Function at 0x405040
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
lea ebx, [ebp - 0x18]
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x14]
mov eax, 0x4d2584
call fcn.0049b8e0
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x5c], ecx
mov word [ebp - 0x44], 0x14
mov edx, 0x4e20d0
lea eax, [ebp - 4]
call fcn.004a7b10
inc dword [ebp - 0x38]
xor ecx, ecx
mov word [ebp - 0x44], 8
mov word [ebp - 0x44], 0x20
mov dword [ebp - 8], ecx
inc dword [ebp - 0x38]
mov word [ebp - 0x44], 8
call fcn.00406350
jmp 0x405188
mov word [ebp - 0x44], 0x38
xor eax, eax
mov dword [ebx], eax
push ebx
inc dword [ebp - 0x38]
mov edx, 0x4d1685
mov eax, edi
call fcn.004a7ad8
inc dword [ebp - 0x38]
mov edx, edi
mov eax, 0x4e20d0
call fcn.004a8054
mov ecx, eax
dec ecx
lea eax, [ebp - 4]
mov edx, 1
call fcn.004a7f20
mov edx, ebx
lea eax, [ebp - 8]
call fcn.004a7c68
dec dword [ebp - 0x38]
mov eax, ebx
mov edx, 2
call fcn.004a7c38
dec dword [ebp - 0x38]
mov eax, edi
mov edx, 2
call fcn.004a7c38
mov word [ebp - 0x44], 0x44
mov edx, 0x4d1687
lea eax, [ebp - 0x1c]
call fcn.004a7ad8
inc dword [ebp - 0x38]
lea edx, [ebp - 0x1c]
mov eax, 0x4e20d0
call fcn.004a8054
test eax, eax
lea eax, [ebp - 0x1c]
setne cl
and ecx, 1
mov edx, 2
push ecx
dec dword [ebp - 0x38]
call fcn.004a7c38
pop ecx
test cl, cl
je 0x405188
mov word [ebp - 0x44], 0x50
mov edx, 0x4d1689
lea eax, [ebp - 0x20]
call fcn.004a7ad8
inc dword [ebp - 0x38]
lea edx, [ebp - 0x20]
mov eax, 0x4e20d0
call fcn.004a8054
mov ecx, eax
dec ecx
lea eax, [ebp - 4]
mov edx, 1
call fcn.004a7e2c
dec dword [ebp - 0x38]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004a7c38
mov word [ebp - 0x44], 0x2c
mov edx, str._
mov eax, esi
call fcn.004a7ad8
inc dword [ebp - 0x38]
mov edx, esi
lea eax, [ebp - 4]
call fcn.004a8054
test eax, eax
mov eax, esi
setne cl
and ecx, 1
mov edx, 2
push ecx
dec dword [ebp - 0x38]
call fcn.004a7c38
pop ecx
test ecx, ecx
jne 0x4050a3
mov word [ebp - 0x44], 0x5c
mov edx, 0x4d168b
lea eax, [ebp - 0x24]
call fcn.004a7ad8
inc dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 4]
inc dword [ebp - 0x38]
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x28]
call fcn.004a7c90
lea edx, [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.004a7c68
dec dword [ebp - 0x38]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004a7c38
dec dword [ebp - 0x38]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004a7c38
jmp 0x405301
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x60], 0x3e8
mov word [ebp - 0x44], 8
cmp dword [ebp - 0x5c], 0xa
jne 0x405264
xor eax, eax
mov dword [ebp - 0x5c], eax
mov word [ebp - 0x44], 0x68
call fcn.00404a00
call fcn.00402788
mov word [ebp - 0x44], 8
jmp 0x405264
inc dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
call fcn.0041bbec
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0x128
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4052ed
movsx edx, byte [ebp - 0x164]
cmp edx, 0x5b
je 0x4052dc
mov word [ebp - 0x44], 0x74
lea edx, [ebp - 0x164]
lea eax, [ebp - 0x2c]
call fcn.004a7ad8
inc dword [ebp - 0x38]
lea edx, [ebp - 0x2c]
lea eax, [ebp - 8]
call fcn.004a7d1c
push eax
dec dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004a7c38
pop ecx
test cl, cl
je 0x4052dc
inc dword [ebp - 0x58]
lea eax, [ebp - 0x188]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x405295
push ebx
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0x58], 0
jne 0x405301
xor edx, edx
mov dword [0x4d11ac], edx
cmp dword [0x4d11ac], 1
je 0x405224
mov word [ebp - 0x44], 0x80
mov edx, 0x4d1690
lea eax, [ebp - 0x30]
call fcn.004a7ad8
inc dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x4e20d0
inc dword [ebp - 0x38]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0xc]
call fcn.004a7c90
dec dword [ebp - 0x38]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004a7c38
mov word [ebp - 0x44], 8
mov eax, dword [ebp - 0xc]
call fcn.004a7a4c
dec dword [ebp - 0x38]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004a7c38
dec dword [ebp - 0x38]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a7c38
dec dword [ebp - 0x38]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a7c38
mov ecx, dword [ebp - 0x54]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret