Function at 0x72bc61
Capabilities:
Enumerate processes

Disassembly:
push 0x9b8
mov eax, 0x7b2ad4
call fcn.00774621
push 0x36
pop ecx
mov esi, str.2PfX4KDsHmu6AB2dVUP5LygVGvnB8vh3Z17O0T0Ucm4FwrADMx0ylWjOjPKRtn0OcQLPsLKbitAq4vxQMZCHGcvUGhdNe3SDMIfWCjYyFvYdc3My8I8V6Ty6QdbxT6VGUeB4eod8E6SvHkKqWqbbKQT3ldplrNQpl0hPtkM4NtKIEseeyZQeg3G2QeVyEj8jWGqmFlkFY0zX1u8JOTj26Chxk
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0xec]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x72
pop ecx
mov dword [ebp - 0x9b8], eax
movsw word es:[edi], word [esi]
mov esi, str.ESEsDEt5B6QjNEqRyJxuLuvaTFV7xUMVQ5bCQWZVKglaaduz9l5ueoV7RmgswJpcE99NcJtiurb22yb1ZdMOxKLdn1cSXQZvg22fKpFIQXomdcifY9McFKoLtOY7vqrYaxzOvHgQRT1YshVS07WNh0rtTVzBjDzfGyyHNjNSf0pCGt1j6dBPSzWCdCvxq7zECikadlv2R6P1IHH81jzUA8Gz1VOfC5CGt7DnGmUozafLLKKJ58uKa8kemdMbFm9llyZyNqFkvdgenudC1YZK9lmawuW3E6Ila0lQgNFpNoleZ9Wtw3GiidyK9IUfnBKrtibO8FwZ2zEKAh9LBkbe2QPzS07ErPyF88CyCusdny4kA7xiX1hxtHGUZw6QYpGT96fD21anlkmUeEeMaK0tIgI9YkH3sMg3OMwvCeeI4etm9aJnlbSiQ7a9Rq9Tq69vf7Ilmtcx
mov dword [ebp - 0x9b4], eax
lea edi, [ebp - 0x560]
mov dword [ebp - 0x9b0], eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x744]
lea eax, [ebp - 0xec]
push eax
call fcn.00405a00
lea eax, [ebp - 0x744]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x9b8]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x744]
mov byte [ebp - 4], 0
call fcn.006eb1be
lea eax, [ebp - 0x560]
push eax
lea ecx, [ebp - 0x744]
call fcn.00405a00
lea eax, [ebp - 0x744]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x9b8]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x744]
mov byte [ebp - 4], 0
call fcn.006eb1be
test ebx, ebx
jne 0x72bd2e
xor esi, esi
jmp 0x72bfa1
push ebx
lea ecx, [ebp - 0x75c]
call fcn.004026c0
lea eax, [ebp - 0x75c]
mov byte [ebp - 4], 3
push eax
call fcn.0073897a
mov dword [esp], 0x22c
lea eax, [ebp - 0x9a0]
push 0
push eax
call fcn.007512b0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x72bd79
xor esi, esi
jmp 0x72bf92
xor eax, eax
mov dword [ebp - 0x9c4], eax
mov dword [ebp - 0x9c0], eax
mov dword [ebp - 0x9bc], eax
push 0x42
pop ecx
mov esi, str.z37P7xAg8L36ncmjQcPsXqti0KA9gmVZgL70wJ7CpLt0huzQxeG9ePsQrT9nyOVGX3vkBQeNpfL7xCMYaBWSEPr4q1Ny3FPf16ACQB2aLOhVSwJ9735k9V0uDbuIjVwo3dDGqQVLT2YJzxhK0YjmaY9sc8hQpgh5uxlTBi0BYpWi9LKCHAcyU6m09C0ifAK4sJSMXOtuM5RsNEcXCipRQASxRIFnRmhq2bIvdDr6uqWkfC7U812rEjZLcThbegnwymfLL4X
mov byte [ebp - 4], 4
lea edi, [ebp - 0x1f4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1f4]
push eax
lea ecx, [ebp - 0x744]
call fcn.00405a00
lea eax, [ebp - 0x744]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x9c4]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x744]
mov byte [ebp - 4], 4
call fcn.006eb1be
lea eax, [ebp - 0x9a0]
mov dword [ebp - 0x9a0], 0x22c
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
jmp 0x72bf0d
and dword [ebp - 0x734], 0
xor eax, eax
mov dword [ebp - 0x730], 7
mov word [ebp - 0x744], ax
cmp word [ebp - 0x97c], ax
je 0x72be28
lea eax, [ebp - 0x97c]
push eax
call fcn.00761599
pop ecx
push eax
lea eax, [ebp - 0x97c]
push eax
lea ecx, [ebp - 0x744]
call fcn.00402820
xor eax, eax
mov dword [ebp - 0x9ac], eax
mov dword [ebp - 0x9a8], eax
mov dword [ebp - 0x9a4], eax
push 0x72
pop ecx
mov esi, str.LC94wMLNuNb1CDU9Lp0JLSCnPG8W954MhKErIfZgBQmdaO2oitZSdQfSbjTHWr9tZXUwXig7hN44K11Y0eDmMwoXsWp1KeS1tKTcJwknGf1nOVs2n7z3kn0TWfU3KXR7PuZUpIZGlBQmHCiqjF7pfDvlVvGWwxq0CIvnUy1nXlQuLbVn1uSYyFhvZB2M95bRGFyUFlBfNE1OzZwGRrDgUmbgreK0zp121pdZ8DfkFdpquJke7LARTYH1lGOTaMNgp5d3qIJz2LuvZIfQiAXEiWvRTz91BXwOdOKNjW1t2ptk0ediiH19Nlw3jjpJnmMyvXch0zNVGwVn5zjP3HIDlFeyLsO0ezeB551g3ZQuCmolWTZSRDMnUfVeI6q1GoihfcNLHKbBEVEOAfPf84ABizBfGyd7vxE613eXt7jYG0wGndjFFS2CBTKzY6Sw2iV0mD7KwPWl
mov byte [ebp - 4], 7
lea edi, [ebp - 0x72c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x72c]
push eax
lea ecx, [ebp - 0x774]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x774]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x9ac]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x774]
mov byte [ebp - 4], 7
call fcn.006eb1be
lea eax, [ebp - 0x744]
push eax
call fcn.0073897a
cmp dword [ebp - 0x748], 8
lea eax, [ebp - 0x75c]
pop ecx
push dword [ebp - 0x74c]
cmovae eax, dword [ebp - 0x75c]
lea ecx, [ebp - 0x744]
push eax
push dword [ebp - 0x734]
push 0
call fcn.00424ed0
test eax, eax
je 0x72bfb4
lea ecx, [ebp - 0x9ac]
call fcn.006eb210
push 0
push 1
lea ecx, [ebp - 0x744]
mov byte [ebp - 4], 4
call fcn.00402760
lea eax, [ebp - 0x9a0]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x72bdf8
mov dword [ebp - 0x9ac], eax
mov dword [ebp - 0x9a8], eax
mov dword [ebp - 0x9a4], eax
push 0x67
pop ecx
mov esi, str.oHRMOXAqgMHzhEns5F6gkUU7taoALz9E3keeQr0kDzJtX6QlpuI5n0EVcsGEKYkdsKcn04HYI5kBZ4uGWagKaXN93L2sreLe7Pbh5DwjeqsPSiviftZlSlWYAbzdkEtanPLACv2sIJsTEiF5NYfmZEw7U7ZxB5bcfv2QM8yAiGwroF8PAdnoLxz2cHvqMLa944caD7Tzo5asdBKIvYaViEY69U1xqmLEbq28muWGbqj3SGyHFzHLtkPy0kvwLE89AWe6gmN2RiF8255KRlFQKxGIYZZJExWnsrFvIZepkFIltqbFyHqpKgHLNNakmsCjzyq583iDZhbkuxZVi3PinSZYv4dxxUKJuWFa5G60vtbSz28sDeBNI0o1fjjVkLr0d19gaC2qFb0elJnqiSkhyM8IxKlG
mov byte [ebp - 4], 9
lea edi, [ebp - 0x394]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x394]
push eax
lea ecx, [ebp - 0x774]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x774]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x9ac]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x774]
call fcn.006eb1be
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x9ac]
xor esi, esi
call fcn.006eb210
lea ecx, [ebp - 0x9c4]
call fcn.006eb210
push 0
push 1
lea ecx, [ebp - 0x75c]
call fcn.00402760
lea ecx, [ebp - 0x9b8]
call fcn.006eb210
mov eax, esi
call fcn.007745cb
ret
call fcn.006eca25
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x998]
lea ecx, [ebp - 0x9ac]
call fcn.006eb210
push 0
push 1
lea ecx, [ebp - 0x744]
call fcn.00402760
jmp 0x72bf87