Function at 0x407310
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x14c], 0
push ebx
push esi
xor bl, bl
mov dword [ebp - 0x154], eax
mov byte [eax], bl
lea eax, [ebp - 0x14c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push eax
call esi
test eax, eax
jne 0x4073dd
cmp dword [0x43ba80], eax
je 0x4073d3
lea ecx, [ebp - 0x1c]
call fcn.004011a0
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x407374
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2d9
push str.D:qianliu_agentworkspace0mq_gitlab7538NetProxyInstCa_firefox_ca.cpp
push esi
push str._ERROR___s__s:_d_tProcessIdToSessionId_current_process_failed__LastError_d_n
push dword [0x43ba80]
call fcn.00402120
mov edx, dword [ebp - 8]
add esp, 0x18
cmp edx, 0x10
jb 0x4073cd
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4073c3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4076a5
push edx
push ecx
call fcn.0040f6ee
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov dword [ebp - 0x14c], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x407474
cmp dword [0x43ba80], 0
je 0x407522
lea ecx, [ebp - 0x1c]
call fcn.004011a0
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x407411
mov esi, dword [esi]
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push 0x2e3
push str.D:qianliu_agentworkspace0mq_gitlab7538NetProxyInstCa_firefox_ca.cpp
push esi
push str._ERROR___s__s:_d_tCreateToolhelp32Snapshot_failed__LastError_d_n
push dword [0x43ba80]
call fcn.00402120
mov edx, dword [ebp - 8]
add esp, 0x18
cmp edx, 0x10
jb 0x407522
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407465
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4076aa
push edx
push ecx
call fcn.0040f6ee
add esp, 8
jmp 0x407522
push 0x124
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.004136c0
add esp, 0xc
mov dword [ebp - 0x148], 0x128
lea eax, [ebp - 0x148]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x407540
cmp dword [0x43ba80], eax
je 0x40751e
lea ecx, [ebp - 0x1c]
call fcn.004011a0
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x4074c4
mov esi, dword [esi]
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push 0x2ef
push str.D:qianliu_agentworkspace0mq_gitlab7538NetProxyInstCa_firefox_ca.cpp
push esi
push str._ERROR___s__s:_d_tProcess32First_failed__LastError_d_n
push dword [0x43ba80]
call fcn.00402120
mov edx, dword [ebp - 8]
add esp, 0x18
cmp edx, 0x10
jb 0x40751e
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407514
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4076af
push edx
push ecx
call fcn.0040f6ee
add esp, 8
test edi, edi
je 0x407529
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f469
mov esp, ebp
pop ebp
ret
mov ecx, str.firefox.exe
lea eax, [ebp - 0x124]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407570
test dl, dl
je 0x40756c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407570
add eax, 2
add ecx, 2
test dl, dl
jne 0x407550
xor eax, eax
jmp 0x407575
sbb eax, eax
or eax, 1
test eax, eax
jne 0x407684
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x140]
call esi
test eax, eax
jne 0x407617
cmp dword [0x43ba80], eax
je 0x407684
lea ecx, [ebp - 0x1c]
call fcn.004011a0
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x4075b8
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x300
push str.D:qianliu_agentworkspace0mq_gitlab7538NetProxyInstCa_firefox_ca.cpp
push esi
push str._ERROR___s__s:_d_tProcessIdToSessionId_firefox_process_failed__LastError_d_n
push dword [0x43ba80]
call fcn.00402120
mov edx, dword [ebp - 8]
add esp, 0x18
cmp edx, 0x10
jb 0x407684
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40760b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4076a5
push edx
push ecx
call fcn.0040f6ee
add esp, 8
jmp 0x407684
mov eax, dword [ebp - 0x14c]
test eax, eax
je 0x407629
cmp eax, dword [ebp - 0x150]
jne 0x407684
mov esi, dword [0x43beac]
mov ecx, esi
mov edx, dword [ebp - 0x140]
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x407654
cmp dword [eax + 0x10], edx
jae 0x40764a
mov eax, dword [eax + 8]
jmp 0x40764e
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x407640
cmp byte [ecx + 0xd], 0
jne 0x407667
cmp edx, dword [ecx + 0x10]
jb 0x407667
cmp ecx, esi
je 0x407667
mov bl, 1
jmp 0x407684
mov eax, dword [ebp - 0x154]
mov bl, 1
mov byte [eax], bl
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.004086c0
lea eax, [ebp - 0x148]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x40751e
mov esi, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
jmp 0x407540
call fcn.00415003
call fcn.00415003
call fcn.00415003
int3