Function at 0x415e30
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov eax, dword [0x423100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x604], esi
mov dword [ebp - 0x608], edi
mov dword [ebp - 0x60c], eax
mov dword [ebp - 0x258], 0xddfb1487
mov dword [ebp - 0x254], 0x664efdbd
mov dword [ebp - 0x250], 0xb15bb3cb
mov dword [ebp - 0x24c], 0xd0f4c46b
mov dword [ebp - 0x248], 0xb17232dd
mov dword [ebp - 0x244], 0x5b5fe287
mov dword [ebp - 0x240], 0x3aae119e
mov dword [ebp - 0x23c], 0x292cda84
mov dword [ebp - 0x238], 0x77915314
mov dword [ebp - 0x234], 0x70cd40e7
mov dword [ebp - 0x230], 0xd0c6b123
mov dword [ebp - 0x22c], 0x753b60ab
mov dword [ebp - 0x228], 0xb04ccda6
mov dword [ebp - 0x224], 0x9421fe94
mov dword [ebp - 0x220], 0x5bcda5cb
mov dword [ebp - 0x21c], 0x21df2b4a
mov dword [ebp - 0x218], 0xf77f96f5
mov dword [ebp - 0x214], 0x1ef00a2
mov dword [ebp - 0x210], 0xafa18e6
mov dword [ebp - 0x20c], 0xb394a70e
mov dword [ebp - 0x208], 0x6622a72c
mov dword [ebp - 0x204], 0x17caec45
mov dword [ebp - 0x200], 0xb6789e30
mov dword [ebp - 0x1fc], 0x411b7629
mov dword [ebp - 0x1f8], 0x8c5b37bd
mov dword [ebp - 0x1f4], 0xf2932e59
mov dword [ebp - 0x1f0], 0xf9fe0be5
mov dword [ebp - 0x1ec], 0x3a2bdc29
mov dword [ebp - 0x118], 0x22c905f7
mov dword [ebp - 0x114], 0xd0fa2930
mov dword [ebp - 0x110], 0x63945710
mov dword [ebp - 0x10c], 0xa8839bc8
mov dword [ebp - 0x148], 0x81d4726
mov dword [ebp - 0x144], 0xb6b9d9fc
mov dword [ebp - 0x140], 0xd4f1f59b
mov dword [ebp - 0x13c], 0x85cda62b
mov dword [ebp - 0x138], 0x7da07933
mov dword [ebp - 0x134], 0xa63f00fd
mov dword [ebp - 0x130], 0x8a13a82
mov dword [ebp - 0x12c], 0x125d77ec
mov dword [ebp - 0x128], 0x741dbd04
mov dword [ebp - 0x124], 0x153fa6fc
mov dword [ebp - 0x120], 0xbfc21faa
mov dword [ebp - 0x11c], 0xb793b04a
mov dword [ebp - 0x168], 0xd0fc5a43
mov dword [ebp - 0x164], 0x6e3c3aac
mov dword [ebp - 0x160], 0xf99377f8
mov dword [ebp - 0x15c], 0xf911de7f
mov dword [ebp - 0x158], 0xf0595621
mov dword [ebp - 0x154], 0x752498aa
mov dword [ebp - 0x150], 0x1e2f6c99
mov dword [ebp - 0x14c], 0x82f70920
mov dword [ebp - 0x1e8], 0x2fc9f390
mov dword [ebp - 0x1e4], 0x946952cb
mov dword [ebp - 0x1e0], 0xb7eb80a0
mov dword [ebp - 0x1dc], 0x13be0c22
mov dword [ebp - 0x1d8], 0xb9ecf7f3
mov dword [ebp - 0x1d4], 0x16d647e3
mov dword [ebp - 0x1d0], 0xf84d8e84
mov dword [ebp - 0x1cc], 0xb301155c
mov dword [ebp - 0x1c8], 0x5d8f3ec0
mov dword [ebp - 0x1c4], 0xc500df64
mov dword [ebp - 0x1c0], 0xadd77783
mov dword [ebp - 0x1bc], 0x417831bf
mov dword [ebp - 0x1b8], 0xd1f05908
mov dword [ebp - 0x1b4], 0xf14a8bd6
mov dword [ebp - 0x1b0], 0x363b85fe
mov dword [ebp - 0x1ac], 0xe00861ca
mov dword [ebp - 0x1a8], 0xdb1bb39f
mov dword [ebp - 0x1a4], 0x62268d77
mov dword [ebp - 0x1a0], 0x946e4ba3
mov dword [ebp - 0x19c], 0xc6674184
mov dword [ebp - 0x368], 0x6b229588
mov dword [ebp - 0x364], 0x68e7bc55
mov dword [ebp - 0x360], 0x9ec53e5
mov dword [ebp - 0x35c], 0x3f9fb8fe
mov dword [ebp - 0x358], 0x6c48fdc4
