Function at 0x45281c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb6c
mov eax, 0x63a288
push ebx
push esi
push edi
call fcn.005da0b4
mov dword [ebp - 0x28], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.005e6fc8
inc dword [ebp - 0x28]
xor edx, edx
mov word [ebp - 0x34], 8
mov word [ebp - 0x34], 0x14
mov dword [ebp - 4], edx
lea edi, [ebp - 0x270]
inc dword [ebp - 0x28]
xor ebx, ebx
mov word [ebp - 0x34], 8
mov esi, 0x625aa0
mov ecx, 0x8b
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x494]
mov ecx, 0x89
mov esi, 0x625ccc
rep movsd dword es:[edi], dword [esi]
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
jne 0x4528c9
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x28]
call fcn.005e7218
dec dword [ebp - 0x28]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.005e7218
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x452ac1
lea ecx, [ebp - 0x270]
push ecx
push esi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
setne al
and eax, 1
test al, al
je 0x452a8d
mov word [ebp - 0x34], 0x20
lea edx, [ebp - 0x24c]
lea eax, [ebp - 8]
call fcn.005e7060
mov edx, eax
inc dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.005e7248
dec dword [ebp - 0x28]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005e7218
mov word [ebp - 0x34], 0x2c
mov edx, 0x62b8a4
lea eax, [ebp - 0xc]
call fcn.005e6f90
inc dword [ebp - 0x28]
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.005e745c
test eax, eax
lea eax, [ebp - 0xc]
sete cl
and ecx, 1
mov edx, 2
push ecx
dec dword [ebp - 0x28]
call fcn.005e7218
pop ecx
test cl, cl
je 0x4529ea
mov eax, dword [ebp - 0x268]
push eax
push 0xf
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x4529a2
mov word [ebp - 0x34], 0x38
lea edx, [ebp - 0x24c]
lea eax, [ebp - 0x10]
call fcn.005e7060
mov edx, eax
inc dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.005e7248
dec dword [ebp - 0x28]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.005e7218
jmp 0x4529e4
lea ecx, [ebp - 0x494]
push ecx
push edi
call sub.KERNEL32.DLL_Module32First
test eax, eax
je 0x4529e4
mov word [ebp - 0x34], 0x44
lea edx, [ebp - 0x374]
lea eax, [ebp - 0x14]
call fcn.005e6f90
mov edx, eax
inc dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.005e7248
dec dword [ebp - 0x28]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.005e7218
push edi
call sub.KERNEL32.DLL_CloseHandle
mov word [ebp - 0x34], 0x50
xor ecx, ecx
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 0x18]
inc dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.005c172c
lea eax, [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 0x1c]
inc dword [ebp - 0x28]
call fcn.005e7508
lea eax, [ebp - 0x1c]
xor ecx, ecx
push eax
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0x28]
lea eax, [ebp + 0xc]
lea edx, [ebp - 0x20]
call fcn.005e7508
lea edx, [ebp - 0x20]
pop eax
call fcn.005e72fc
push eax
dec dword [ebp - 0x28]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.005e7218
dec dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.005e7218
dec dword [ebp - 0x28]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.005e7218
pop ecx
test cl, cl
je 0x452a70
mov bl, 1
jmp 0x452a8d
lea eax, [ebp - 0x270]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
setne al
and eax, 1
test al, al
jne 0x4528e6
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x28]
call fcn.005e7218
dec dword [ebp - 0x28]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.005e7218
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret