Function at 0x437bf0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e6d3
mov eax, dword fs:[0]
push eax
sub esp, 0x174
mov eax, dword [0x5afb3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
mov dword [ebp - 0x168], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x437c40
xor al, al
jmp 0x437e7c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.0042d260
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x180]
call fcn.0042bb90
mov esi, eax
lea eax, [ebp - 0x40]
cmp eax, esi
je 0x437c9e
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x437c83
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004279e0
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
call fcn.00427870
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x16c]
cmp eax, 0x10
jb 0x437cc0
inc eax
lea ecx, [ebp - 0x180]
push eax
push dword [ebp - 0x180]
call fcn.004279e0
lea eax, [ebp - 0x168]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x437e5e
nop word [eax + eax]
mov edx, dword [ebp - 0x160]
lea ecx, [ebp - 0x28]
call fcn.0042d260
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x180]
call fcn.0042bb90
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x437d39
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x437d1e
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004279e0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00427870
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x16c]
cmp eax, 0x10
jb 0x437d5b
inc eax
lea ecx, [ebp - 0x180]
push eax
push dword [ebp - 0x180]
call fcn.004279e0
push dword [ebp - 0x30]
lea eax, [ebp - 0x180]
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.00427280
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x437da8
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x437d8d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004279e0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00427870
mov eax, dword [ebp - 0x16c]
cmp eax, 0x10
jb 0x437dc6
inc eax
lea ecx, [ebp - 0x180]
push eax
push dword [ebp - 0x180]
call fcn.004279e0
mov esi, dword [ebp - 0x18]
test esi, esi
sete al
test al, al
jne 0x437e2d
cmp dword [ebp - 0x2c], 0x10
lea edx, [ebp - 0x40]
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x40]
mov eax, edi
cmp dword [ebp - 0x14], 0x10
cmovae ecx, dword [ebp - 0x28]
cmp esi, edi
cmovb eax, esi
push eax
call fcn.004266d0
add esp, 4
test eax, eax
jne 0x437e11
cmp esi, edi
jae 0x437e08
or eax, 0xffffffff
jmp 0x437e0f
xor eax, eax
cmp esi, edi
setne al
test eax, eax
sete al
test al, al
je 0x437e2d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x160]
cmp eax, ecx
je 0x437e2d
call fcn.0042bf90
lea eax, [ebp - 0x168]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
mov byte [ebp - 4], 0
mov esi, eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x437e56
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.004279e0
test esi, esi
jne 0x437ce0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x437e7a
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004279e0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00526b2d
mov esp, ebp
pop ebp
ret