mov dword [ebp - 0x354], 0x20618e89
mov dword [ebp - 0x350], 0xb3b8343
mov dword [ebp - 0x34c], 0xf1f101b2
mov dword [ebp - 0x348], 0x3d2c2046
mov dword [ebp - 0x344], 0xe32812d1
mov dword [ebp - 0x340], 0xce7143e1
mov dword [ebp - 0x33c], 0x34856404
mov dword [ebp - 0x338], 0x77446ce8
mov dword [ebp - 0x334], 0x189eb4d7
mov dword [ebp - 0x330], 0x9978cc5
mov dword [ebp - 0x32c], 0x2773667f
mov dword [ebp - 0x328], 0x81975114
mov dword [ebp - 0x324], 0x81dce21b
mov dword [ebp - 0x320], 0xb27c8f3b
mov dword [ebp - 0x31c], 0x31ff2e52
mov dword [ebp - 0x318], 0xd2d9f4d4
mov dword [ebp - 0x314], 0x6b4821d3
mov dword [ebp - 0x310], 0x12d59bcf
mov dword [ebp - 0x30c], 0x706f4262
mov dword [ebp - 0x308], 0x67984b54
mov dword [ebp - 0x304], 0xdfa0740e
mov dword [ebp - 0x300], 0x4c031a42
mov dword [ebp - 0x2fc], 0x859d20b7
mov dword [ebp - 0x2f8], 0x70892cb0
mov dword [ebp - 0x2f4], 0x99f3f185
mov dword [ebp - 0x2f0], 0x7b08e21
mov dword [ebp - 0x2ec], 0x14afe1bd
mov dword [ebp - 0x2e8], 0x555b6c90
mov dword [ebp - 0x2e4], 0xc9155561
mov dword [ebp - 0x2e0], 0x8e2d9196
mov dword [ebp - 0x2dc], 0x448c8447
mov dword [ebp - 0x2d8], 0x3d2c2046
mov dword [ebp - 0x2d4], 0xe32812d1
mov dword [ebp - 0x2d0], 0xce7143e1
mov dword [ebp - 0x2cc], 0x34856404
mov dword [ebp - 0x2c8], 0x46dcaa7b
mov dword [ebp - 0x2c4], 0x982bd494
mov dword [ebp - 0x2c0], 0x2976cfde
mov dword [ebp - 0x2bc], 0xcffa4781
mov dword [ebp - 0x2b8], 0xc80d82cc
mov dword [ebp - 0x2b4], 0xf48ed7aa
mov dword [ebp - 0x2b0], 0x5db679b7
mov dword [ebp - 0x2ac], 0x343be24e
mov dword [ebp - 0x2a8], 0xd2d9f4d4
mov dword [ebp - 0x2a4], 0x6b4821d3
mov dword [ebp - 0x2a0], 0x12d59bcf
mov dword [ebp - 0x29c], 0x706f4262
mov dword [ebp - 0x298], 0x67984b54
mov dword [ebp - 0x294], 0xdfa0740e
mov dword [ebp - 0x290], 0x4c031a42
mov dword [ebp - 0x28c], 0x859d20b7
mov dword [ebp - 0x288], 0x70892cb0
mov dword [ebp - 0x284], 0x99f3f185
mov dword [ebp - 0x280], 0x7b08e21
mov dword [ebp - 0x27c], 0x14afe1bd
mov dword [ebp - 0x278], 0x3d2c2046
mov dword [ebp - 0x274], 0xe32812d1
mov dword [ebp - 0x270], 0xce7143e1
mov dword [ebp - 0x26c], 0x34856404
mov dword [ebp - 0x268], 0xc39ac5ea
mov dword [ebp - 0x264], 0x8e71eb9f
mov dword [ebp - 0x260], 0x57a5abdb
mov dword [ebp - 0x25c], 0x6d86817d
mov dword [ebp - 0x198], 0xcd56a7c7
mov dword [ebp - 0x194], 0x16857b43
mov dword [ebp - 0x190], 0x2b56fa41
mov dword [ebp - 0x18c], 0xfe5660d5
mov dword [ebp - 0x188], 0x43747781
mov dword [ebp - 0x184], 0xf7f6bdf7
mov dword [ebp - 0x180], 0xbf046644
mov dword [ebp - 0x17c], 0x7721aac2
mov dword [ebp - 0x178], 0xdaa2d4e2
mov dword [ebp - 0x174], 0x3d9502e2
mov dword [ebp - 0x170], 0xa41e1961
mov dword [ebp - 0x16c], 0xf429ec5d
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004092dc
add esp, 0xc
mov byte [esi], 0
mov byte [edi], 0
mov dword [ebp - 0x5fc], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x600], edi
cmp edi, 0xffffffff
je 0x4166f3
lea eax, [ebp - 0x5fc]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x4166e8
