Function at 0x40a350
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x294
mov eax, dword [0x422760]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
mov ebx, dword [esp + 0x29c]
push ebp
mov ebp, dword [esp + 0x2a4]
test ebp, ebp
je 0x40a614
push esi
push edi
push ebp
push 0x41dc80
push 0xffffffffffffffff
lea eax, [esp + 0x24c]
push 0x10
push eax
call fcn.004126d2
mov ecx, dword [esp + 0x2c4]
push ecx
push 0x41dc80
push 0xffffffffffffffff
lea edx, [esp + 0x280]
push 0x10
push edx
call fcn.004126d2
push 0
lea eax, [esp + 0x28c]
push eax
lea ecx, [esp + 0x270]
push ecx
lea esi, [ebx + 2]
push esi
push 0x400003ff
push 4
call fcn.004050e0
add esp, 0x40
push ebp
push 0
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40a4c5
mov edx, dword [esp + 0x2b4]
push edx
push 0x41dc80
push 0xffffffffffffffff
lea eax, [esp + 0x28c]
push 0x10
push eax
call fcn.004126d2
push 0
push esi
lea ecx, [esp + 0x29c]
push ecx
lea edx, [esp + 0x260]
push edx
push 0x40000403
push 4
call fcn.004050e0
mov eax, dword [esp + 0x2dc]
push eax
push ebp
push edi
push ebx
call fcn.0040a230
add esp, 0x3c
test eax, eax
jne 0x40a4bc
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40a45e
cmp dword [esp + 0x10], 0x103
jne 0x40a4bc
test byte [ebx + 0x70484], 8
push 0
je 0x40a49a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00404fa0
add esp, 4
push eax
push esi
lea edx, [esp + 0x24c]
push edx
push 0xc0000404
push 1
call fcn.004050e0
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a4ef
push str.AppStopMethodSkip
push str.NSSM
lea eax, [esp + 0x24c]
push eax
push esi
push 0x8000041d
push 2
call fcn.004050e0
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a4ef
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00404fa0
add esp, 4
push eax
push esi
lea ecx, [esp + 0x24c]
push ecx
push 0xc0000402
push 1
call fcn.004050e0
add esp, 0x18
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
jne 0x40a524
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00404fa0
add esp, 4
push eax
push esi
push 0xc0000400
push 1
call fcn.004050e0
add esp, 0x14
jmp 0x40a612
push 0x22c
lea edx, [esp + 0x18]
push 0
push edx
call fcn.00412740
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x1c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x40a55b
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a5f1
push ebp
lea ecx, [esp + 0x18]
push ecx
push ebx
call fcn.00409e10
add esp, 0xc
test eax, eax
jne 0x40a58c
mov edx, dword [esp + 0x2b4]
mov eax, dword [esp + 0x2b0]
mov ecx, dword [esp + 0x1c]
push edx
push eax
push ecx
push ebx
call fcn.0040a350
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x40a5e0
jmp 0x40a5a0
push ebp
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.00409e10
add esp, 0xc
test eax, eax
jne 0x40a5d1
mov ecx, dword [esp + 0x2b4]
mov edx, dword [esp + 0x2b0]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push ebx
call fcn.0040a350
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40a5a0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x12
je 0x40a60b
push 0
call ebx
push eax
call fcn.00404fa0
add esp, 4
push eax
push esi
push 0xc0000401
push 1
call fcn.004050e0
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [esp + 0x298]
pop ebp
pop ebx
xor ecx, esp
call fcn.004126f3
add esp, 0x294
ret