Function at 0x4efdb8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4b
push 0
push 0
dec ecx
jne 0x4efdc0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f0777
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
xor edx, edx
call fcn.0043ec9c
mov byte [ebp - 0x81], 1
xor edx, edx
push ebp
push 0x4f06e2
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4f06d1
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x4f0788
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x64], eax
push 0
push 0x4f07a0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x68], eax
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1d0], 0x128
mov byte [ebp - 5], 0
mov byte [ebp - 6], 0
mov byte [ebp - 7], 0
mov byte [ebp - 8], 0
mov byte [ebp - 9], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x12], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x368]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x4ff510]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x1d0]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4f01d5
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x1ac]
mov ecx, 0x104
call fcn.00404968
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.00408dd4
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x70]
call fcn.004ef4dc
mov eax, dword [ebp - 0x70]
mov edx, 0x4f07b0
call fcn.00404b04
jne 0x4efef8
mov esi, dword [ebp - 0x1c8]
mov eax, dword [ebp - 0x70]
mov edx, 0x4f07c8
call fcn.00404b04
jne 0x4eff10
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x70]
mov edx, 0x4f07dc
call fcn.00404b04
jne 0x4eff28
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x70]
mov edx, 0x4f07f4
call fcn.00404b04
jne 0x4eff40
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x70]
mov edx, 0x4f0808
call fcn.00404b04
jne 0x4eff58
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x70]
mov edx, 0x4f0828
call fcn.00404b04
jne 0x4eff70
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x60], eax
lea edx, [ebp - 0x21c]
mov eax, 0x4f0840
call fcn.004ef3f0
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4effc1
mov byte [ebp - 5], 1
mov edi, dword [ebp - 0x1b8]
cmp esi, edi
je 0x4effb7
cmp edi, dword [ebp - 0x50]
je 0x4effb7
cmp edi, dword [ebp - 0x54]
je 0x4effb7
cmp edi, dword [ebp - 0x58]
je 0x4effb7
cmp edi, dword [ebp - 0x5c]
je 0x4effb7
cmp edi, dword [ebp - 0x60]
jne 0x4effc1
cmp dword [ebp - 0x68], 0
je 0x4effc1
mov byte [ebp - 0x3f], 1
lea edx, [ebp - 0x220]
mov eax, 0x4f0864
call fcn.004ef3f0
mov edx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4efff1
mov byte [ebp - 6], 1
cmp esi, dword [ebp - 0x1b8]
jne 0x4efff1
mov byte [ebp - 0x41], 1
lea edx, [ebp - 0x224]
mov eax, 0x4f0880
call fcn.004ef3f0
mov edx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f0015
mov byte [ebp - 7], 1
lea edx, [ebp - 0x228]
mov eax, 0x4f08a4
call fcn.004ef3f0
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f004b
mov byte [ebp - 8], 1
cmp esi, dword [ebp - 0x1b8]
jne 0x4f004b
cmp dword [ebp - 0x64], 0
je 0x4f004b
mov byte [ebp - 0x40], 1
lea edx, [ebp - 0x22c]
mov eax, 0x4f08d0
call fcn.004ef3f0
mov edx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f007b
mov byte [ebp - 9], 1
cmp esi, dword [ebp - 0x1b8]
jne 0x4f007b
mov byte [ebp - 0x3e], 1
lea edx, [ebp - 0x230]
mov eax, 0x4f08f4
call fcn.004ef3f0
mov edx, dword [ebp - 0x230]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f009f
mov byte [ebp - 0xa], 1
lea edx, [ebp - 0x234]
mov eax, 0x4f0920
call fcn.004ef3f0
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f00c3
mov byte [ebp - 0xb], 1
lea edx, [ebp - 0x238]
mov eax, 0x4f0940
call fcn.004ef3f0
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f00e7
mov byte [ebp - 0xc], 1
lea edx, [ebp - 0x23c]
mov eax, 0x4f096c
call fcn.004ef3f0
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f010b
mov byte [ebp - 0xd], 1
lea edx, [ebp - 0x240]
mov eax, 0x4f0994
