Function at 0x4769f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4985d3
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x254], esi
xor edi, edi
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x244], esi
push esi
push 2
mov dword [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push eax
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x25c], eax
call fcn.00476dc0
mov eax, dword [ebx]
sub eax, 0x10
push eax
mov byte [ebp - 4], 2
call fcn.00405350
add eax, 0x10
add esp, 4
mov dword [ebp - 0x250], eax
mov ebx, dword [ebp - 0x25c]
lea ecx, [ebp - 0x23c]
push ecx
push ebx
mov byte [ebp - 4], 3
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x476b3a
mov esi, dword [ebp - 0x258]
lea edx, [ebp - 0x24c]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
cmp esi, edx
je 0x476add
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x250]
add eax, 0xfffffff0
mov dword [ebp - 0x254], 1
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476b0d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 1
call fcn.00476de0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004799e1
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x23c]
push ecx
push ebx
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x476c8c
lea esp, [esp]
mov edx, dword [ebp - 0x250]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.0047d266
add esp, 8
test eax, eax
jne 0x476c6d
lea ecx, [ebp - 0x234]
cmp ecx, edi
jae 0x476bff
mov edx, ecx
cmp esi, edx
ja 0x476bff
mov ebx, ecx
mov ecx, dword [ebp - 0x244]
sub ebx, esi
sar ebx, 2
cmp edi, ecx
jne 0x476bee
mov eax, edi
sub eax, esi
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x476d1b
sub ecx, esi
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x476bee
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x476bce
xor ecx, ecx
jmp 0x476bd0
add ecx, edx
cmp ecx, eax
jae 0x476bd6
mov ecx, eax
push ecx
lea ecx, [ebp - 0x24c]
call fcn.004767c0
mov edi, dword [ebp - 0x248]
mov esi, dword [ebp - 0x24c]
test edi, edi
je 0x476bf7
mov eax, dword [esi + ebx*4]
mov dword [edi], eax
mov ebx, dword [ebp - 0x25c]
jmp 0x476c64
mov ecx, dword [ebp - 0x244]
cmp edi, ecx
jne 0x476c58
mov eax, edi
sub eax, esi
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x476d1b
sub ecx, esi
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x476c58
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x476c38
xor ecx, ecx
jmp 0x476c3a
add ecx, edx
cmp ecx, eax
jae 0x476c40
mov ecx, eax
push ecx
lea ecx, [ebp - 0x24c]
call fcn.004767c0
mov edi, dword [ebp - 0x248]
mov esi, dword [ebp - 0x24c]
test edi, edi
je 0x476c64
mov ecx, dword [ebp - 0x234]
mov dword [edi], ecx
add edi, 4
mov dword [ebp - 0x248], edi
lea edx, [ebp - 0x23c]
push edx
push ebx
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x476b60
mov ebx, dword [ebp - 0x258]
xor eax, eax
lea ecx, [ebp - 0x24c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
cmp ebx, ecx
je 0x476cc8
mov edx, dword [ebp - 0x244]
mov dword [ebx], esi
xor esi, esi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x250]
add eax, 0xfffffff0
mov dword [ebp - 0x254], 1
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476cf8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 1
call fcn.00476de0
test esi, esi
je 0x476d14
push esi
call fcn.004799d6
add esp, 4
mov eax, ebx
jmp 0x476b1e
push str.vector_T__too_long
call fcn.0047732a
int3