Function at 0x402e40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov byte [ebp - 0x150], 0
xor eax, eax
mov dword [ebp - 0x14f], eax
mov dword [ebp - 0x14b], eax
mov dword [ebp - 0x147], eax
mov dword [ebp - 0x143], eax
mov dword [ebp - 0x13f], eax
mov dword [ebp - 0x13b], eax
mov dword [ebp - 0x137], eax
mov word [ebp - 0x133], ax
mov byte [ebp - 0x131], al
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
jne 0x402ec8
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
xor al, al
jmp 0x4032a7
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov dword [ebp - 0x130], 0x128
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x154]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x402f2d
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4032a7
mov dword [ebp - 0x15c], 0
mov dword [ebp - 4], 0
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00402d30
add esp, 4
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov dword [ebp - 0x15c], 0x46c050
mov edx, dword [ebp - 0x15c]
movsx eax, byte [edx]
test eax, eax
je 0x40324d
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov ecx, dword [ebp - 0x15c]
add ecx, 2
mov dword [ebp - 0x178], ecx
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
lea edx, [ebp - 0x150]
test edx, edx
je 0x402fca
cmp dword [ebp - 0x178], 0
jne 0x402fdf
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
jmp 0x403078
mov dword [ebp - 0x174], 0
jmp 0x402ffa
mov eax, dword [ebp - 0x174]
add eax, 1
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x178]
add ecx, dword [ebp - 0x174]
movsx edx, byte [ecx]
test edx, edx
je 0x40304a
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov eax, dword [ebp - 0x178]
add eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x174]
mov dl, byte [eax]
mov byte [ebp + ecx - 0x150], dl
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
jmp 0x402feb
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov eax, dword [ebp - 0x174]
mov byte [ebp + eax - 0x150], 0
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x17c], ecx
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov edx, dword [ebp - 0x17c]
movsx eax, byte [edx]
test eax, eax
jne 0x4030e7
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov ecx, dword [ebp - 0x17c]
lea edx, [ebp - 0x150]
sub ecx, edx
mov dword [ebp - 0x180], ecx
jmp 0x403108
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov eax, dword [ebp - 0x17c]
add eax, 1
mov dword [ebp - 0x17c], eax
jmp 0x4030a4
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x158], ecx
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov dword [ebp - 0x160], 0
jmp 0x40313f
mov edx, dword [ebp - 0x160]
add edx, 1
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x158]
jge 0x40316d
mov ecx, dword [ebp - 0x160]
movsx edx, byte [ebp + ecx - 0x150]
add edx, 2
mov eax, dword [ebp - 0x160]
mov byte [ebp + eax - 0x150], dl
jmp 0x403130
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x10c]
push edx
call fcn.00407328
add esp, 8
test eax, eax
jne 0x4031b4
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov eax, dword [ebp - 0x15c]
mov al, byte [eax]
jmp 0x4032a7
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x184], ecx
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
jne 0x403211
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov ecx, dword [ebp - 0x184]
sub ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x188], ecx
jmp 0x403232
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov edx, dword [ebp - 0x184]
add edx, 1
mov dword [ebp - 0x184], edx
jmp 0x4031d0
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x15c]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x15c], edx
jmp 0x402f77
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x154]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402f3e
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 0x73
mov al, 0xfb
mov al, 0xf2
mov al, 0xf3
mov al, 0x36
mov al, 0x74
mov al, 0x8b
mov al, 0x4d
xor al, al
mov esp, ebp
pop ebp
ret