Function at 0x401d30
Capabilities:
Contain obfuscated stackstrings
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405886
mov eax, dword fs:[0]
push eax
mov eax, 0x15c4
call fcn.00405530
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x113c]
push eax
push 0x1000
lea eax, [ebp - 0x1114]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x401d86
xor al, al
jmp 0x402493
mov edi, dword [ebp - 0x113c]
lea ecx, [ebp - 0x15d0]
xorps xmm0, xmm0
shr edi, 2
push str.processhacker.exe
mov dword [ebp - 0x1150], edi
movq qword [ebp - 0x1120], xmm0
mov dword [ebp - 0x1118], 0
call fcn.004037f0
push str.httpdebuggerui.exe
lea ecx, [ebp - 0x15b8]
mov dword [ebp - 4], 0
call fcn.004037f0
push str.wireshark.exe
lea ecx, [ebp - 0x15a0]
mov byte [ebp - 4], 1
call fcn.004037f0
push str.fiddler.exe
lea ecx, [ebp - 0x1588]
mov byte [ebp - 4], 2
call fcn.004037f0
push str.regedit.exe
lea ecx, [ebp - 0x1570]
mov byte [ebp - 4], 3
call fcn.004037f0
push str.cmd.exe
lea ecx, [ebp - 0x1558]
mov byte [ebp - 4], 4
call fcn.004037f0
push str.taskmgr.exe
lea ecx, [ebp - 0x1540]
mov byte [ebp - 4], 5
call fcn.004037f0
push str.vboxservice.exe
lea ecx, [ebp - 0x1528]
mov byte [ebp - 4], 6
call fcn.004037f0
push str.df5serv.exe
lea ecx, [ebp - 0x1510]
mov byte [ebp - 4], 7
call fcn.004037f0
push str.vboxtray.exe
lea ecx, [ebp - 0x14f8]
mov byte [ebp - 4], 8
call fcn.004037f0
push str.vmtoolsd.exe
lea ecx, [ebp - 0x14e0]
mov byte [ebp - 4], 9
call fcn.004037f0
push str.vmwaretray.exe
lea ecx, [ebp - 0x14c8]
mov byte [ebp - 4], 0xa
call fcn.004037f0
push str.ida64.exe
lea ecx, [ebp - 0x14b0]
mov byte [ebp - 4], 0xb
call fcn.004037f0
push str.ollydbg.exe
lea ecx, [ebp - 0x1498]
mov byte [ebp - 4], 0xc
call fcn.004037f0
push str.pestudio.exe
lea ecx, [ebp - 0x1480]
mov byte [ebp - 4], 0xd
call fcn.004037f0
mov byte [ebp - 4], 0xe
push str.vmwareuser.exe
lea ecx, [ebp - 0x1468]
call fcn.004037f0
push str.vgauthservice.exe
lea ecx, [ebp - 0x1450]
mov byte [ebp - 4], 0xf
call fcn.004037f0
push str.vmacthlp.exe
lea ecx, [ebp - 0x1438]
mov byte [ebp - 4], 0x10
call fcn.004037f0
push str.vmsrvc.exe
lea ecx, [ebp - 0x1420]
mov byte [ebp - 4], 0x11
call fcn.004037f0
push str.x32dbg.exe
lea ecx, [ebp - 0x1408]
mov byte [ebp - 4], 0x12
call fcn.004037f0
push str.x64dbg.exe
lea ecx, [ebp - 0x13f0]
mov byte [ebp - 4], 0x13
call fcn.004037f0
push str.vmusrvc.exe
lea ecx, [ebp - 0x13d8]
mov byte [ebp - 4], 0x14
call fcn.004037f0
push str.prl_cc.exe
lea ecx, [ebp - 0x13c0]
mov byte [ebp - 4], 0x15
call fcn.004037f0
push str.prl_tools.exe
lea ecx, [ebp - 0x13a8]
mov byte [ebp - 4], 0x16
call fcn.004037f0
push str.qemu_ga.exe
lea ecx, [ebp - 0x1390]
mov byte [ebp - 4], 0x17
call fcn.004037f0
push str.joeboxcontrol.exe
lea ecx, [ebp - 0x1378]
mov byte [ebp - 4], 0x18
call fcn.004037f0
push str.ksdumperclient.exe
