Function at 0x401b90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x6b6224]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov byte [ebp - 0x130], 0
call fcn.00401af0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x401be2
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x401bf3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006052fe
mov esp, ebp
pop ebp
ret
push ebx
push esi
nop word [eax + eax]
lea eax, [ebp - 0x134]
push 0x639e50
push eax
call fcn.00404ab0
add esp, 8
mov ecx, dword [eax]
lea eax, [ebp - 0x108]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401c40
test dl, dl
je 0x401c3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401c40
add eax, 2
add ecx, 2
test dl, dl
jne 0x401c20
xor eax, eax
jmp 0x401c45
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x134]
test eax, eax
sete bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401c68
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x401c76
mov ebx, 1
jmp 0x401f57
lea eax, [ebp - 0x138]
push 0x639e6c
push eax
call fcn.00404ab0
add esp, 8
mov ecx, dword [eax]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401cb2
test dl, dl
je 0x401cae
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401cb2
add eax, 2
add ecx, 2
test dl, dl
jne 0x401c92
xor eax, eax
jmp 0x401cb7
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x138]
test eax, eax
sete bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401cda
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x401ce5
mov bl, 1
jmp 0x401f57
lea eax, [ebp - 0x13c]
push 0x639e88
push eax
call fcn.00404ab0
add esp, 8
mov ecx, dword [eax]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401d21
test dl, dl
je 0x401d1d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401d21
add eax, 2
add ecx, 2
test dl, dl
jne 0x401d01
xor eax, eax
jmp 0x401d26
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x13c]
test eax, eax
sete bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401d49
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x401d54
mov bl, 1
jmp 0x401f57
lea eax, [ebp - 0x140]
push 0x639ea4
push eax
call fcn.00404ab0
add esp, 8
mov ecx, dword [eax]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401d90
test dl, dl
je 0x401d8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401d90
add eax, 2
add ecx, 2
test dl, dl
jne 0x401d70
xor eax, eax
jmp 0x401d95
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x140]
test eax, eax
sete bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401db8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x401dc3
mov bl, 1
jmp 0x401f57
lea eax, [ebp - 0x144]
push 0x639ebc
push eax
call fcn.00404ab0
add esp, 8
mov ecx, dword [eax]
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401e00
test dl, dl
je 0x401dfc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401e00
add eax, 2
add ecx, 2
test dl, dl
jne 0x401de0
xor eax, eax
jmp 0x401e05
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x144]
test eax, eax
sete bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401e28
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x401e33
mov bl, 1
jmp 0x401f57
lea eax, [ebp - 0x148]
push 0x639ee0
push eax
call fcn.00404ab0
add esp, 8
mov ecx, dword [eax]
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401e70
test dl, dl
je 0x401e6c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401e70
add eax, 2
add ecx, 2
test dl, dl
jne 0x401e50
xor eax, eax
jmp 0x401e75
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x148]
test eax, eax
sete bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401e98
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x401ea3
mov bl, 1
jmp 0x401f57
lea eax, [ebp - 0x14c]
push 0x639efc
push eax
call fcn.00404ab0
add esp, 8
mov ecx, dword [eax]
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401ee0
test dl, dl
je 0x401edc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401ee0
add eax, 2
add ecx, 2
test dl, dl
jne 0x401ec0
xor esi, esi
jmp 0x401ee5
sbb esi, esi
or esi, 1
lea ecx, [ebp - 0x14c]
call fcn.00402840
test esi, esi
jne 0x401ef8
mov bl, 1
jmp 0x401f57
lea eax, [ebp - 0x150]
push 0x639f14
push eax
call fcn.00404ab0
add esp, 8
mov ecx, dword [eax]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401f34
test dl, dl
je 0x401f30
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401f34
add eax, 2
add ecx, 2
test dl, dl
jne 0x401f14
xor esi, esi
jmp 0x401f39
sbb esi, esi
or esi, 1
lea ecx, [ebp - 0x150]
call fcn.00402840
mov ebx, dword [ebp - 0x130]
test esi, esi
movzx ebx, bl
mov eax, 1
cmove ebx, eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x130], ebx
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401c00
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.006052fe
mov esp, ebp
pop ebp
ret