Function at 0x412600
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432bf5
mov eax, dword fs:[0]
push eax
mov eax, 0x162c
call fcn.00430ae0
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x1610], eax
mov dword [ebp - 0x15ec], ecx
test eax, eax
je 0x413067
push 1
call fcn.00411fd0
test eax, eax
je 0x413067
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x160c], edi
cmp edi, 0xffffffff
je 0x413067
lea eax, [ebp - 0x15a0]
push eax
push edi
mov dword [ebp - 0x15a0], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x41269a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413067
mov esi, dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
push 0x14
call esi
add esp, 4
test eax, eax
je 0x413067
mov ecx, eax
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
call fcn.00421d00
mov dword [ebp - 0x15f0], eax
test eax, eax
je 0x413067
push 0x10
call esi
add esp, 4
mov dword [ebp - 0x15c0], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x412701
mov ecx, eax
mov dword [eax + 8], 0
call fcn.00420f20
jmp 0x412703
xor eax, eax
mov dword [ebp - 0x15dc], eax
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x413067
mov ebx, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
mov dword [ebp - 0x15e8], 0
push 0x10
call esi
add esp, 4
mov dword [ebp - 0x15c0], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x412758
mov ecx, eax
mov dword [eax + 8], 0
call fcn.00420f20
mov edi, eax
mov dword [ebp - 0x15e4], eax
jmp 0x412760
xor edi, edi
mov dword [ebp - 0x15e4], edi
lea eax, [ebp - 0x157c]
push eax
lea ecx, [ebp - 0x15d8]
mov dword [ebp - 4], 0xffffffff
call fcn.004026f0
push str.proc_nm
lea ecx, [ebp - 0x1608]
mov dword [ebp - 4], 2
call fcn.00402620
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x1608]
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.004213c0
cmp dword [ebp - 0x15f4], 0x10
jb 0x4127bd
push dword [ebp - 0x1608]
call ebx
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x15c4], 8
mov dword [ebp - 0x15f4], 0xf
mov dword [ebp - 0x15f8], 0
mov byte [ebp - 0x1608], 0
jb 0x4127f3
push dword [ebp - 0x15d8]
call ebx
add esp, 4
lea eax, [ebp - 0x157c]
push eax
lea ecx, [ebp - 0x15b8]
call fcn.004026f0
push str.inskey
lea ecx, [ebp - 0x1608]
mov dword [ebp - 4], 4
call fcn.00402620
lea edx, [ebp - 0x15b8]
lea ecx, [ebp - 0x15d8]
mov byte [ebp - 4], 5
call fcn.00405e00
push eax
lea eax, [ebp - 0x1608]
push eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.004213c0
cmp dword [ebp - 0x15c4], 8
jb 0x412858
push dword [ebp - 0x15d8]
call ebx
add esp, 4
xor eax, eax
cmp dword [ebp - 0x15f4], 0x10
mov dword [ebp - 0x15c4], 7
mov dword [ebp - 0x15c8], 0
mov word [ebp - 0x15d8], ax
jb 0x412889
push dword [ebp - 0x1608]
call ebx
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x15a4], 8
mov dword [ebp - 0x15f4], 0xf
mov dword [ebp - 0x15f8], 0
mov byte [ebp - 0x1608], 0
jb 0x4128bf
push dword [ebp - 0x15b8]
call ebx
add esp, 4
push dword [ebp - 0x1598]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x15e0], esi
test esi, esi
je 0x412f2c
cmp dword [ebp - 0x1598], 8
jbe 0x412f5a
push 0x103
lea eax, [ebp - 0x117]
push 0
push eax
mov byte [ebp - 0x118], 0
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push dword [ebp - 0x1598]
push 0x437bc0
push eax
call fcn.00413700
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x15d8]
call fcn.00402620
push str.proc_id
lea ecx, [ebp - 0x15b8]
mov dword [ebp - 4], 7
call fcn.00402620
lea ecx, [ebp - 0x15d8]
mov byte [ebp - 4], 8
call fcn.00420990
push eax
lea eax, [ebp - 0x15b8]
push eax
mov ecx, edi
call fcn.00421100
lea ecx, [ebp - 0x15b8]
call fcn.00402680
lea ecx, [ebp - 0x15d8]
mov dword [ebp - 4], 0xffffffff
call fcn.00402680
push dword [ebp - 0x158c]
lea eax, [ebp - 0x118]
push 0x437bbc
push eax
call fcn.00413700
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x15d8]
call fcn.00402620
push str.thrd_cnt
