Function at 0x447af0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4b8548
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4dc
push ebx
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], 0
call sub.MFC42u.DLL_CString::CString_1
push 0
push 2
mov dword [esp + 0x4f8], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0xb4]
push eax
push esi
mov dword [esp + 0x34], esi
mov dword [esp + 0xbc], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x447eaa
mov esi, dword [esp + 0x4fc]
lea ecx, [esp + 0xd8]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_2
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e2]
mov word [esp + 0x2e0], 0
rep stosd dword es:[edi], eax
push ecx
mov byte [esp + 0x4f4], 2
mov ecx, esp
mov dword [esp + 0x48], esp
push str.IMONITOR_ID_30051
stosw word es:[edi], ax
call sub.MFC42u.DLL_CString::CString_4
lea edx, [esp + 0x34]
push 0x4e2a30
push edx
call fcn.004285b0
mov eax, dword [eax]
push eax
lea eax, [esp + 0x2f0]
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 0x14
lea ecx, [esp + 0x30]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xbc]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10]
push edx
mov edi, eax
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 0x10]
mov byte [esp + 0x4f0], 3
call sub.MFC42u.DLL_CString::MakeLower
mov eax, dword [esp + 0xbc]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.004479c0
add esp, 8
push str.explorer.exe
lea ecx, [esp + 0x28]
mov byte [esp + 0x4f4], 4
call sub.MFC42u.DLL_CString::CString_4
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
lea ecx, [esp + 0x24]
test eax, eax
sete bl
call sub.MFC42u.DLL_CString::CString
test bl, bl
je 0x447c67
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_2
test edi, edi
je 0x447e57
mov eax, dword [esi + 8]
lea edx, [esp + 0xc]
push edx
push eax
mov ecx, esi
call sub.MFC42u.DLL_CStringArray::SetAtGrow
mov eax, dword [esi + 8]
lea ecx, [esp + 0x20]
push ecx
push eax
mov ecx, esi
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea edx, [esp + 0x48]
lea eax, [esp + 0x3c]
push edx
push 4
push eax
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x447cbd
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x2e0]
push 0x208
push ecx
push edx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [esp + 0x8c]
push 0x28
push eax
push edi
call sub.PSAPI.DLL_GetProcessMemoryInfo
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0xc]
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
push eax
push 0x4cf4dc
push ecx
call sub.MFC42u.DLL_CString::Format
mov eax, dword [esi + 8]
add esp, 0xc
lea edx, [esp + 0xc]
mov ecx, esi
push edx
push eax
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea eax, [esp + 0xd8]
lea ecx, [esp + 0x28]
push eax
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x28]
mov byte [esp + 0x4f0], 5
call sub.MFC42u.DLL_CString::MakeLower
lea ecx, [esp + 0x4c]
call fcn.00435fb0
lea ecx, [esp + 0x18]
mov byte [esp + 0x4f0], 6
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4f0], 7
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x2e0]
mov byte [esp + 0x4f0], 8
push ecx
lea ecx, [esp + 0x50]
call fcn.00436000
test eax, eax
je 0x447dd9
lea edx, [esp + 0x34]
push str.ProductName
push edx
lea ecx, [esp + 0x54]
call fcn.004361e0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4f4], 9
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 0x34]
mov byte [esp + 0x4f0], 8
call sub.MFC42u.DLL_CString::CString
lea eax, [esp + 0x38]
push 0x4d0644
push eax
lea ecx, [esp + 0x54]
call fcn.004361e0
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x4f4], 0xa
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 0x38]
mov byte [esp + 0x4f0], 8
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esi + 8]
lea ecx, [esp + 0x18]
push ecx
push eax
mov ecx, esi
call sub.MFC42u.DLL_CStringArray::SetAtGrow
mov eax, dword [esi + 8]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, esi
call sub.MFC42u.DLL_CStringArray::SetAtGrow
mov eax, dword [esi + 8]
lea ecx, [esp + 0x2e0]
push ecx
push eax
mov ecx, esi
call sub.MFC42u.DLL_CStringArray::SetAtGrow_1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4f0], 7
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x4f0], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x4f0], 5
call fcn.00435fe0
lea ecx, [esp + 0x28]
mov byte [esp + 0x4f0], 4
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xb4]
push edx
push eax
call sub.KERNEL32.dll_Process32NextW
lea ecx, [esp + 0x20]
mov edi, eax
mov byte [esp + 0x4f0], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x4f0], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x4f0], 1
call sub.MFC42u.DLL_CString::CString
test edi, edi
jne 0x447b61
mov esi, dword [esp + 0x2c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x4f8]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_3
mov dword [esp + 0x40], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x4f0], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x4e8]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x4e8
ret