nop word [eax + eax]
movaps xmm0, xmmword [str.________________R]
lea ecx, [ebp - 0x5d8]
movups xmmword [ebp - 0x108], xmm0
lea edx, [ecx + 2]
movups xmmword [ebp - 0xf8], xmm0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4164d0
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x3fffffff
jg 0x416528
lea edi, [ecx + ecx]
mov eax, edi
call fcn.00417aa0
mov esi, esp
test esi, esi
je 0x416522
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x5d8]
mov byte [esi], 0
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, dword [ebp - 0x600]
neg eax
sbb edx, edx
and edx, esi
jmp 0x41652a
mov edi, dword [ebp - 0x600]
xor edx, edx
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416530
sub ecx, esi
cmp ecx, 0x10
jae 0x41654e
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416543
sub ecx, esi
jmp 0x416553
mov ecx, 0x10
push ecx
push 0
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.00419530
lea ecx, [ebp - 0x108]
add esp, 0x10
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416570
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00419701
lea eax, [ebp - 0x3d0]
push eax
call fcn.004172e0
push 0x20
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x3d0]
push eax
call fcn.00417420
lea eax, [ebp - 0x3d0]
push eax
call fcn.004171b0
push 0x10
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x258]
push 0x70
push eax
call fcn.00416780
add esp, 0x2c
test eax, eax
je 0x4165dd
mov eax, dword [ebp - 0x604]
mov byte [eax], 1
push 0x10
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x118]
push 0x10
push eax
call fcn.00416780
add esp, 0x10
test eax, eax
je 0x416604
mov eax, dword [ebp - 0x608]
mov byte [eax], 1
push 0x10
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x148]
push 0x20
push eax
call fcn.00416780
add esp, 0x10
test eax, eax
je 0x416625
mov byte [ebx], 1
push 0x10
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x128]
push 0x10
push eax
call fcn.00416780
add esp, 0x10
test eax, eax
je 0x416646
mov byte [ebx], 1
push 0x10
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x168]
push 0x20
push eax
call fcn.00416780
add esp, 0x10
test eax, eax
je 0x416667
mov byte [ebx], 1
push 0x10
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x1e8]
push 0x50
push eax
call fcn.00416780
add esp, 0x10
test eax, eax
je 0x416688
mov byte [ebx], 1
push 0x10
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x368]
push 0x110
push eax
call fcn.00416780
add esp, 0x10
test eax, eax
je 0x4166b2
mov eax, dword [ebp - 0x60c]
mov byte [eax], 1
push 0x10
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x198]
push 0x30
push eax
call fcn.00416780
add esp, 0x10
test eax, eax
je 0x4166d3
mov byte [ebx], 1
lea eax, [ebp - 0x5fc]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4164b0
test edi, edi
je 0x4166f3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esp, [ebp - 0x618]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409359
mov esp, ebp
pop ebp
ret