Function at 0x40cf77
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push 0xaec
mov eax, 0x4ad64c
call fcn.0048f48f
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0xac4]
mov dword [ebp - 0xa98], eax
call fcn.0042f326
mov edx, dword [0x507340]
push 0x14
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
pop ecx
idiv ecx
push 0x13
pop eax
mov dword [ebp - 4], ebx
cmp edx, eax
jne 0x40cfd3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x50
xor edx, edx
pop ecx
div ecx
inc edx
mov dword [0x507340], edx
xor eax, eax
push ebx
inc eax
push 2
mov byte [ebp - 4], al
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0xaa0], esi
cmp esi, 0xffffffff
jne 0x40d099
mov edi, 0x505ab0
push edi
lea ecx, [ebp - 0xa94]
call fcn.00408fd9
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa94]
push str.enumProcess_CreateToolhelp32Snapshot__d
push eax
call fcn.00405092
add esp, 0xc
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0x82c]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xad4]
mov byte [ebp - 4], 3
call fcn.0042f275
push 0x4c0c00
lea ecx, [ebp - 0xac4]
mov byte [ebp - 4], 4
call fcn.0042f5f2
lea ecx, [ebp - 0xad4]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0xad4]
mov byte [ebp - 4], 3
call fcn.0042f451
lea ecx, [ebp - 0x82c]
call fcn.00401056
mov ecx, dword [ebp - 0xa94]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov byte [ebp - 4], bl
jmp 0x40d657
mov edi, 0x22c
push edi
lea eax, [ebp - 0xa90]
push ebx
push eax
call fcn.004913e0
add esp, 0xc
lea eax, [ebp - 0xa90]
push eax
push esi
mov dword [ebp - 0xa90], edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40d51e
call fcn.004111af
test al, al
jne 0x40d0e5
mov eax, dword [0x507340]
push 1
test eax, eax
pop ecx
cmove eax, ecx
mov dword [0x507340], eax
mov edi, 0x505ab0
mov dword [ebp - 0xaac], 0x17
push dword [ebp - 0xa88]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x507340]
mov dword [ebp - 0xad8], eax
lea eax, [esi + 1]
imul eax, esi
push 0xb
cdq
pop ecx
idiv ecx
cmp edx, 4
jne 0x40d14c
mov eax, ebx
test esi, esi
je 0x40d147
mov ecx, esi
and ecx, 1
add eax, ecx
mov dword [ebp - 0xab0], eax
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
mov eax, dword [ebp - 0xab0]
jne 0x40d129
mov dword [0x507340], eax
mov esi, dword [ebp - 0xad8]
test esi, esi
je 0x40d461
xor eax, eax
push 0x7fe
mov word [ebp - 0x814], ax
lea eax, [ebp - 0x812]
push ebx
push eax
call fcn.004913e0
add esp, 0xc
lea eax, [ebp - 0x814]
push 0x800
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x40d1cd
push edi
lea ecx, [ebp - 0xaa4]
call fcn.00408fd9
push 5
pop eax
mov byte [ebp - 4], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xaa4]
push str.GetProcessImageFileName__d
push eax
call fcn.00405092
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xaa4]
jmp 0x40d453
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x507340]
push 5
lea eax, [ecx + 1]
imul eax, ecx
cdq
pop ecx
idiv ecx
cmp edx, 4
jne 0x40d200
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0xa9c]
call fcn.00401b1e
push edi
lea ecx, [ebp - 0xa94]
mov byte [ebp - 4], 6
call fcn.00408fd9
push edi
lea ecx, [ebp - 0xab4]
mov byte [ebp - 4], 7
call fcn.00408fd9
push dword [ebp - 0xa88]
lea eax, [ebp - 0xab4]
push eax
lea eax, [ebp - 0xa94]
push eax
mov byte [ebp - 4], 8
call fcn.00423704
mov ecx, dword [0x507340]
add esp, 0xc
lea esi, [ecx + 1]
mov eax, esi
imul eax, ecx
cdq
idiv dword [ebp - 0xaac]
cmp edx, 0x16
jne 0x40d28d
sub ecx, ebx
je 0x40d283
dec ecx
je 0x40d27b
mov dword [0x507340], esi
jmp 0x40d28d
mov dword [0x507340], ebx
jmp 0x40d28d
mov dword [0x507340], 2
push ebx
lea ecx, [ebp - 0xad4]
call fcn.0042f326
mov eax, dword [ebp - 0xa94]
mov ecx, 0x4c1ab0
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 9
cmovne ecx, eax
push ecx
lea ecx, [ebp - 0xaa8]
call fcn.00401b1e
lea eax, [ebp - 0xaa8]
push eax
lea eax, [ebp - 0x844]
push eax
mov byte [ebp - 4], 0xa
call fcn.00438012
pop ecx
pop ecx
push 0xb
pop ecx
mov byte [ebp - 4], cl
push eax
lea ecx, [ebp - 0xaf8]
call fcn.0042f275
push str.user
lea ecx, [ebp - 0xad4]
mov byte [ebp - 4], 0xc
call fcn.0042f5f2
lea ecx, [ebp - 0xaf8]
push ecx
mov ecx, eax
call fcn.0042f4ab
push 0xb
pop eax
lea ecx, [ebp - 0xaf8]
mov byte [ebp - 4], al
call fcn.0042f451
lea ecx, [ebp - 0x844]
call fcn.00401056
mov ecx, dword [ebp - 0xaa8]
mov byte [ebp - 4], 9
lea ecx, [ecx - 0x10]
call fcn.00407864
lea eax, [ebp - 0xa9c]
push eax
lea eax, [ebp - 0x844]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xae8]
mov byte [ebp - 4], 0xd
call fcn.0042f275
push str.process
lea ecx, [ebp - 0xad4]
mov byte [ebp - 4], 0xe
call fcn.0042f5f2
lea ecx, [ebp - 0xae8]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0xae8]
mov byte [ebp - 4], 0xd
call fcn.0042f451
lea ecx, [ebp - 0x844]
mov byte [ebp - 4], 9
call fcn.00401056
push dword [ebp - 0xa88]
lea ecx, [ebp - 0x824]
call fcn.0042f2b1
mov byte [ebp - 4], 0xf
push 0x4c1ac0
lea ecx, [ebp - 0xad4]
call fcn.0042f5f2
lea ecx, [ebp - 0x824]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x824]
mov byte [ebp - 4], 9
call fcn.0042f451
call fcn.00411319
test al, al
jne 0x40d410
mov ecx, dword [0x507340]
mov eax, ecx
sub eax, ebx
je 0x40d406
dec eax
je 0x40d3fe
inc ecx
mov dword [0x507340], ecx
jmp 0x40d410
mov dword [0x507340], ebx
jmp 0x40d410
mov dword [0x507340], 2
lea eax, [ebp - 0xad4]
push eax
lea ecx, [ebp - 0xac4]
call fcn.0042fa35
lea ecx, [ebp - 0xad4]
mov byte [ebp - 4], 8
call fcn.0042f451
mov ecx, dword [ebp - 0xab4]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xa94]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xa9c]
xor eax, eax
inc eax
lea ecx, [ecx - 0x10]
mov byte [ebp - 4], al
call fcn.00407864
mov esi, dword [ebp - 0xaa0]
lea eax, [ebp - 0xa90]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40d0f4
mov eax, dword [0x507340]
imul eax, eax
push 0x13
cdq
pop ecx
idiv ecx
cmp edx, 0xf
jne 0x40d499
call fcn.0048f9e0
mov dword [0x507340], eax
lea ecx, [ebp - 0xac4]
call fcn.0042fe3a
test al, al
je 0x40d4eb
push str.empty
lea ecx, [ebp - 0x824]
call fcn.0042f2f7
push 0x4c0c00
lea ecx, [ebp - 0xac4]
mov byte [ebp - 4], 0x10
call fcn.0042f5f2
lea ecx, [ebp - 0x824]
push ecx
mov ecx, eax
call fcn.0042f4ab
xor eax, eax
inc eax
lea ecx, [ebp - 0x824]
mov byte [ebp - 4], al
call fcn.0042f451
mov ecx, dword [0x507340]
push 0x16
lea eax, [ecx + 1]
imul eax, ecx
cdq
pop ecx
idiv ecx
push 5
pop eax
cmp edx, eax
jne 0x40d50a
inc dword [0x507548]
test esi, esi
je 0x40d654
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d654
mov edi, 0x505ab0
push edi
lea ecx, [ebp - 0xa94]
call fcn.00408fd9
mov byte [ebp - 4], 0x11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa94]
push str.enumProcess_Process32First__d
push eax
call fcn.00405092
add esp, 0xc
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0x844]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x824]
mov byte [ebp - 4], 0x12
call fcn.0042f275
push 0x13
pop ecx
mov byte [ebp - 4], cl
push 0x4c0c00
lea ecx, [ebp - 0xac4]
call fcn.0042f5f2
lea ecx, [ebp - 0x824]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x824]
mov byte [ebp - 4], 0x12
call fcn.0042f451
lea ecx, [ebp - 0x844]
jmp 0x40d07e
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0xa98]
lea ecx, [ebp - 0x864]
call fcn.00430a82
push edi
lea ecx, [ebp - 0xa9c]
mov byte [ebp - 4], 0x18
call fcn.00408fd9
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x864]
mov byte [ebp - 4], 0x19
call fcn.00432bf9
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0x1a
jb 0x40d6a1
mov eax, dword [eax]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401027
lea eax, [ebp - 0xaa0]
push eax
call fcn.00437fc7
add esp, 0x1c
push eax
lea ecx, [ebp - 0xa9c]
mov byte [ebp - 4], 0x1b
call fcn.00402394
mov ecx, dword [ebp - 0xaa0]
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x844]
mov byte [ebp - 4], 0x19
call fcn.00401056
call fcn.00411501
test al, al
jne 0x40d6fd
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push 8
pop eax
mov word [esi], ax
mov esi, dword [ebp - 0xa9c]
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x40d71c
call fcn.00409bd9
mov ecx, dword [ebp - 0xa98]
mov dword [ecx + 8], eax
lea ecx, [esi - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x864]
mov byte [ebp - 4], bl
call fcn.004090f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac4]
call fcn.0042f451
call fcn.0048f3e1
ret