Function at 0x42250e
Capabilities:
Enumerate processes

Disassembly:
push 0x268
mov eax, 0x4a9d2b
call fcn.00473acf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
push eax
lea ecx, [ebp - 0x24c]
call fcn.0040a8a7
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x240]
push eax
xor ecx, ecx
call fcn.0041d082
mov edi, eax
mov byte [ebp - 4], 1
mov dword [esp], 0x4c204c
lea eax, [ebp - 0x244]
push esi
push eax
call fcn.00418219
mov byte [ebp - 4], 2
push edi
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.0042f6c6
add esp, 0x18
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.00409a10
push 0x228
lea eax, [ebp - 0x238]
push ebx
push eax
xor edi, edi
mov dword [ebp - 0x23c], ebx
call fcn.00473120
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x4229ed
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.00418464
mov byte [ebp - 4], 8
push 0x4c2054
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229b9
push 0x4c206c
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229b9
push 0x4c2090
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229b4
push 0x4c20a4
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229b4
push 0x4c20b8
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229af
push 0x4c20d4
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229af
push 0x4c20f0
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229aa
push 0x4c2104
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229aa
push 0x4c211c
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229a5
push 0x4c2138
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229a5
push 0x4c215c
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229a5
push 0x4c2174
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229a0
push 0x4c2188
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x4229a0
push 0x4c21a4
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x42299b
push 0x4c21b8
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x42299b
push 0x4c21cc
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x422993
push 0x4c21e4
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x422993
push 0x4c21fc
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
jne 0x4227b0
or edi, 0x100
jmp 0x4229bc
push 0x4c220c
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
jne 0x4227cf
or edi, 0x200
jmp 0x4229bc
push 0x4c2224
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
jne 0x4227ee
or edi, 0x400
jmp 0x4229bc
push 0x4c2240
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
jne 0x42280d
or edi, 0x800
jmp 0x4229bc
push 0x4c2258
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x42298b
push 0x4c2270
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x42298b
push 0x4c2288
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x422983
push 0x4c22a4
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x422983
push 0x4c22d0
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x422983
push 0x4c22fc
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x422983
push 0x4c231c
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
jne 0x4228bc
or edi, 0x4000
jmp 0x4229bc
push 0x4c2338
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
jne 0x4228db
or edi, 0x8000
jmp 0x4229bc
push 0x4c2348
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x42297b
push 0x4c2360
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x42297b
push 0x4c2380
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x42297b
push 0x4c23a0
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x422973
push 0x4c23c0
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x422973
push 0x4c23d8
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
je 0x422973
push 0x4c23f8
lea ecx, [ebp - 0x240]
call fcn.004286e1
test eax, eax
jne 0x4229bc
or edi, 0x40000
jmp 0x4229bc
or edi, 0x20000
jmp 0x4229bc
or edi, 0x10000
jmp 0x4229bc
or edi, 0x2000
jmp 0x4229bc
or edi, 0x1000
jmp 0x4229bc
or edi, 0x80
jmp 0x4229bc
or edi, 0x40
jmp 0x4229bc
or edi, 0x20
jmp 0x4229bc
or edi, 0x10
jmp 0x4229bc
or edi, 8
jmp 0x4229bc
or edi, 4
jmp 0x4229bc
or edi, 2
jmp 0x4229bc
or edi, 1
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.00409a10
cmp dword [ebp - 0x244], ebx
jne 0x4225e3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x4f930c
push esi
lea ecx, [ebp - 0x244]
call fcn.0040a6cc
mov byte [ebp - 4], 0xb
push edi
lea eax, [ebp - 0x244]
push 0x4c240c
push eax
call fcn.0040ab53
add esp, 0xc
lea ecx, [ebp - 0x270]
call fcn.0042d1df
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x248], esp
push 0x4c2414
call fcn.00418464
mov byte [ebp - 4], 0xe
push ecx
mov eax, esp
mov dword [ebp - 0x240], esp
push eax
lea ecx, [ebp - 0x274]
call fcn.004330a8
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x254]
push eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x274]
call fcn.004330ec
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x254]
lea eax, [ebp - 0x248]
push eax
call fcn.0041d082
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x240]
push 0x4c2430
push eax
call fcn.0042f71d
add esp, 0x10
mov byte [ebp - 4], 0x12
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040a99e
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.00409a10
push esi
lea ecx, [ebp - 0x240]
call fcn.0040a6cc
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x240]
push eax
call fcn.00455145
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x248]
push 0x4c2440
push eax
call fcn.0042f71d
add esp, 0x10
mov byte [ebp - 4], 0x17
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040a99e
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.00409a10
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x248]
push 0x4c2450
push eax
call fcn.0042f71d
add esp, 0xc
mov byte [ebp - 4], 0x19
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040a99e
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.00409a10
push dword [ebp + 0x10]
push dword [ebp - 0x250]
push dword [ebp - 0x24c]
push dword [ebp - 0x258]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x254]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x270]
call fcn.0042d237
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
call fcn.00409a10
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24c]
add ecx, 0xfffffff0
call fcn.00409a10
mov eax, esi
call fcn.00473b52
ret