call fcn.004ef3f0
mov edx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f012f
mov byte [ebp - 0xe], 1
lea edx, [ebp - 0x244]
mov eax, 0x4f09b4
call fcn.004ef3f0
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f0153
mov byte [ebp - 0xf], 1
lea edx, [ebp - 0x248]
mov eax, 0x4f09d4
call fcn.004ef3f0
mov edx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f0177
mov byte [ebp - 0x10], 1
lea edx, [ebp - 0x24c]
mov eax, 0x4f09f4
call fcn.004ef3f0
mov edx, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f019b
mov byte [ebp - 0x11], 1
lea edx, [ebp - 0x250]
mov eax, 0x4f0a14
call fcn.004ef3f0
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x70]
call fcn.00404b04
jne 0x4f01bf
mov byte [ebp - 0x12], 1
lea eax, [ebp - 0x1d0]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4efeae
lea eax, [ebp - 0x18]
call fcn.004046f8
cmp byte [ebp - 0x12], 1
jne 0x4f0210
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b8b], 0
jne 0x4f0210
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b7d], 0
jne 0x4f0210
lea eax, [ebp - 0x18]
mov edx, 0x4f0a38
call fcn.00404790
cmp byte [ebp - 0x11], 1
jne 0x4f023b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b8a], 0
jne 0x4f023b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b7c], 0
jne 0x4f023b
lea eax, [ebp - 0x18]
mov edx, 0x4f0a50
call fcn.00404790
cmp byte [ebp - 0x10], 1
jne 0x4f0266
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b89], 0
jne 0x4f0266
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b7b], 0
jne 0x4f0266
lea eax, [ebp - 0x18]
mov edx, 0x4f0a64
call fcn.00404790
cmp byte [ebp - 0xf], 1
jne 0x4f0291
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b88], 0
jne 0x4f0291
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b7a], 0
jne 0x4f0291
lea eax, [ebp - 0x18]
mov edx, 0x4f0a78
call fcn.00404790
cmp byte [ebp - 0xe], 1
jne 0x4f02bc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b87], 0
jne 0x4f02bc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b79], 0
jne 0x4f02bc
lea eax, [ebp - 0x18]
mov edx, 0x4f0a8c
call fcn.00404790
cmp byte [ebp - 0xd], 1
jne 0x4f02e7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b86], 0
jne 0x4f02e7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b78], 0
jne 0x4f02e7
lea eax, [ebp - 0x18]
mov edx, 0x4f0aa0
call fcn.00404790
cmp byte [ebp - 0xc], 1
jne 0x4f0312
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b85], 0
jne 0x4f0312
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b77], 0
jne 0x4f0312
lea eax, [ebp - 0x18]
mov edx, 0x4f0ab8
call fcn.00404790
cmp byte [ebp - 0xb], 1
jne 0x4f033d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b84], 0
jne 0x4f033d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b76], 0
jne 0x4f033d
lea eax, [ebp - 0x18]
mov edx, 0x4f0ad4
call fcn.00404790
cmp byte [ebp - 0xa], 1
jne 0x4f0368
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b83], 0
jne 0x4f0368
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b75], 0
jne 0x4f0368
lea eax, [ebp - 0x18]
mov edx, 0x4f0ae8
call fcn.00404790
cmp esi, dword [ebp - 0x1b8]
jne 0x4f0420
cmp byte [ebp - 9], 1
jne 0x4f039f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b82], 0
jne 0x4f039f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b74], 0
jne 0x4f039f
lea eax, [ebp - 0x18]
mov edx, 0x4f0b04
call fcn.00404790
cmp byte [ebp - 8], 1
jne 0x4f03ca
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b81], 0
jne 0x4f03ca
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b73], 0
jne 0x4f03ca
lea eax, [ebp - 0x18]
mov edx, 0x4f0b1c
call fcn.00404790
cmp byte [ebp - 6], 1
jne 0x4f03f5
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b7f], 0
jne 0x4f03f5
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b71], 0
jne 0x4f03f5
lea eax, [ebp - 0x18]
mov edx, 0x4f0b38
call fcn.00404790
cmp byte [ebp - 5], 1
jne 0x4f0420
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b7e], 0
jne 0x4f0420
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b70], 0
jne 0x4f0420
lea eax, [ebp - 0x18]
mov edx, 0x4f0828
call fcn.00404790
cmp byte [ebp - 7], 1
jne 0x4f044b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b80], 0
jne 0x4f044b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12b72], 0
jne 0x4f044b
lea eax, [ebp - 0x18]
mov edx, 0x4f0b4c
call fcn.00404790
mov eax, dword [ebp - 4]
add eax, 0x12b6c
mov edx, dword [ebp - 0x18]
call fcn.0040474c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x12b6c]
mov edx, 0x4f0b38
call fcn.00404b04
je 0x4f04af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x12b6c]
mov edx, 0x4f0b1c
call fcn.00404b04
je 0x4f04af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x12b6c]
mov edx, 0x4f0b04
call fcn.00404b04
je 0x4f04af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x12b6c]
mov edx, 0x4f0828
call fcn.00404b04
jne 0x4f04c2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
call fcn.004adb04
jmp 0x4f05e5
cmp dword [ebp - 0x18], 0
je 0x4f05e5
lea eax, [ebp - 0x1d0]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4f05dd
lea eax, [ebp - 0x258]
lea edx, [ebp - 0x1ac]
mov ecx, 0x104
call fcn.00404968
mov eax, dword [ebp - 0x258]
lea edx, [ebp - 0x254]
call fcn.00408dd4
mov eax, dword [ebp - 0x254]
lea edx, [ebp - 0x70]
call fcn.004ef4dc
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x18]
call fcn.00404b04
jne 0x4f05c7
mov edi, dword [ebp - 0x1b8]
cmp esi, edi
je 0x4f054b
cmp edi, dword [ebp - 0x50]
je 0x4f054b
cmp edi, dword [ebp - 0x54]
je 0x4f054b
cmp edi, dword [ebp - 0x58]
je 0x4f054b
cmp edi, dword [ebp - 0x5c]
jne 0x4f05c7
lea ecx, [ebp - 0x25c]
mov edx, dword [ebp - 0x1c8]
mov eax, dword [ebp - 4]
call fcn.004efa78
mov edx, dword [ebp - 0x25c]
mov eax, 0x4ff508
call fcn.0040474c
mov eax, dword [0x4ff508]
call fcn.004098e0
test al, al
je 0x4f05c7
push 0x32
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 0x18]
call fcn.004ef57c
mov eax, dword [ebp - 0x1c8]
mov dword [0x4ff4fc], eax
call fcn.0040bcc8
fstp qword [0x4ff500]
wait
mov eax, 0x4ff50c
mov edx, dword [ebp - 0x70]
call fcn.0040474c
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
call fcn.004adb04
jmp 0x4f05e5
lea eax, [ebp - 0x1d0]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4f04e7
cmp byte [ebp - 5], 0
je 0x4f05f1
cmp byte [ebp - 0x3f], 0
jne 0x4f05f5
xor eax, eax
jmp 0x4f05f7
mov al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0x12b7e], al
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 6]
mov byte [eax + 0x12b7f], dl
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 7]
mov byte [eax + 0x12b80], dl
cmp byte [ebp - 8], 0
je 0x4f0624
cmp byte [ebp - 0x40], 0
jne 0x4f0628
xor eax, eax
jmp 0x4f062a
mov al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0x12b81], al
cmp byte [ebp - 9], 0
je 0x4f063f
cmp byte [ebp - 0x3e], 0
jne 0x4f0643
xor eax, eax
jmp 0x4f0645
mov al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0x12b82], al
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0xa]
mov byte [eax + 0x12b83], dl
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0xb]
mov byte [eax + 0x12b84], dl
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0xc]
mov byte [eax + 0x12b85], dl
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0xd]
mov byte [eax + 0x12b86], dl
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0xe]
mov byte [eax + 0x12b87], dl
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0xf]
mov byte [eax + 0x12b88], dl
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0x10]
mov byte [eax + 0x12b89], dl
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0x11]
mov byte [eax + 0x12b8a], dl
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0x12]
mov byte [eax + 0x12b8b], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f06d8
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_CloseHandle
ret