Function at 0x4fc981
Capabilities:
Enumerate processes

Disassembly:
push 0x4d4
mov eax, 0x50f378
call fcn.004fb730
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 0x4a8], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4fc9af
xor al, al
jmp 0x4fccd3
push edi
lea ecx, [ebp - 0x4b0]
call fcn.0045c011
lea eax, [ebp - 0x498]
mov dword [ebp - 4], ebx
push eax
push edi
mov dword [ebp - 0x498], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4fccc6
xor ebx, ebx
inc ebx
push ecx
push ecx
lea eax, [ebp - 0x474]
mov edx, esp
mov ecx, eax
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x4a8]
jne 0x4fc9f2
sub ecx, esi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x250]
call fcn.004b2788
push str.gamelauncher.exe
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], bl
call fcn.004582e4
test al, al
jne 0x4fca42
push str.gamelauncherx64.exe
lea ecx, [ebp - 0x250]
call fcn.004582e4
test al, al
je 0x4fcc9e
push dword [ebp - 0x490]
xor eax, eax
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4fcc9e
push esi
lea ecx, [ebp - 0x4a4]
call fcn.0045c011
xor ecx, ecx
mov dword [ebp - 0x224], 7
xor eax, eax
mov dword [ebp - 0x228], ecx
mov word [ebp - 0x238], ax
lea eax, [ebp - 0x49c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x49c], 0x105
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x4fcb19
xor eax, eax
push ecx
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x220]
push ecx
mov edx, esp
mov ecx, eax
mov dword [edx], eax
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x4a8]
jne 0x4fcac6
sub ecx, ebx
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x268]
call fcn.004b2788
lea ecx, [ebp - 0x238]
cmp ecx, eax
je 0x4fcb0b
xor ecx, ecx
mov byte [ebp - 0x4ac], cl
lea ecx, [ebp - 0x238]
push dword [ebp - 0x4ac]
push eax
call fcn.00458734
lea ecx, [ebp - 0x268]
call fcn.00455d7e
xor ebx, ebx
inc ebx
xor eax, eax
lea ecx, [ebp - 0x238]
push eax
push str.wildtangent
call fcn.004753d5
cmp eax, 0xffffffff
je 0x4fcc25
lea eax, [ebp - 0x4d0]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x4d8]
movlpd qword [ebp - 0x4b8], xmm0
push eax
lea eax, [ebp - 0x4e0]
movlpd qword [ebp - 0x4e0], xmm0
push eax
lea eax, [ebp - 0x4b8]
movlpd qword [ebp - 0x4d8], xmm0
push eax
push esi
movlpd qword [ebp - 0x4d0], xmm0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x4fcbd8
mov eax, dword [ebp - 0x224]
cmp eax, 8
jb 0x4fcc7a
mov ecx, dword [ebp - 0x238]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x49c], ecx
cmp eax, 0x1000
jb 0x4fcc71
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.00455f19
mov eax, dword [ebp - 0x4a0]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x49c]
jmp 0x4fcc71
lea edx, [ebp - 0x4b8]
lea ecx, [ebp - 0x4c0]
call fcn.004c8bd9
lea ecx, [ebp - 0x4c8]
call fcn.004c8ff4
mov ecx, dword [ebp - 0x4c0]
mov eax, dword [ebp - 0x4bc]
add ecx, 0x7f3d4000
adc eax, 0x25b
cmp dword [ebp - 0x4c4], eax
jl 0x4fccd9
jg 0x4fcc25
cmp dword [ebp - 0x4c8], ecx
jbe 0x4fccd9
mov eax, dword [ebp - 0x224]
cmp eax, 8
jb 0x4fcc7a
mov ecx, dword [ebp - 0x238]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x4a0], ecx
mov dword [ebp - 0x49c], eax
cmp eax, 0x1000
jb 0x4fcc71
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.00455f19
mov eax, dword [ebp - 0x49c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4a0]
push eax
push ecx
call fcn.0047834a
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x224], 7
lea ecx, [ebp - 0x4a4]
mov dword [ebp - 0x228], eax
mov word [ebp - 0x238], ax
call fcn.004ac292
xor eax, eax
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], al
call fcn.00455d7e
lea eax, [ebp - 0x498]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4fc9e1
xor ebx, ebx
lea ecx, [ebp - 0x4b0]
call fcn.004ac292
mov al, bl
call fcn.004fb6da
ret
mov eax, dword [ebp - 0x224]
cmp eax, 8
jb 0x4fcd2e
mov ecx, dword [ebp - 0x238]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x4a0], ecx
cmp eax, 0x1000
jb 0x4fcd25
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.00455f19
mov eax, dword [ebp - 0x49c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4a0]
push eax
push ecx
call fcn.0047834a
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x224], 7
lea ecx, [ebp - 0x4a4]
mov dword [ebp - 0x228], eax
mov word [ebp - 0x238], ax
call fcn.004ac292
lea ecx, [ebp - 0x250]
call fcn.00455d7e
jmp 0x4fccc6