lea ecx, [ebp - 0x15b8]
mov dword [ebp - 4], 9
call fcn.00402620
lea ecx, [ebp - 0x15d8]
mov byte [ebp - 4], 0xa
call fcn.00420990
push eax
lea eax, [ebp - 0x15b8]
push eax
mov ecx, edi
call fcn.00421100
lea ecx, [ebp - 0x15b8]
call fcn.00402680
lea ecx, [ebp - 0x15d8]
mov dword [ebp - 4], 0xffffffff
call fcn.00402680
push dword [ebp - 0x1588]
lea eax, [ebp - 0x118]
push 0x437bc0
push eax
call fcn.00413700
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x15d8]
call fcn.00402620
push str.ppar_id
lea ecx, [ebp - 0x15b8]
mov dword [ebp - 4], 0xb
call fcn.00402620
lea ecx, [ebp - 0x15d8]
mov byte [ebp - 4], 0xc
call fcn.00420990
push eax
lea eax, [ebp - 0x15b8]
push eax
mov ecx, edi
call fcn.00421100
lea ecx, [ebp - 0x15b8]
call fcn.00402680
lea ecx, [ebp - 0x15d8]
mov dword [ebp - 4], 0xffffffff
call fcn.00402680
push dword [ebp - 0x1584]
lea eax, [ebp - 0x118]
push 0x437bbc
push eax
call fcn.00413700
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x15d8]
call fcn.00402620
push str.pri_base
lea ecx, [ebp - 0x15b8]
mov dword [ebp - 4], 0xd
call fcn.00402620
lea ecx, [ebp - 0x15d8]
mov byte [ebp - 4], 0xe
call fcn.00420990
push eax
lea eax, [ebp - 0x15b8]
push eax
mov ecx, edi
call fcn.00421100
lea ecx, [ebp - 0x15b8]
call fcn.00402680
lea ecx, [ebp - 0x15d8]
mov dword [ebp - 4], 0xffffffff
call fcn.00402680
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
je 0x412b88
push eax
lea eax, [ebp - 0x118]
push 0x437bbc
push eax
call fcn.00413700
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x15d8]
call fcn.00402620
push str.pri_class
lea ecx, [ebp - 0x15b8]
mov dword [ebp - 4], 0xf
call fcn.00402620
lea ecx, [ebp - 0x15d8]
mov byte [ebp - 4], 0x10
call fcn.00420990
push eax
lea eax, [ebp - 0x15b8]
push eax
mov ecx, edi
call fcn.00421100
lea ecx, [ebp - 0x15b8]
call fcn.00402680
lea ecx, [ebp - 0x15d8]
mov dword [ebp - 4], 0xffffffff
call fcn.00402680
push esi
call fcn.00412080
push eax
lea eax, [ebp - 0x118]
push 0x437bbc
push eax
call fcn.00413700
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x15d8]
call fcn.00402620
push str.pro_hdl_cnt
lea ecx, [ebp - 0x15b8]
mov dword [ebp - 4], 0x11
call fcn.00402620
lea ecx, [ebp - 0x15d8]
mov byte [ebp - 4], 0x12
call fcn.00420990
push eax
lea eax, [ebp - 0x15b8]
push eax
mov ecx, edi
call fcn.00421100
lea ecx, [ebp - 0x15b8]
call fcn.00402680
lea ecx, [ebp - 0x15d8]
mov dword [ebp - 4], 0xffffffff
call fcn.00402680
mov dword [ebp - 0x1368], 0
mov dword [ebp - 0x1364], 0
call fcn.00410420
mov dword [ebp - 0x1368], eax
lea eax, [ebp - 0x1368]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x13
call fcn.00411490
lea eax, [ebp - 0x1368]
push eax
push dword [ebp - 0x1598]
call fcn.00411c20
mov ecx, dword [ebp - 0x15ec]
lea eax, [ebp - 0x1368]
push eax
push esi
call fcn.00411df0
mov eax, dword [ebp - 0x1368]
mov esi, dword [eax]
mov dword [ebp - 0x15bc], esi
cmp esi, eax
je 0x412cc5
push ecx
lea edx, [esi + 0x10]
lea ecx, [ebp - 0x15b8]
call fcn.0041a4f0
add esp, 4
add esi, 0x28
push esi
push eax
mov ecx, edi
mov byte [ebp - 4], 0x14
call fcn.004213c0
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x15a4], 0x10
jb 0x412cac
push dword [ebp - 0x15b8]
call ebx
add esp, 4
lea ecx, [ebp - 0x15bc]
call fcn.004102a0
mov esi, dword [ebp - 0x15bc]
cmp esi, dword [ebp - 0x1368]
jne 0x412c72
mov ecx, dword [ebp - 0x15dc]
call fcn.00421070
mov esi, dword [ebp - 0x15e0]
lea eax, [ebp - 0x136c]
push eax
push 0x1040
lea eax, [ebp - 0x1360]
push eax
push esi
mov dword [ebp - 0x136c], 0
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x412eff
push 0x14
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
test eax, eax
je 0x413083
mov ecx, eax
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
call fcn.00421d00
mov dword [ebp - 0x15bc], eax
test eax, eax
je 0x413083
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x320], ax
