Function at 0x40e0e0
Capabilities:
Enumerate processes
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x48bee3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x674
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x276]
mov word [esp + 0x274], bx
mov word [esp + 0x47c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x47e]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x17]
stosw word es:[edi], ax
mov al, byte [esp + 0x17]
mov byte [esp + 0x1d], cl
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c], al
call fcn.00418bb0
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x30]
push eax
mov dword [esp + 0x690], ebx
mov ecx, dword [eax]
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.004100c0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ebp, ebp
xor esi, esi
push esi
push 0x4b0b90
lea eax, [esp + 0x484]
push 0x208
push eax
call fcn.0040c490
lea ecx, [esp + 0x28]
push ecx
call fcn.0040e4a0
mov eax, dword [eax]
add esp, 0x14
lea edx, [esp + 0x274]
push eax
push 0x104
push edx
lea eax, [esp + 0x488]
push 0x4b99c0
push eax
push str.rname
call edi
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString
cmp word [esp + 0x274], bx
je 0x40e27b
lea ecx, [esp + 0x274]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::CString_2
push str..exe
lea ecx, [esp + 0x14]
mov byte [esp + 0x690], 1
call fcn.0043606e
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::MakeLower
lea edx, [esp + 0x10]
lea ecx, [esp + 0x30]
push edx
call fcn.00436032
lea eax, [esp + 0x10]
lea ecx, [esp + 0x34]
push eax
mov byte [esp + 0x690], 2
call fcn.00436032
lea ecx, [esp + 0x30]
lea edx, [esp + 0x40]
push ecx
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x694], 3
call fcn.0040fe70
lea ecx, [esp + 0x34]
mov byte [esp + 0x68c], 4
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x68c], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
inc ebp
mov byte [esp + 0x68c], bl
call sub.MFC42u.DLL_CString::CString
inc esi
cmp esi, 0x18
jl 0x40e179
cmp ebp, ebx
jne 0x40e2d4
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x694], 0xffffffff
call fcn.0040fa90
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.004100c0
mov eax, dword [esp + 0x20]
push eax
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], ebx
push ecx
jmp 0x40e479
lea ecx, [esp + 0x38]
call fcn.004222a0
push ebx
push 2
mov byte [esp + 0x694], 5
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40e431
lea edx, [esp + 0x48]
mov ecx, 0x8a
xor eax, eax
lea edi, [esp + 0x4c]
push edx
push ebp
rep stosd dword es:[edi], eax
mov dword [esp + 0x50], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x40e42a
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x68c], 6
call sub.MFC42u.DLL_CString::MakeLower
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.004020b0
add esp, 8
lea edx, [esp + 0x10]
mov byte [esp + 0x68c], 7
push edx
push eax
lea eax, [esp + 0x20]
push eax
call sub.MFC42u.DLL_operator_1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x68c], 9
call sub.MFC42u.DLL_CString::CString
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x20]
call fcn.00411310
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], eax
cmp eax, ecx
je 0x40e3b2
mov eax, dword [eax + 0xc]
mov edx, dword [esp + 0x10]
push eax
push edx
call edi
add esp, 8
cmp eax, ebx
jl 0x40e3b2
lea eax, [esp + 0x40]
jmp 0x40e3be
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
cmp dword [eax], esi
je 0x40e3f3
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call fcn.00436032
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x3c]
push eax
call fcn.004225c0
cmp eax, ebx
je 0x40e3f3
mov ecx, dword [esp + 0x50]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00422570
lea edx, [esp + 0x48]
push edx
push ebp
call sub.KERNEL32.dll_Process32NextW
lea ecx, [esp + 0x18]
mov esi, eax
mov byte [esp + 0x68c], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x68c], 5
call sub.MFC42u.DLL_CString::CString
cmp esi, ebx
jne 0x40e326
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x38]
mov byte [esp + 0x68c], bl
call fcn.004222d0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x68c], 0xffffffff
push eax
mov ecx, dword [eax]
lea eax, [esp + 0x40]
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.004100c0
mov ecx, dword [esp + 0x20]
push ecx
call sub.MFC42u.DLL_operatordelete
mov edx, dword [esp + 0x28]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], ebx
push edx
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [esp + 0x68c]
add esp, 8
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x680
ret