lea ecx, [ebp - 0x1360]
mov byte [ebp - 4], 0x19
call fcn.004037f0
push str.xenservice.exe
lea ecx, [ebp - 0x1348]
mov byte [ebp - 4], 0x1a
call fcn.004037f0
push str.joeboxserver.exe
lea ecx, [ebp - 0x1330]
mov byte [ebp - 4], 0x1b
call fcn.004037f0
push str.devenv.exe
lea ecx, [ebp - 0x1318]
mov byte [ebp - 4], 0x1c
call fcn.004037f0
push str.immunitydebugger.exe
lea ecx, [ebp - 0x1300]
mov byte [ebp - 4], 0x1d
call fcn.004037f0
mov byte [ebp - 4], 0x1e
push str.importrec.exe
lea ecx, [ebp - 0x12e8]
call fcn.004037f0
push str.reshacker.exe
lea ecx, [ebp - 0x12d0]
mov byte [ebp - 4], 0x1f
call fcn.004037f0
push str.windbg.exe
lea ecx, [ebp - 0x12b8]
mov byte [ebp - 4], 0x20
call fcn.004037f0
push str.32dbg.exe
lea ecx, [ebp - 0x12a0]
mov byte [ebp - 4], 0x21
call fcn.004037f0
push str.64dbg.exe
lea ecx, [ebp - 0x1288]
mov byte [ebp - 4], 0x22
call fcn.004037f0
push str.protection_id.exe
lea ecx, [ebp - 0x1270]
mov byte [ebp - 4], 0x23
call fcn.004037f0
push str.scylla_x86.exe
lea ecx, [ebp - 0x1258]
mov byte [ebp - 4], 0x24
call fcn.004037f0
push str.scylla_x64.exe
lea ecx, [ebp - 0x1240]
mov byte [ebp - 4], 0x25
call fcn.004037f0
push str.scylla.exe
lea ecx, [ebp - 0x1228]
mov byte [ebp - 4], 0x26
call fcn.004037f0
push str.idau64.exe
lea ecx, [ebp - 0x1210]
mov byte [ebp - 4], 0x27
call fcn.004037f0
push str.idau.exe
lea ecx, [ebp - 0x11f8]
mov byte [ebp - 4], 0x28
call fcn.004037f0
push str.idaq64.exe
lea ecx, [ebp - 0x11e0]
mov byte [ebp - 4], 0x29
call fcn.004037f0
push str.idaq.exe
lea ecx, [ebp - 0x11c8]
mov byte [ebp - 4], 0x2a
call fcn.004037f0
push str.idaw.exe
lea ecx, [ebp - 0x11b0]
mov byte [ebp - 4], 0x2b
call fcn.004037f0
push str.idag64.exe
lea ecx, [ebp - 0x1198]
mov byte [ebp - 4], 0x2c
call fcn.004037f0
push str.idag.exe
lea ecx, [ebp - 0x1180]
mov byte [ebp - 4], 0x2d
call fcn.004037f0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x1168]
push str.ida.exe
call fcn.004037f0
lea ebx, [ebp - 0x15d0]
mov dword [ebp - 4], 0x2f
lea ecx, [ebp - 0x1150]
mov dword [ebp - 0x1120], 0
sub ecx, ebx
mov dword [ebp - 0x111c], 0
mov eax, 0x2aaaaaab
mov dword [ebp - 0x1118], 0
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x402245
cmp eax, 0xaaaaaaa
ja 0x4024af
lea esi, [eax + eax*2]
shl esi, 3
cmp esi, 0x1000
jb 0x4021f5
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x4024b4
push eax
call fcn.00404510
add esp, 4
test eax, eax
je 0x4021ef
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x402208
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
test esi, esi
je 0x402206
push esi
call fcn.00404510
add esp, 4
mov ecx, eax
jmp 0x402208
xor ecx, ecx
lea eax, [esi + ecx]
mov dword [ebp - 0x1120], ecx
mov dword [ebp - 0x1118], eax
lea eax, [ebp - 0x1120]
mov dword [ebp - 0x111c], ecx
mov dword [ebp - 0x1144], eax
push eax
push ecx
lea edx, [ebp - 0x1150]
mov byte [ebp - 4], 0x30
mov ecx, ebx
call fcn.00404290
add esp, 8
mov dword [ebp - 0x111c], eax
push 0x403790
push 0x30
push 0x18
lea eax, [ebp - 0x15d0]
mov byte [ebp - 4], 0x32
push eax
call fcn.00404540
xor ebx, ebx
mov dword [ebp - 0x1148], ebx
test edi, edi
je 0x402484
nop
mov esi, dword [ebp + ebx*4 - 0x1114]
test esi, esi
je 0x402475
mov ax, word [0x4067cc]
movq xmm0, qword [str._unknown_]
push 0xfa
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x10a]
push 0
push eax
movq qword [ebp - 0x114], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x114c], eax
test eax, eax
je 0x402475
lea ecx, [ebp - 0x1140]
push ecx
push 4
lea ecx, [ebp - 0x1144]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x402469
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x1144]
push dword [ebp - 0x114c]
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea edx, [ebp - 0x114]
lea ecx, [ebp - 0x1138]
call fcn.00401a80
mov edx, dword [ebp - 0x1124]
lea eax, [ebp - 0x1138]
mov ebx, dword [ebp - 0x1138]
lea esi, [ebp - 0x1138]
mov ecx, dword [ebp - 0x1128]
cmp edx, 7
cmova eax, ebx
cmova esi, ebx
lea edi, [eax + ecx*2]
cmp esi, edi
je 0x402379
nop word [eax + eax]
movzx eax, word [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [esi], ax
add esp, 4
add esi, 2
cmp esi, edi
jne 0x402350
mov ebx, dword [ebp - 0x1138]
mov ecx, dword [ebp - 0x1128]
mov edx, dword [ebp - 0x1124]
mov edi, dword [ebp - 0x1120]
cmp edi, dword [ebp - 0x111c]
je 0x402429
nop dword [eax + eax]
cmp dword [edi + 0x14], 7
mov eax, edi
jbe 0x40239a
mov eax, dword [edi]
cmp edx, 7
lea esi, [ebp - 0x1138]
cmova esi, ebx
cmp ecx, dword [edi + 0x10]
jne 0x40241a
mov edx, ecx
test edx, edx
je 0x4023c4
sub esi, eax
mov cx, word [esi + eax]
cmp cx, word [eax]
jne 0x40240e
add eax, 2
sub edx, 1
jne 0x4023b3
push dword [ebp - 0x114c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1124]
cmp eax, 7
jbe 0x40240a
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x402400
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4021ef
push ecx
push ebx
call fcn.00404655
add esp, 8
mov bl, 1
jmp 0x402486
mov ecx, dword [ebp - 0x1128]
mov edx, dword [ebp - 0x1124]
add edi, 0x18
cmp edi, dword [ebp - 0x111c]
jne 0x402390
cmp edx, 7
jbe 0x40245d
lea edx, [edx*2 + 2]
mov eax, ebx
cmp edx, 0x1000
jb 0x402453
mov ebx, dword [eax - 4]
add edx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4021ef
push edx
push ebx
call fcn.00404655
add esp, 8
mov edi, dword [ebp - 0x1150]
mov ebx, dword [ebp - 0x1148]
push dword [ebp - 0x114c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
mov dword [ebp - 0x1148], ebx
cmp ebx, edi
jb 0x402270
xor bl, bl
lea ecx, [ebp - 0x1120]
call fcn.00403b20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00404502
mov esp, ebp
pop ebp
ret
call fcn.00404280
call fcn.004010c0
int3