Function at 0x43fc25
Capabilities:
Enumerate processes

Disassembly:
push ebp
push ebx
mov edx, 0x97
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x43fc2c
call fcn.005873a0
mov edx, dword [esp + 0x268]
lea ecx, [esp]
call fcn.004fc000
mov dword [section..data], 0x17000d7
mov dword [section..data], 0x17000e3
mov dword [esp + 0xc], 0
mov dword [section..data], 0x17000e4
mov dword [esp + 0x10], 0
mov dword [section..data], 0x17000e7
mov dword [esp + 0x1c], 0
mov dword [section..data], 0x17000e8
mov dword [esp + 0x20], 0
mov dword [section..data], 0x17000eb
mov dword [esp + 0x254], 1
mov dword [section..data], 0x17000ee
mov dword [section..data], 0x17000f0
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push 0x1f4
call fcn.00575d90
lea eax, [esp + 0x18]
push eax
call fcn.005872c0
mov dword [section..data], 0x17000f1
push dword [esp + 0x14]
call fcn.00575080
mov dword [esp + 0x18], eax
mov dword [section..data], 0x17000f3
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 8]
call fcn.00578e6d
lea eax, [esp + 8]
push eax
call fcn.005872c0
mov dword [section..data], 0x17000f4
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 8]
call fcn.00578d17
lea eax, [esp + 0xc]
push eax
call fcn.005872c0
mov dword [section..data], 0x17000f6
push edx
call fcn.00587290
pop edx
push eax
push 3
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.Filename__
push edx
call fcn.00587330
mov edx, dword [esp + 0xc]
push edx
call fcn.00587330
mov edx, str._____ExePath__
push edx
call fcn.00587330
mov edx, dword [esp + 0x14]
push edx
call fcn.00587330
mov edx, str.__ExeFile__
push edx
call fcn.00587330
mov edx, dword [esp + 0x10]
push edx
call fcn.00587330
mov edx, 0x6bef86
push edx
call fcn.00587330
call fcn.00587380
mov eax, str._GetProcData
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x17000f8
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x10], eax
mov dword [section..data], 0x17000fa
mov ebx, dword [esp + 0x10]
cmp ebx, 0xffffffff
jne 0x43fe58
mov dword [section..data], 0x17000fb
push 0
mov eax, str.Failed_to_exec_CreateToolhelp32Snapshot___InvalidHandleValue
push eax
mov eax, str._GetProcData
push eax
call fcn.0043fbb5
mov dword [section..data], 0x17000fc
mov dword [esp + 0x254], 0xfffff7cb
mov dword [section..data], 0x17000fd
jmp 0x4406ae
mov dword [section..data], 0x17000fe
mov dword [section..data], 0x1700100
lea ebp, [esp + 0x24]
mov dword [ebp], 0x22c
mov dword [section..data], 0x1700101
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32FirstW
and eax, eax
je 0x43fe97
xor eax, eax
jmp 0x43fe9c
mov eax, 1
and eax, eax
je 0x43ffc0
mov dword [section..data], 0x1700102
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x250], eax
mov dword [section..data], 0x1700103
mov ebx, dword [esp + 0x250]
cmp ebx, 0x12
jne 0x43feff
mov dword [section..data], 0x1700104
push 3
mov eax, str.No_running_processes_detected
push eax
mov eax, str._GetProcData
push eax
call fcn.0043fbb5
mov dword [section..data], 0x1700105
jmp 0x4406ae
mov dword [section..data], 0x1700106
mov dword [section..data], 0x1700108
push edx
call fcn.00587290
pop edx
push eax
push 0
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.Failed_to_get_Process32First____
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x264]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6db8ba
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x260]
call fcn.0043f2a5
pop eax
mov edx, 0x6bdecc
push edx
call fcn.00587330
call fcn.00587380
mov eax, str._GetProcData
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x1700109
mov dword [esp + 0x254], 0xfffff7ca
mov dword [section..data], 0x170010a
jmp 0x4406ae
mov dword [section..data], 0x170010b
mov dword [section..data], 0x170010d
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
lea ebp, [esp + 0x34]
lea eax, [ebp + 0x24]
push eax
call fcn.005870b0
call fcn.004fc302
add dword [esp], edx
call fcn.00575d20
call fcn.00587380
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x10]
call fcn.00575d20
call fcn.004fc330
mov edx, eax
pop ecx
push ecx
call fcn.004fc330
mov ecx, eax
call fcn.004fc340
je 0x440302
mov dword [section..data], 0x170010e
lea ebp, [esp + 0x24]
push dword [ebp + 8]
pop eax
mov dword [esp + 0xc], eax
mov dword [section..data], 0x170010f
push edx
call fcn.00587290
pop edx
push eax
push 3
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.Detected_process__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x20]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6bef86
push edx
call fcn.00587330
call fcn.00587380
mov eax, str._GetProcData
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x1700111
push dword [esp + 8]
mov edx, 0x6bb5f6
pop ecx
call fcn.004fc340
jne 0x440294
mov dword [section..data], 0x1700113
lea eax, [esp + 0x258]
push eax
push dword [esp + 8]
push dword [esp + 0x14]
call fcn.0044076c
mov dword [esp + 0x250], eax
mov dword [section..data], 0x1700114
mov ebx, dword [esp + 0x250]
cmp ebx, 1
jge 0x4401bc
mov dword [section..data], 0x1700115
push edx
call fcn.00587290
pop edx
push eax
push 0
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.Getting_fullpath_from_pid_failed____
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x260]
call fcn.0043f402
pop eax
mov edx, 0x6bef86
push edx
call fcn.00587330
call fcn.00587380
mov eax, str._GetProcData
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x1700116
push dword [esp + 0x250]
pop eax
mov dword [esp + 0x254], eax
mov dword [section..data], 0x1700117
jmp 0x4406ae
mov dword [section..data], 0x1700118
mov dword [section..data], 0x170011a
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
lea ebp, [esp + 0x260]
push dword [ebp]
call fcn.00575d20
call fcn.00587380
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0xc]
call fcn.00575d20
call fcn.004fc330
mov edx, eax
pop ecx
push ecx
call fcn.004fc330
mov ecx, eax
call fcn.004fc340
je 0x44027e
mov dword [section..data], 0x170011b
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x44024c
mov ebx, dword [esp + 0x270]
cmp ebx, 1
jne 0x44024c
mov eax, 1
jmp 0x44024e
xor eax, eax
and eax, eax
je 0x440261
mov dword [section..data], 0x170011c
jmp 0x4406ae
mov dword [section..data], 0x170011d
mov dword [section..data], 0x170011e
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x170011f
mov dword [section..data], 0x1700120
jmp 0x4402f8
mov dword [section..data], 0x1700120
mov dword [section..data], 0x1700121
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x4402c6
mov ebx, dword [esp + 0x270]
cmp ebx, 1
jne 0x4402c6
mov eax, 1
jmp 0x4402c8
xor eax, eax
and eax, eax
je 0x4402db
mov dword [section..data], 0x1700122
jmp 0x4406ae
mov dword [section..data], 0x1700123
mov dword [section..data], 0x1700125
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x1700126
mov dword [section..data], 0x1700127
mov dword [section..data], 0x1700129
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32NextW
and eax, eax
je 0x440691
mov dword [section..data], 0x170012a
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
lea ebp, [esp + 0x34]
lea eax, [ebp + 0x24]
push eax
call fcn.005870b0
call fcn.004fc302
add dword [esp], edx
call fcn.00575d20
call fcn.00587380
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x10]
call fcn.00575d20
call fcn.004fc330
mov edx, eax
pop ecx
push ecx
call fcn.004fc330
mov ecx, eax
call fcn.004fc340
je 0x440678
mov dword [section..data], 0x170012b
lea ebp, [esp + 0x24]
