Function at 0x40a290
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475048
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x499694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xffffffffffffffff
xor ebx, ebx
mov esi, ecx
push ebx
xor eax, eax
push esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
call fcn.004013e0
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x27c]
push ecx
mov dword [ebp - 4], ebx
mov ecx, esi
mov dword [ebp - 0x27c], 0x5c
call fcn.00403b70
cmp eax, 0xffffffff
je 0x40a333
push 0xffffffffffffffff
inc eax
push eax
lea edx, [ebp - 0x2c]
push edx
mov ecx, esi
call fcn.00403a70
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00401360
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], 8
jb 0x40a333
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0040f3f1
add esp, 4
mov dword [ebp - 0x27c], ebx
mov byte [ebp - 0x275], bl
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x280], eax
cmp eax, 0xffffffff
je 0x40a46e
lea ecx, [ebp - 0x274]
push ecx
push eax
mov dword [ebp - 0x274], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, ebx
je 0x40a461
xor edx, edx
lea eax, [ebp - 0x250]
mov word [ebp - 0x2c], dx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40a390
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401540
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x40a3bb
lea eax, [ebp - 0x48]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x38]
mov edx, esi
cmp esi, edi
jb 0x40a3c9
mov edx, edi
cmp dword [ebp - 0x18], 8
mov ecx, dword [ebp - 0x2c]
jae 0x40a3d5
lea ecx, [ebp - 0x2c]
cmp edx, ebx
jbe 0x40a401
lea esp, [esp]
mov bx, word [ecx]
cmp bx, word [eax]
jne 0x40a3f5
add ecx, 2
add eax, 2
dec edx
jne 0x40a3e0
xor ebx, ebx
jmp 0x40a401
sbb eax, eax
and eax, 0xfffffffe
inc eax
xor ebx, ebx
cmp eax, ebx
jne 0x40a410
cmp esi, edi
jb 0x40a410
xor eax, eax
cmp esi, edi
setne al
cmp eax, ebx
je 0x40a445
mov eax, dword [ebp - 0x280]
lea edx, [ebp - 0x274]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], 8
mov esi, eax
jb 0x40a43b
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0040f3f1
add esp, 4
cmp esi, ebx
jne 0x40a377
jmp 0x40a461
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], 8
mov byte [ebp - 0x275], 1
jb 0x40a461
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0040f3f1
add esp, 4
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x275], bl
je 0x40a497
mov esi, dword [ebp - 0x27c]
inc esi
push 0x3e8
mov dword [ebp - 0x27c], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 8
jle 0x40a33f
cmp dword [ebp - 0x34], 8
jb 0x40a4a9
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.0040f3f1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ecc7
mov esp, ebp
pop ebp
ret