Function at 0x401540
Capabilities:
Enumerate processes
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x33c
mov ecx, dword [eax + 4]
mov dword [ebp - 0x308], eax
test ecx, ecx
je 0x401e78
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov dword [esp], 0
mov dword [ebp - 0x318], eax
call eax
mov esi, dword [sym.imp.user32.dll_LoadStringW]
sub esp, 4
mov ebx, eax
lea eax, [ebp - 0x298]
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0x66
mov dword [esp], ebx
mov dword [ebp - 0x314], esi
call esi
lea eax, [ebp - 0x258]
sub esp, 0x10
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0x67
mov dword [esp], ebx
call esi
lea eax, [ebp - 0x218]
sub esp, 0x10
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0x68
mov dword [esp], ebx
call esi
lea eax, [ebp - 0x1d8]
sub esp, 0x10
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0x69
mov dword [esp], ebx
call esi
lea eax, [ebp - 0x198]
sub esp, 0x10
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0x6a
mov dword [esp], ebx
call esi
mov eax, dword [ebp - 0x308]
sub esp, 0x10
cmp dword [eax + 4], 2
je 0x401e89
mov eax, dword [ebp - 0x308]
mov edx, dword [eax]
test edx, edx
jne 0x40165c
mov eax, dword [eax + 4]
test eax, eax
je 0x401f02
cmp eax, 1
je 0x401f45
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov esi, eax
cmp eax, 0xffffffff
je 0x401b90
mov dword [esp], 0x11600
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x2f4], eax
test eax, eax
je 0x401fed
mov eax, dword [ebp - 0x2f4]
mov ebx, pe_nt_image_headers32
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.kernel32.dll_Process32FirstW
mov edi, dword [sym.imp.ucrtbase.dll_realloc]
mov dword [ebp - 0x300], 1
sub esp, 8
test eax, eax
je 0x401fbc
mov dword [ebp - 0x2f8], esi
mov esi, 1
lea esi, [esi]
imul eax, esi, 0x22c
add eax, dword [ebp - 0x2f4]
mov dword [eax], 0x22c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2f8]
mov dword [esp], eax
call sub.kernel32.dll_Process32NextW
sub esp, 8
test eax, eax
je 0x401740
add esi, 1
cmp esi, ebx
jne 0x4016e0
imul eax, esi, 0x458
lea ebx, [esi + esi]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2f4]
mov dword [esp], eax
call edi
test eax, eax
je 0x402007
mov dword [ebp - 0x2f4], eax
jmp 0x4016e0
mov dword [ebp - 0x300], esi
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [ebp - 0x2f8]
mov dword [ebp - 0x30c], eax
mov dword [esp], esi
call eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
sub esp, 4
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x300]
test eax, eax
je 0x401ba5
mov dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f4]
add eax, 0x24
mov dword [ebp - 0x2fc], eax
jmp 0x4017c8
test byte [0x404018], 1
jne 0x401b20
add dword [ebp - 0x2f8], 1
mov eax, dword [ebp - 0x2f8]
add dword [ebp - 0x2fc], 0x22c
cmp eax, dword [ebp - 0x300]
je 0x401ba5
xor eax, eax
mov ecx, 0x53
lea edi, [ebp - 0x158]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2fc]
lea ecx, [ebp - 0x2f0]
mov dword [esp + 4], ecx
mov ebx, eax
mov eax, dword [eax - 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ProcessIdToSessionId]
sub esp, 8
test eax, eax
je 0x401798
mov eax, dword [ebp - 0x2fc]
mov eax, dword [eax - 0x1c]
mov dword [esp + 4], 0
mov dword [esp], 0x410
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenProcess]
mov esi, eax
mov eax, dword [sym.imp.ucrtbase.dll_wcscpy]
sub esp, 0xc
mov dword [ebp - 0x304], eax
test esi, esi
je 0x401865
lea eax, [ebp - 0x2cc]
mov dword [esp + 8], 0x28
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.kernel32.dll_K32GetProcessMemoryInfo
sub esp, 0xc
test eax, eax
jne 0x401c48
mov dword [esp], esi
mov eax, dword [ebp - 0x30c]
call eax
sub esp, 4
cmp word [ebp - 0x4c], 0
je 0x401b60
mov eax, dword [ebp - 0x2fc]
lea ecx, [ebp - 0x10e]
mov esi, dword [eax - 0x1c]
mov eax, dword [ebp - 0x2c0]
shr eax, 0xa
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x14c]
lea esi, [esi]
lea esi, [esi]
movzx edx, word [ebx]
test dx, dx
je 0x4018c6
add eax, 2
add ebx, 2
mov word [eax - 2], dx
