp, 8
mov eax, dword [ebp - 0x20050]
cmp eax, 7
jbe 0x41a13c
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x41a132
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a6af
push ecx
push esi
call fcn.004637ef
add esp, 8
mov ecx, dword [ebp - 0x202ec]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x41a1a2
mov eax, dword [ebp - 0x202e4]
sub eax, ecx
sar eax, 2
lea edx, [eax*4]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a17a
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a6af
push edx
push ecx
call fcn.004637ef
add esp, 8
mov dword [ebp - 0x202ec], 0
mov dword [ebp - 0x202e8], 0
mov dword [ebp - 0x202e4], 0
mov eax, dword [ebp - 0x20018]
lea edx, [ebp - 0x20028]
cmp dword [ebp - 0x20014], 7
mov esi, 0x811c9dc5
cmova edx, dword [ebp - 0x20028]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x41a1e1
nop word [eax + eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x41a1d0
push esi
lea eax, [ebp - 0x20028]
push eax
lea eax, [ebp - 0x202fc]
push eax
lea ecx, [ebp - 0x202c0]
call fcn.00417d90
mov eax, dword [ebp - 0x202f8]
test eax, eax
jne 0x41a31b
cmp dword [ebp - 0x202b8], 0x5d1745d
je 0x41a6b4
lea eax, [ebp - 0x202bc]
mov dword [ebp - 0x20318], eax
push 0x2c
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x20314], 0
call fcn.004637bf
add esp, 4
mov dword [ebp - 0x20298], eax
mov dword [ebp - 0x20314], eax
lea edi, [eax + 8]
lea eax, [ebp - 0x20028]
mov ecx, edi
push eax
call fcn.0040b440
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov eax, dword [ebp - 0x202b8]
inc eax
mov byte [ebp - 4], 0xf
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x47cde0]
mov eax, dword [ebp - 0x202a4]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x47cde0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebp - 0x202c0]
seta al
test al, al
je 0x41a2f4
lea ecx, [ebp - 0x202c0]
call fcn.00419570
push esi
push edi
lea eax, [ebp - 0x20338]
push eax
lea ecx, [ebp - 0x202c0]
call fcn.00417d90
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x202fc], ecx
mov dword [ebp - 0x202f8], eax
jmp 0x41a2fa
mov ecx, dword [ebp - 0x202fc]
push dword [ebp - 0x20298]
mov dword [ebp - 0x20314], 0
push ecx
push esi
lea ecx, [ebp - 0x202c0]
call fcn.00419510
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x20288]
lea ecx, [eax + 0x20]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x20298], edx
cmp eax, dword [ecx + 8]
je 0x41a33a
mov dword [eax], edx
add dword [ecx + 4], 4
jmp 0x41a347
lea edx, [ebp - 0x20298]
push edx
push eax
call fcn.00417c70
mov ecx, dword [ebp - 0x2002c]
mov byte [ebp - 4], 5
cmp ecx, 7
jbe 0x41a38b
mov edx, dword [ebp - 0x20040]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41a381
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a6af
push ecx
push edx
call fcn.004637ef
add esp, 8
mov ecx, dword [ebp - 0x20014]
xor eax, eax
mov dword [ebp - 0x20030], 0
mov dword [ebp - 0x2002c], 7
mov word [ebp - 0x20040], ax
mov byte [ebp - 4], 3
cmp ecx, 7
jbe 0x41a3ec
mov edx, dword [ebp - 0x20028]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41a3e2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a6af
push ecx
push edx
call fcn.004637ef
add esp, 8
xor eax, eax
mov dword [ebp - 0x20018], 0
mov dword [ebp - 0x20014], 7
mov word [ebp - 0x20028], ax
push dword [ebp - 0x202dc]
mov byte [ebp - 4], 0x10
call dword [0x47ccb0]
mov edi, 0xa
jmp 0x41a514
cmp byte [ebp - 0x20299], 0
mov byte [ebp - 4], 5
je 0x41a46b
mov ecx, dword [ebp - 0x2002c]
mov edx, dword [ebp - 0x20304]
mov eax, edx
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x41a461
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a6af
push ecx
push edx
call fcn.004637ef
add esp, 8
mov ecx, dword [ebp - 0x20014]
xor eax, eax
mov dword [ebp - 0x20030], 0
mov dword [ebp - 0x2002c], 7
mov word [ebp - 0x20040], ax
mov byte [ebp - 4], 3
cmp ecx, 7
jbe 0x41a4cc
mov edx, dword [ebp - 0x20028]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41a4c2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a6af
push ecx
push edx
call fcn.004637ef
add esp, 8
xor eax, eax
mov dword [ebp - 0x20018], 0
mov dword [ebp - 0x20014], 7
mov word [ebp - 0x20028], ax
push dword [ebp - 0x202dc]
mov byte [ebp - 4], 8
call dword [0x47ccb0]
mov edi, 0xa
jmp 0x41a514
mov byte [ebp - 4], 4
test eax, eax
je 0x41a514
cmp eax, 0xffffffff
je 0x41a514
push eax
call dword [0x47ccb0]
lea eax, [ebp - 0x20290]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x202e0]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x419aa0
mov edi, dword [ebp - 0x20308]
mov eax, dword [ebp - 0x202c0]
mov dword [edi], eax
push 0x2c
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.004637bf
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push eax
push 0x10
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 0x12
call fcn.00419130
mov ecx, dword [edi + 4]
mov eax, dword [ebp - 0x202bc]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x202b8]
mov dword [ebp - 0x202bc], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov edx, dword [edi + 0xc]
mov eax, dword [ebp - 0x202b4]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x202b0]
mov dword [ebp - 0x202b8], ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x202ac]
mov dword [ebp - 0x202b0], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 0x202a8]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x202a4]
mov dword [ebp - 0x202b4], edx
mov dword [ebp - 0x202ac], ecx
mov dword [ebp - 0x202a8], 7
mov dword [ebp - 0x202a4], 8
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x202e0]
mov byte [ebp - 4], 0x13
test eax, eax
je 0x41a625
push eax
call dword [0x47ccb0]
mov ecx, dword [ebp - 0x202ac]
mov edx, dword [ebp - 0x202b4]
test edx, edx
je 0x41a670
sub ecx, edx
mov eax, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x41a648
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a6af
push ecx
push edx
call fcn.004637ef
add esp, 8
mov dword [ebp - 0x202b4], 0
mov dword [ebp - 0x202b0], 0
mov dword [ebp - 0x202ac], 0
push dword [ebp - 0x202bc]
lea eax, [ebp - 0x202bc]
push eax
call fcn.00417e30
push 0x2c
push dword [ebp - 0x202bc]
call fcn.004637ef
add esp, 0x10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004637fd
mov esp, ebp
pop ebp
ret
call fcn.00465020
push str.unordered_map_set_too_long
call fcn.0044b5ac
call fcn.0040e690
int3