push dword [ebp + 8]
pop eax
mov dword [esp + 0xc], eax
mov dword [section..data], 0x170012c
push edx
call fcn.00587290
pop edx
push eax
push 3
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.Detected_process__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x20]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, str.__for_file__
push edx
call fcn.00587330
mov edx, dword [esp + 0x10]
push edx
call fcn.00587330
mov edx, 0x6bef86
push edx
call fcn.00587330
call fcn.00587380
mov eax, str._GetProcData
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x170012e
push dword [esp + 8]
mov edx, 0x6bb5f6
pop ecx
call fcn.004fc340
jne 0x44060c
mov dword [section..data], 0x1700130
lea eax, [esp + 0x258]
push eax
push dword [esp + 8]
push dword [esp + 0x14]
call fcn.0044076c
mov dword [esp + 0x250], eax
mov dword [section..data], 0x1700131
mov ebx, dword [esp + 0x250]
cmp ebx, 1
jge 0x440533
mov dword [section..data], 0x1700132
push edx
call fcn.00587290
pop edx
push eax
push 0
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.Getting_fullpath_from_pid_failed____
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x260]
call fcn.0043f402
pop eax
mov edx, 0x6bef86
push edx
call fcn.00587330
call fcn.00587380
mov eax, str._GetProcData
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x1700133
push dword [esp + 0x250]
pop eax
mov dword [esp + 0x254], eax
mov dword [section..data], 0x1700134
jmp 0x440691
mov dword [section..data], 0x1700135
mov dword [section..data], 0x1700137
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
lea ebp, [esp + 0x260]
push dword [ebp]
call fcn.00575d20
call fcn.00587380
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0xc]
call fcn.00575d20
call fcn.004fc330
mov edx, eax
pop ecx
push ecx
call fcn.004fc330
mov ecx, eax
call fcn.004fc340
je 0x4405f6
mov dword [section..data], 0x1700138
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x170013a
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x4405d7
mov ebx, dword [esp + 0x270]
cmp ebx, dword [esp + 0x20]
jne 0x4405d7
mov eax, 1
jmp 0x4405d9
xor eax, eax
and eax, eax
je 0x4405ec
mov dword [section..data], 0x170013b
jmp 0x440691
mov dword [section..data], 0x170013c
mov dword [section..data], 0x170013e
mov dword [section..data], 0x170013f
jmp 0x44066e
mov dword [section..data], 0x170013f
mov dword [section..data], 0x1700140
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x1700142
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x440652
mov ebx, dword [esp + 0x270]
cmp ebx, dword [esp + 0x20]
jne 0x440652
mov eax, 1
jmp 0x440654
xor eax, eax
and eax, eax
je 0x440664
mov dword [section..data], 0x1700143
jmp 0x440691
mov dword [section..data], 0x1700144
mov dword [section..data], 0x1700146
mov dword [section..data], 0x1700147
mov dword [section..data], 0x1700148
jmp 0x44030c
mov dword [section..data], 0x170014a
push dword [esp + 0x10]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x170014c
mov dword [section..data], 0x170014e
mov ebx, dword [esp + 0x254]
cmp ebx, 1
jge 0x4406d7
mov dword [section..data], 0x170014f
mov eax, dword [esp + 0x254]
jmp 0x44072c
mov dword [section..data], 0x1700150
mov dword [section..data], 0x1700152
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x440706
mov dword [section..data], 0x1700153
mov eax, dword [esp + 0xc]
jmp 0x44072c
mov dword [section..data], 0x1700154
mov dword [section..data], 0x1700156
mov eax, dword [esp + 0x20]
jmp 0x44072c
push dword [esp + 0x14]
call fcn.00587410
push dword [esp + 8]
call fcn.00587410
push dword [esp]
call fcn.00587410
lea edx, [esp + 0x258]
push 0x6f50c8
push edx
call fcn.0052ac2b
push dword [esp + 4]
call fcn.00587410
add esp, 0x25c
pop ebx
pop ebp
ret 0xc