Function at 0x40a580
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x294
mov eax, dword [0x422760]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
mov ebx, dword [esp + 0x29c]
push ebp
mov ebp, dword [esp + 0x2a4]
test ebp, ebp
je 0x40a844
push esi
push edi
push ebp
push 0x41dc80
push 0xffffffffffffffff
lea eax, [esp + 0x24c]
push 0x10
push eax
call fcn.00412731
mov ecx, dword [esp + 0x2c4]
push ecx
push 0x41dc80
push 0xffffffffffffffff
lea edx, [esp + 0x280]
push 0x10
push edx
call fcn.00412731
push 0
lea eax, [esp + 0x28c]
push eax
lea ecx, [esp + 0x270]
push ecx
lea esi, [ebx + 2]
push esi
push 0x400003ff
push 4
call fcn.00405400
add esp, 0x40
push ebp
push 0
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40a6f5
mov edx, dword [esp + 0x2b4]
push edx
push 0x41dc80
push 0xffffffffffffffff
lea eax, [esp + 0x28c]
push 0x10
push eax
call fcn.00412731
push 0
push esi
lea ecx, [esp + 0x29c]
push ecx
lea edx, [esp + 0x260]
push edx
push 0x40000403
push 4
call fcn.00405400
mov eax, dword [esp + 0x2dc]
push eax
push ebp
push edi
push ebx
call fcn.0040a460
add esp, 0x3c
test eax, eax
jne 0x40a6ec
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40a68e
cmp dword [esp + 0x10], 0x103
jne 0x40a6ec
test byte [ebx + 0x70484], 8
push 0
je 0x40a6ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004052c0
add esp, 4
push eax
push esi
lea edx, [esp + 0x24c]
push edx
push 0xc0000404
push 1
call fcn.00405400
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a71f
push str.AppStopMethodSkip
push str.NSSM
lea eax, [esp + 0x24c]
push eax
push esi
push 0x8000041d
push 2
call fcn.00405400
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a71f
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004052c0
add esp, 4
push eax
push esi
lea ecx, [esp + 0x24c]
push ecx
push 0xc0000402
push 1
call fcn.00405400
add esp, 0x18
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
jne 0x40a754
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004052c0
add esp, 4
push eax
push esi
push 0xc0000400
push 1
call fcn.00405400
add esp, 0x14
jmp 0x40a842
push 0x22c
lea edx, [esp + 0x18]
push 0
push edx
call fcn.00412d20
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x1c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x40a78b
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a821
push ebp
lea ecx, [esp + 0x18]
push ecx
push ebx
call fcn.0040a040
add esp, 0xc
test eax, eax
jne 0x40a7bc
mov edx, dword [esp + 0x2b4]
mov eax, dword [esp + 0x2b0]
mov ecx, dword [esp + 0x1c]
push edx
push eax
push ecx
push ebx
call fcn.0040a580
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x40a810
jmp 0x40a7d0
push ebp
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.0040a040
add esp, 0xc
test eax, eax
jne 0x40a801
mov ecx, dword [esp + 0x2b4]
mov edx, dword [esp + 0x2b0]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push ebx
call fcn.0040a580
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40a7d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x12
je 0x40a83b
push 0
call ebx
push eax
call fcn.004052c0
add esp, 4
push eax
push esi
push 0xc0000401
push 1
call fcn.00405400
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [esp + 0x298]
pop ebp
pop ebx
xor ecx, esp
call fcn.00412cdc
add esp, 0x294
ret