Function at 0x402c80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov byte [ebp - 0x150], 0
xor eax, eax
mov dword [ebp - 0x14f], eax
mov dword [ebp - 0x14b], eax
mov dword [ebp - 0x147], eax
mov dword [ebp - 0x143], eax
mov dword [ebp - 0x13f], eax
mov dword [ebp - 0x13b], eax
mov dword [ebp - 0x137], eax
mov word [ebp - 0x133], ax
mov byte [ebp - 0x131], al
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
jne 0x402d04
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
xor al, al
jmp 0x4030ad
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov dword [ebp - 0x130], 0x128
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x154]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x402d63
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4030ad
mov dword [ebp - 0x15c], 0
mov dword [ebp - 4], 0
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00402b80
add esp, 4
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov dword [ebp - 0x15c], str.1__ufbrquw_dwd
mov edx, dword [ebp - 0x15c]
movsx eax, byte [edx]
test eax, eax
je 0x403059
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov ecx, dword [ebp - 0x15c]
add ecx, 2
mov dword [ebp - 0x178], ecx
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
lea edx, [ebp - 0x150]
test edx, edx
je 0x402df8
cmp dword [ebp - 0x178], 0
jne 0x402e0b
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
jmp 0x402e9c
mov dword [ebp - 0x174], 0
jmp 0x402e26
mov eax, dword [ebp - 0x174]
add eax, 1
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x178]
add ecx, dword [ebp - 0x174]
movsx edx, byte [ecx]
test edx, edx
je 0x402e72
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov eax, dword [ebp - 0x178]
add eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x174]
mov dl, byte [eax]
mov byte [ebp + ecx - 0x150], dl
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
jmp 0x402e17
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov eax, dword [ebp - 0x174]
mov byte [ebp + eax - 0x150], 0
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x17c], ecx
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov edx, dword [ebp - 0x17c]
movsx eax, byte [edx]
test eax, eax
jne 0x402f03
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov ecx, dword [ebp - 0x17c]
lea edx, [ebp - 0x150]
sub ecx, edx
mov dword [ebp - 0x180], ecx
jmp 0x402f22
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov eax, dword [ebp - 0x17c]
add eax, 1
mov dword [ebp - 0x17c], eax
jmp 0x402ec4
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x158], ecx
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov dword [ebp - 0x160], 0
jmp 0x402f57
mov edx, dword [ebp - 0x160]
add edx, 1
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x158]
jge 0x402f85
mov ecx, dword [ebp - 0x160]
movsx edx, byte [ebp + ecx - 0x150]
add edx, 1
mov eax, dword [ebp - 0x160]
mov byte [ebp + eax - 0x150], dl
jmp 0x402f48
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x10c]
push edx
call fcn.004070f8
add esp, 8
test eax, eax
jne 0x402fc8
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov eax, dword [ebp - 0x15c]
mov al, byte [eax]
jmp 0x4030ad
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x184], ecx
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
jne 0x40301f
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov ecx, dword [ebp - 0x184]
sub ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x188], ecx
jmp 0x40303e
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov edx, dword [ebp - 0x184]
add edx, 1
mov dword [ebp - 0x184], edx
jmp 0x402fe2
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x15c]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x15c], edx
jmp 0x402da9
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x154]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402d74
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 0xd4
mov al, 0x98
mov al, 0x37
mov al, 0x16
mov al, 0x38
mov al, 0xb1
mov al, 0x85
xor al, al
mov esp, ebp
pop ebp
ret