cmp eax, ecx
jne 0x4018b0
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x10c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x406020
mov dword [esp + 4], 0x20
mov dword [esp], eax
call fcn.00401440
mov ecx, dword [ebp - 0x2f0]
mov edx, str.Console
mov eax, str.Services
test ecx, ecx
cmovne eax, edx
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
mov eax, dword [ebp - 0x304]
call eax
mov eax, dword [ebp - 0x2f0]
mov dword [esp + 8], 0x406020
mov dword [esp + 4], 0x20
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x8c]
mov dword [esp], eax
call fcn.00401440
mov eax, dword [ebp - 0x308]
mov edi, dword [eax + 8]
test edi, edi
je 0x4019de
mov esi, dword [sym.imp.ucrtbase.dll__wcsicmp]
mov eax, dword [edi]
cmp eax, 1
je 0x401a78
cmp eax, 4
je 0x401aa8
mov ebx, dword [ebp - 0x158]
cmp eax, 2
je 0x40198f
mov ebx, dword [ebp - 0x150]
cmp eax, 3
je 0x40198f
cmp eax, 5
mov ebx, 0
cmove ebx, dword [ebp - 0x154]
lea eax, [ebp - 0x2cc]
mov dword [esp + 4], 0x406018
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], eax
call fcn.004013f0
cmp eax, 1
jne 0x401c00
mov eax, dword [edi + 4]
test eax, eax
jne 0x401ab0
xor eax, eax
cmp dword [ebp - 0x2cc], ebx
sete al
test eax, eax
je 0x4017a5
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x401956
mov eax, dword [ebp - 0x308]
mov eax, dword [eax + 4]
test eax, eax
je 0x401bc0
cmp eax, 1
je 0x401e38
cmp eax, 2
jne 0x4017a5
lea eax, [ebp - 0x4c]
mov dword [esp], str._n__13.13s__s_n__13.13s__s_n__13.13s__s_n__13.13s__s_n__13.13s__s_n
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x198]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x1d8]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0xcc]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x218]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x258]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x14c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x298]
mov dword [esp + 4], eax
call fcn.00401000
jmp 0x4017a5
lea eax, [ebp - 0x14c]
mov edx, dword [edi + 8]
mov dword [esp], eax
mov dword [esp + 4], edx
call esi
mov ebx, dword [edi + 4]
test ebx, ebx
jne 0x4019cb
test eax, eax
sete al
movzx eax, al
jmp 0x4019cb
lea eax, [ebp - 0xcc]
jmp 0x401a7e
cmp eax, 1
je 0x401ae8
cmp eax, 2
je 0x401b00
cmp eax, 3
je 0x401b10
cmp eax, 4
je 0x401b80
cmp eax, 5
jne 0x4017a5
xor eax, eax
cmp ebx, dword [ebp - 0x2cc]
setbe al
jmp 0x4019cb
xor eax, eax
cmp dword [ebp - 0x2cc], ebx
setne al
jmp 0x4019cb
xor eax, eax
cmp ebx, dword [ebp - 0x2cc]
seta al
jmp 0x4019cb
xor eax, eax
cmp ebx, dword [ebp - 0x2cc]
setb al
jmp 0x4019cb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_get_process_session_id___lu._n
mov dword [esp + 8], str.tasklist_get_process_info
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x404018
mov dword [esp], 0
call fcn.004014f0
jmp 0x4017a5
lea eax, [ebp - 0x4c]
mov dword [esp + 4], 0x4061a4
mov dword [esp], eax
mov eax, dword [ebp - 0x304]
call eax
jmp 0x401870
xor eax, eax
cmp ebx, dword [ebp - 0x2cc]
setae al
jmp 0x4019cb
mov dword [ebp - 0x2f4], 0
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x2f4]
mov dword [esp], eax
mov eax, dword [ebp - 0x310]
call eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x4c]
mov dword [esp], str.__25.25s__8.8s___16.16s__11.11s__12s_n
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xcc]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
call fcn.00401000
jmp 0x4017a5
test byte [0x404018], 2
je 0x4017a5
mov eax, dword [edi + 8]
call fcn.004011c0
mov dword [esp + 0xc], str.Invalid_filter_operand__s._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.tasklist_check_filters
mov dword [esp + 4], 0x404018
mov dword [esp], 1
call fcn.004014f0
jmp 0x4017a5
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 8], 0x406020
mov dword [esp + 4], 0x10
shr eax, 0xa
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2ec]
mov dword [esp], eax
call fcn.00401440
mov edi, dword [0x408010]
test edi, edi
je 0x401d2f
lea eax, [ebp - 0x2ec]