lea eax, [ebp - 0x31e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
xor edi, edi
test dword [ebp - 0x136c], 0xfffffffc
jbe 0x412e90
mov ebx, edi
push 0x104
lea eax, [ebp - 0x320]
push eax
push dword [ebp + edi*4 - 0x1360]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x412e6a
lea ecx, [ebp - 0x320]
call fcn.00412550
test al, al
jne 0x412e72
push 0x10
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x15c0], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x412dd1
mov ecx, eax
mov dword [eax + 8], 0
call fcn.00420f20
mov esi, eax
jmp 0x412dd3
xor esi, esi
mov byte [ebp - 4], 0x13
test esi, esi
je 0x412e72
mov edx, esi
lea ecx, [ebp - 0x320]
call fcn.00416780
test eax, eax
jne 0x412dfa
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x412e72
cmp dword [esi + 0xc], 0
jne 0x412e0a
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x412e72
push 0x4374d8
lea ecx, [ebp - 0x15b8]
call fcn.00402620
lea edx, [ebp - 0x320]
lea ecx, [ebp - 0x15d8]
mov byte [ebp - 4], 0x16
call fcn.00405430
push eax
lea eax, [ebp - 0x15b8]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x17
call fcn.004213c0
lea ecx, [ebp - 0x15d8]
call fcn.00402800
lea ecx, [ebp - 0x15b8]
mov byte [ebp - 4], 0x13
call fcn.00402680
mov ecx, dword [ebp - 0x15bc]
push esi
push ebx
call fcn.00421e00
inc ebx
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x136c]
mov esi, dword [ebp - 0x15e0]
inc edi
shr eax, 2
cmp edi, eax
jb 0x412d71
mov ebx, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
mov edi, dword [ebp - 0x15bc]
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 8]
test eax, 0xfffffffc
jne 0x412ebe
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1368]
push eax
push dword [eax]
lea eax, [ebp - 0x162c]
jmp 0x413099
push str.modules
lea ecx, [ebp - 0x15b8]
call fcn.00402620
mov ecx, dword [ebp - 0x15dc]
push edi
lea eax, [ebp - 0x15b8]
push eax
mov byte [ebp - 4], 0x18
call fcn.00421100
cmp dword [ebp - 0x15a4], 0x10
jb 0x412ef9
push dword [ebp - 0x15b8]
call ebx
add esp, 4
mov edi, dword [ebp - 0x15e4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1368]
push eax
push dword [eax]
lea eax, [ebp - 0x1630]
push eax
lea ecx, [ebp - 0x1368]
call fcn.0040fe30
push dword [ebp - 0x1368]
call ebx
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x15dc]
mov ecx, edi
call fcn.00421900
mov ecx, dword [ebp - 0x15f0]
push edi
mov edi, dword [ebp - 0x15e8]
push edi
call fcn.00421e00
inc edi
mov dword [ebp - 0x15e8], edi
mov edi, dword [ebp - 0x160c]
lea eax, [ebp - 0x15a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov esi, dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
test eax, eax
jne 0x412728
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.00411fd0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x320], ax
lea eax, [ebp - 0x31e]
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [ebp - 0x15ec]
add esp, 0xc
push dword [eax]
lea eax, [ebp - 0x320]
push str.proc_hdl_ttl_cnt:_d
push eax
call fcn.00410c30
add esp, 0xc
lea eax, [ebp - 0x320]
push eax
lea ecx, [ebp - 0x15b8]
call fcn.004026f0
mov esi, dword [ebp - 0x15f0]
lea eax, [ebp - 0x15b8]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x19
call fcn.00421fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x15a4], 8
jb 0x41300c
push dword [ebp - 0x15b8]
call ebx
add esp, 4
push 4
push str.list
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0x1614], 0xf
mov dword [ebp - 0x1618], 0
mov byte [ebp - 0x1628], 0
call fcn.00402da0
mov ecx, dword [ebp - 0x1610]
push esi
lea eax, [ebp - 0x1628]
push eax
mov dword [ebp - 4], 0x1a
call fcn.00421100
cmp dword [ebp - 0x1614], 0x10
jb 0x413067
push dword [ebp - 0x1628]
call ebx
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1368]
push eax
push dword [eax]
lea eax, [ebp - 0x1634]
push eax
lea ecx, [ebp - 0x1368]
call fcn.0040fe30
push dword [ebp - 0x1368]
call ebx
add esp, 4
jmp 0x412f5a