Function at 0x4e85c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
push 2
mov dword [ebp - 0x250], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x23c], edi
cmp edi, 0xffffffff
je 0x4e8839
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4e8839
or ebx, 0xffffffff
lea esp, [esp]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x238], 0
push eax
lea ecx, [ebp - 0x238]
call fcn.004672d0
test esi, esi
je 0x4e8946
push esi
push dword [ebp - 0x238]
call fcn.0053ef62
add esp, 8
test eax, eax
jne 0x4e8803
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
jne 0x4e8671
mov eax, dword [ebp + 0x10]
cmp dword [eax - 0xc], 0
je 0x4e8895
push dword [ebp - 0x228]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x234], ebx
test ebx, ebx
je 0x4e888d
mov byte [ebp - 0x24c], 1
mov byte [ebp - 0x244], 1
call fcn.00468bd0
mov ecx, eax
test ecx, ecx
je 0x4e8946
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x248], edi
call fcn.00468bd0
mov ecx, eax
test ecx, ecx
je 0x4e8946
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x240], esi
cmp dword [eax - 0xc], 0
je 0x4e874f
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.004cedb0
add esp, 0xc
test eax, eax
je 0x4e8743
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4e8946
mov edi, dword [ebp - 0x248]
push eax
push edi
call fcn.0053ef62
mov ecx, dword [ebp - 0x24c]
xor edx, edx
add esp, 8
movzx ecx, cl
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x24c], ecx
jmp 0x4e8749
mov edi, dword [ebp - 0x248]
mov ebx, dword [ebp - 0x234]
mov eax, dword [ebp + 0x10]
cmp dword [eax - 0xc], 0
je 0x4e87a5
lea eax, [ebp - 0x240]
push eax
push ebx
call fcn.004cf530
add esp, 8
test eax, eax
je 0x4e879f
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4e8946
mov esi, dword [ebp - 0x240]
push eax
push esi
call fcn.0053ef62
mov ecx, dword [ebp - 0x244]
xor edx, edx
add esp, 8
movzx ecx, cl
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x244], ecx
jmp 0x4e87a5
mov esi, dword [ebp - 0x240]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x24c], 0
je 0x4e87c2
cmp byte [ebp - 0x244], 0
jne 0x4e88cd
add esi, 0xfffffff0
or ebx, 0xffffffff
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e87de
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e87f7
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x23c]
mov esi, dword [ebp - 0x250]
mov edx, dword [ebp - 0x238]
mov ecx, ebx
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e8822
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4e8620
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0xc]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e885d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 0x10]
or ecx, 0xffffffff
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e887a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret
or ebx, 0xffffffff
jmp 0x4e8803
mov edx, dword [ebp - 0x238]
mov ecx, ebx
add edx, 0xfffffff0
mov dword [ebp - 0x234], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e893c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x234]
jmp 0x4e8839
add esi, 0xfffffff0
mov dword [ebp - 0x234], 1
or ebx, 0xffffffff
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e88f3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e890c
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x238]
mov ecx, ebx
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e892b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x23c]
mov ebx, dword [ebp - 0x234]
jmp 0x4e8839
mov ebx, 1
jmp 0x4e8839
push 0x80004005
call fcn.00468960
int3