Function at 0x4cec7b
Capabilities:
Enumerate processes

Disassembly:
push 0x4f8
mov eax, 0x5531b5
call fcn.00513ea1
push 0x6d
pop ecx
mov esi, str.5jbwgLc8QAc1JBryhKx4FlYE3Bttl6J9oxsg4HBRVMQjQMGPIFYf93haB26aJ0JDd5Y9y9qvGK0meouWyM5QxPcl6gdHvxIHmoVAFZKNPyozvtnOBfDZCDlVfZp4pig5ys5lZIT1PRrVVQbHrfOvy494lmyFWH7F38UZmosP3yeEDBdgp71r76qEwxRpjINY5UC9zo0dWQOy5UfjbuvUsbDt9EzGTjdEKDXFQn5VL42oKdxsU7wguVo1DgXYIS2XPXdoSQggoAQ5gEoaGLnHsUlPkFiDRVjP96Grs3WuHtQUj4lsyOvBm19c1V4SnpV5IqNswG0b8xpaYdVUMCLmqwJlqJC7vOyRcvE7W9FgEq3NEhR1G2YzYiwSd4NoiIyl0QKniYrbV98vcJEueGIgUDtGOgoagCd28yYeGENWsiTRHNcNxQe
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x29c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x35
pop ecx
mov esi, str.PgI5LolLmoua8Ao2wPzB4Xl5LjfTdQFSlYOwUpyFPo0yUdlM1BkOD5IBbpbjpkPfS4UnNXPwNSfnsFWc9nWo8WhPkrfec7g37vnxgtF0RxLI7wqg7gLPY63juqvsfpK8YyaRYWWpclWzfCeSqiQdaT1CIqWPbuyqJLvgFVHgNqVgoZ4iCPSnFFy2ZhpxKJHu6MEciUJ7VLzxXdg1AryNtR
mov dword [ebp - 0x504], eax
lea edi, [ebp - 0xe8]
mov dword [ebp - 0x500], eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x4fc], eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2b4]
lea eax, [ebp - 0x29c]
push eax
call fcn.004057d0
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x504]
call fcn.00408170
xor edi, edi
mov byte [ebp - 4], 0
push 0
inc edi
lea ecx, [ebp - 0x2b4]
push edi
call fcn.004096c0
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.004057d0
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x504]
call fcn.00408170
push 0
push edi
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 0
call fcn.004096c0
test ebx, ebx
jne 0x4ced49
xor esi, esi
jmp 0x4cee71
push ebx
lea ecx, [ebp - 0x2cc]
call fcn.004024f0
lea eax, [ebp - 0x2cc]
mov byte [ebp - 4], 3
push eax
call fcn.004da491
mov dword [esp], 0x22c
lea eax, [ebp - 0x4f8]
xor ebx, ebx
push ebx
push eax
call fcn.004f0ae0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4cee62
lea eax, [ebp - 0x4f8]
mov dword [ebp - 0x4f8], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4cee53
xor eax, eax
mov dword [ebp - 0x2a0], 7
mov dword [ebp - 0x2a4], ebx
mov word [ebp - 0x2b4], ax
cmp word [ebp - 0x4d4], ax
jne 0x4cedd3
mov eax, ebx
jmp 0x4cede0
lea eax, [ebp - 0x4d4]
push eax
call fcn.00500d29
pop ecx
push eax
lea eax, [ebp - 0x4d4]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00402650
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 4
push eax
call fcn.004da491
cmp dword [ebp - 0x2b8], 8
lea eax, [ebp - 0x2cc]
pop ecx
push dword [ebp - 0x2bc]
cmovae eax, dword [ebp - 0x2cc]
lea ecx, [ebp - 0x2b4]
push eax
push dword [ebp - 0x2a4]
push ebx
call fcn.004266e0
test eax, eax
je 0x4cee84
push ebx
push edi
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 3
call fcn.00402590
lea eax, [ebp - 0x4f8]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4cedad
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push ebx
push edi
lea ecx, [ebp - 0x2cc]
call fcn.00402590
lea ecx, [ebp - 0x504]
call fcn.0047920e
mov eax, esi
call fcn.00513e4b
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x4f0]
lea ecx, [ebp - 0x2b4]
push ebx
push edi
call fcn.00402590
jmp 0x4cee64