Function at 0x4029ff
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x71c
mov word [ebp - 0x42], 0x71
lea eax, [ebp - 0x184]
mov dword [esp + 4], eax
mov dword [esp], str.C:WindowsSystem32VBox.dll
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call eax
sub esp, 8
cmp eax, 0xffffffff
je 0x402a38
mov eax, 0x990834
jmp 0x402a3d
mov eax, 0x990836
mov dword [esp], eax
call fcn.008b6790
mov dword [esp + 8], eax
mov dword [esp + 4], str.vbox_first
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.008b6820
lea eax, [ebp - 0x188]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMControlSet001ServicesVBoxSF
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
jne 0x402a9a
mov eax, 0x990834
jmp 0x402a9f
mov eax, 0x990836
mov dword [esp], eax
call fcn.008b6790
mov dword [esp + 8], eax
mov dword [esp + 4], str.vbox_second
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.008b6820
mov dword [esp + 8], 0x105
lea eax, [ebp - 0x28d]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x28d]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_CharUpperA]
call eax
sub esp, 4
mov dword [esp + 4], str.C:USERSPUBLIC_
lea eax, [ebp - 0x28d]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
test eax, eax
je 0x402b15
mov eax, 0x990834
jmp 0x402b1a
mov eax, 0x990836
mov dword [esp], eax
call fcn.008b6790
mov dword [esp + 8], eax
mov dword [esp + 4], str.public_check
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.008b6820
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x3b8]
mov eax, 0
mov ecx, 0x4a
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3b8], 0x22c
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3b8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
je 0x402bcc
mov ebx, dword [ebp - 0x3b0]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call eax
cmp ebx, eax
jne 0x402bb0
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x1c], eax
jmp 0x402bcc
lea eax, [ebp - 0x3b8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
jne 0x402b94
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x4c4], 0x104
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x400
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x4c4]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x4bd]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
call eax
sub esp, 0x10
lea eax, [ebp - 0x4bd]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_CharUpperA]
call eax
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp + 4], str.WINDBG.EXE
lea eax, [ebp - 0x4bd]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
test eax, eax
je 0x402c6f
mov eax, 0x990834
jmp 0x402c74
mov eax, 0x990836
mov dword [esp], eax
call fcn.008b6790
mov dword [esp + 8], eax
mov dword [esp + 4], 0x99089e
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.008b6820
mov byte [ebp - 0x42], 0x31
lea edx, [ebp - 0x5ec]
mov eax, 0
mov ecx, 0x4a
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3b8], 0x128
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x5ec]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
je 0x402dcf
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x5ec]
add eax, 0x24
mov dword [esp + 4], eax
lea eax, [ebp - 0x6f1]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strncpy
mov byte [ebp - 0x5ed], 0
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x6f1]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strlwr_s]
call eax
mov dword [esp + 4], str.wireshark.exe
lea eax, [ebp - 0x6f1]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
test eax, eax
jne 0x402d99
mov dword [esp + 4], str.procmon.exe
lea eax, [ebp - 0x6f1]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
test eax, eax
jne 0x402d99
mov dword [esp + 4], str.x64dbg.exe
lea eax, [ebp - 0x6f1]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
test eax, eax
jne 0x402d99
mov dword [esp + 4], str.ida.exe
lea eax, [ebp - 0x6f1]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
test eax, eax
je 0x402daf
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov byte [ebp - 0x42], 0x30
jmp 0x402dcf
lea eax, [ebp - 0x5ec]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
jne 0x402cef
lea eax, [ebp - 0x42]
mov dword [esp], eax
call fcn.008b6790
mov dword [esp + 8], eax
mov dword [esp + 4], str.dbg_sec
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.008b6820
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [ebp - 0x6f8], 0
lea eax, [ebp - 0x6f8]
mov dword [esp + 4], eax
mov dword [esp], 0x4024d1
mov eax, dword [sym.imp.USER32.dll_EnumWindows]
call eax
sub esp, 8
mov eax, dword [ebp - 0x6f8]
test eax, eax
je 0x402e37
mov eax, 0x990834
jmp 0x402e3c
mov eax, 0x990836
mov dword [esp], eax
call fcn.008b6790
mov dword [esp + 8], eax
mov dword [esp + 4], str.dbg_third
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.008b6820
mov dword [ebp - 0x30], 0x7ffe0004
mov dword [ebp - 0x34], 0x7ffe0324
mov dword [ebp - 0x38], 0x7ffe0320
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov edx, dword [ebp - 0x34]
mov edx, dword [edx]
shl edx, 8
imul eax, edx
mov dword [ebp - 0x6fc], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov edx, 0
mov edi, ebx
imul edi, eax
mov esi, edi
mov edi, edx
imul edi, ecx
add edi, esi
mul ecx
lea ecx, [edi + edx]
mov edx, ecx
shrd eax, edx, 0x18
shr edx, 0x18
mov ebx, dword [ebp - 0x6fc]
add eax, ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x40]
cmp eax, 0x64
jbe 0x402eea
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x3c]
cmp eax, 0x64
jbe 0x402eea
mov eax, 0x990834
jmp 0x402eef
mov eax, 0x990836
mov dword [esp], eax
call fcn.008b6790
mov dword [esp + 8], eax
mov dword [esp + 4], str.yadro
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.008b6820
nop
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret