Function at 0x40e8f8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov edx, esp
lea esi, [ebp - 0x54]
mov dword [edx], esi
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x29c], ecx
call fcn.00404c44
mov dword [ebp - 0x28], 0x780834
mov dword [ebp - 0x24], 0x793650
mov eax, ebp
mov dword [ebp - 0x20], eax
mov eax, esp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x40ebf8
mov dword [ebp - 0x3c], 1
lea eax, [ebp - 0x44]
call fcn.007811a9
mov eax, esp
mov dword [eax + 4], 0
mov dword [eax], 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0x2a0], eax
jmp 0x40e988
mov eax, 0xffffffff
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], eax
jne 0x40e9e9
mov eax, dword [ebp - 0x298]
mov dword [eax], 0
mov dword [ebp - 0x3c], 2
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], 0
call fcn.00404c5c
jmp 0x40e9c0
mov dword [ebp - 0x60], 1
jmp 0x40ebb0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x3c], 3
mov eax, esp
lea ecx, [ebp - 0x290]
mov dword [eax], ecx
mov dword [eax + 8], 0x22c
mov dword [eax + 4], 0
call fcn.0076d60f
mov dword [ebp - 0x2ac], eax
jmp 0x40ea1c
mov dword [ebp - 0x290], 0x22c
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 4
mov ecx, esp
lea edx, [ebp - 0x290]
mov dword [ecx + 4], edx
mov dword [ecx], eax
call sub.KERNEL32.DLL_Process32FirstW
sub esp, 8
mov dword [ebp - 0x2b0], eax
jmp 0x40ea4d
mov eax, dword [ebp - 0x2b0]
cmp eax, 0
jne 0x40ea5d
jmp 0x40eb65
jmp 0x40ea5f
mov eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0x48]
jne 0x40ea75
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x64], eax
jmp 0x40eaa9
jmp 0x40ea77
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 5
mov ecx, esp
lea edx, [ebp - 0x290]
mov dword [ecx + 4], edx
mov dword [ecx], eax
call sub.KERNEL32.DLL_Process32NextW
sub esp, 8
mov dword [ebp - 0x2b4], eax
jmp 0x40ea9e
mov eax, dword [ebp - 0x2b4]
cmp eax, 0
jne 0x40ea5f
cmp dword [ebp - 0x64], 0
jbe 0x40eb63
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x3c], 6
mov ecx, esp
lea edx, [ebp - 0x294]
mov dword [ecx], edx
mov dword [ebp - 0x2b8], eax
call fcn.00404c44
jmp 0x40eae6
mov dword [ebp - 0x3c], 7
mov eax, esp
mov ecx, dword [ebp - 0x2b8]
mov dword [eax + 4], ecx
lea edx, [ebp - 0x294]
mov dword [eax], edx
call fcn.00424d38
jmp 0x40eb07
mov dword [ebp - 0x3c], 8
mov eax, esp
lea ecx, [ebp - 0x294]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x54]
mov dword [eax], ecx
call fcn.00785cc0
mov dword [ebp - 0x2bc], eax
jmp 0x40eb2b
lea eax, [ebp - 0x294]
mov dword [esp], eax
call fcn.0078556c
jmp 0x40eb63
jmp 0x40eb65
cmp dword [ebp - 0x50], 0
je 0x40eb8b
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 9
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov dword [ebp - 0x2c8], eax
jmp 0x40eb89
jmp 0x40eb8b
mov dword [ebp - 0x3c], 0xa
mov eax, esp
lea ecx, [ebp - 0x54]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x298]
mov dword [eax], ecx
call fcn.007855bc
jmp 0x40eba9
mov dword [ebp - 0x60], 1
lea eax, [ebp - 0x54]
mov dword [esp], eax
call fcn.0078556c
jmp 0x40ebca
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.007811ca
mov eax, dword [ebp - 0x29c]
add esp, 0x2cc
pop esi
pop edi
pop ebx
pop ebp
ret