lea edi, [ebp - 0x4c]
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x404000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x400
call dword [sym.imp.kernel32.dll_GetNumberFormatW]
sub esp, 0x18
test eax, eax
je 0x401857
mov eax, dword [ebp - 0x318]
mov dword [esp], 0
call eax
lea ecx, [ebp - 0x2ec]
sub esp, 4
mov dword [esp + 8], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x314]
mov dword [esp + 0xc], 0x10
mov dword [esp + 4], 0x6b
call eax
mov edx, dword [sym.imp.ucrtbase.dll_wcscat]
sub esp, 0x10
mov dword [ebp - 0x31c], edx
mov dword [esp + 4], 0x4061a0
mov dword [esp], edi
call edx
lea eax, [ebp - 0x2ec]
mov dword [esp], edi
mov edx, dword [ebp - 0x31c]
mov dword [esp + 4], eax
call edx
jmp 0x401857
mov dword [esp + 0xc], 2
mov edi, dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov dword [esp + 8], 0x404004
mov dword [esp + 4], 0x20000012
mov dword [esp], 0x400
call edi
sub esp, 0x10
test eax, eax
jne 0x401d67
mov dword [0x404004], 0
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x408008
mov dword [esp + 4], 0x10
mov dword [esp], 0x400
call edi
sub esp, 0x10
test eax, eax
je 0x401ef3
cmp word [0x40800c], 0x32
mov eax, 0x20
je 0x401dac
movzx eax, word [0x408008]
sub eax, 0x30
mov dword [0x404008], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x408004
mov dword [esp + 4], 0xe
mov dword [esp], 0x400
call edi
mov ecx, dword [sym.imp.ucrtbase.dll_wcscpy]
sub esp, 0x10
mov dword [ebp - 0x304], ecx
test eax, eax
je 0x401fa4
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x408000
mov dword [esp + 4], 0xf
mov dword [esp], 0x400
call edi
sub esp, 0x10
test eax, eax
je 0x401f88
mov dword [0x40400c], 0x408004
mov dword [0x404010], 0x408000
mov dword [0x408010], 1
jmp 0x401c81
lea eax, [ebp - 0x4c]
mov dword [esp], str.__s____s____s____s____s__n
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xcc]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
call fcn.00401000
jmp 0x4017a5
mov dword [esp], 0x406048
call fcn.00401000
jmp 0x40155d
lea eax, [ebp - 0x298]
mov ebx, dword [sym.imp.ucrtbase.dll_wcscat]
mov dword [esp + 4], 0x40604c
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x258]
mov dword [esp + 4], 0x40604c
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x218]
mov dword [esp + 4], 0x40604c
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x1d8]
mov dword [esp + 4], 0x40604c
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x198]
mov dword [esp + 4], 0x40604c
mov dword [esp], eax
call ebx
jmp 0x40163c
mov dword [0x404008], 3
jmp 0x401db1
lea eax, [ebp - 0x198]
mov dword [esp], 0x406050
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1d8]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x218]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x258]
mov dword [esp + 8], eax
lea eax, [ebp - 0x298]
mov dword [esp + 4], eax
call fcn.00401000
jmp 0x40165c
lea eax, [ebp - 0x198]
mov dword [esp], str.__s____s____s____s____s__n
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1d8]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x218]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x258]
mov dword [esp + 8], eax
lea eax, [ebp - 0x298]
mov dword [esp + 4], eax
call fcn.00401000
jmp 0x40165c
mov dword [esp + 4], 0x40619c
mov eax, dword [ebp - 0x304]
mov dword [esp], section..bss
call eax
jmp 0x401e15
mov dword [esp + 4], 0x406198
mov eax, ecx
mov dword [esp], 0x408004
call eax
jmp 0x401de9
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x2f4]
sub esp, 4
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x310], eax
call eax
mov dword [ebp - 0x2f4], 0
jmp 0x401ba5
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x310], eax
jmp 0x401ba5
mov dword [ebp - 0x300], esi
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [ebp - 0x2f8]
mov dword [ebp - 0x30c], eax
mov dword [esp], esi
call eax
mov eax, dword [ebp - 0x2f4]
sub esp, 4
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x310], eax
call eax
mov dword [ebp - 0x2f4], 0
jmp 0x40176a