Function at 0x4185e4
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcb4
mov eax, 0x4c936c
push ebx
push esi
push edi
call fcn.0049fef4
lea edi, [ebp - 0x224]
mov esi, str.__t_n_a
mov ecx, 0x3c
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x20], 8
xor eax, eax
mov dword [ebp - 4], eax
inc dword [ebp - 0x14]
xor esi, esi
mov word [ebp - 0x20], 0x14
mov edx, dword [ebp + 8]
mov dword [edx + 0x1d68], 0xffffffff
push 0x14
mov eax, esi
shl eax, 2
lea eax, [eax + eax*4]
lea edx, [ebp - 0x224]
add eax, edx
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.0049fa50
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x44]
mov ecx, eax
inc eax
shl ecx, 2
push ecx
mov cl, 0x64
pop ebx
sub cl, bl
xor byte [edx], cl
inc edx
cmp eax, 0x14
jl 0x418653
mov eax, esi
lea edx, [ebp - 0x134]
shl eax, 2
push esi
lea edi, [ebp - 0x44]
lea eax, [eax + eax*4]
add eax, edx
mov esi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
inc esi
cmp esi, 0xc
jl 0x41862f
push 0x19000
call fcn.0049f2bc
pop ecx
mov edi, eax
push 0x19000
push 0
push edi
call fcn.0049fac0
add esp, 0xc
xor esi, esi
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov word [ebp - 0x20], 0x14
mov ebx, eax
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x34c], 0x128
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
lea edx, [ebp - 0x328]
push edx
call fcn.0049fbf4
pop ecx
add eax, esi
mov esi, eax
cmp esi, 0x19000
jge 0x418799
mov word [ebp - 0x20], 0x20
lea edx, [ebp - 0x328]
lea eax, [ebp - 8]
call fcn.004adb50
mov edx, eax
inc dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.004adc7c
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004adc4c
mov word [ebp - 0x20], 0x2c
xor ecx, ecx
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 4]
inc dword [ebp - 0x14]
call fcn.004ade88
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004adc7c
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004adc4c
cmp dword [ebp - 4], 0
je 0x418775
mov ecx, dword [ebp - 4]
jmp 0x41877a
mov ecx, 0x4c5e70
push ecx
push edi
call fcn.0049fb64
add esp, 8
lea eax, [ebp - 0x34c]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4186e8
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor esi, esi
mov eax, esi
shl eax, 2
lea eax, [eax + eax*4]
lea edx, [ebp - 0x134]
add eax, edx
push eax
push edi
call fcn.0049fced
add esp, 8
test eax, eax
je 0x418864
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x34c], 0x128
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
mov edx, esi
shl edx, 2
lea edx, [edx + edx*4]
lea ecx, [ebp - 0x134]
add edx, ecx
push edx
lea eax, [ebp - 0x328]
push eax
call fcn.0049fced
add esp, 8
test eax, eax
je 0x41881d
mov eax, dword [ebp - 0x344]
mov edx, dword [ebp + 8]
add edx, 0x1fc4
mov dword [edx + 0x2c], eax
jmp 0x41882e
lea ecx, [ebp - 0x34c]
push ecx
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4187e5
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp + 8]
mov edx, 2
mov dword [eax + 0x1d68], 2
mov eax, 1
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x14]
call fcn.004adc4c
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x4188ce
inc esi
cmp esi, 0xc
jl 0x4187a1
call fcn.00442494
and eax, 0xff
test eax, eax
je 0x41889f
mov eax, 1
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x14]
call fcn.004adc4c
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x4188ce
inc eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x1d68], eax
push edi
call fcn.0049f0e4
pop ecx
xor eax, eax
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004adc4c
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret