Function at 0x496d30
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x4bf070]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
mov eax, ecx
mov byte [esp + 7], 0
mov dword [esp + 8], eax
push esi
push edi
test eax, eax
je 0x496fb1
mov dword [esp + 0x18], 0
mov dword [esp + 0x150], 4
mov dword [esp + 0x154], 0
call fcn.00406360
push 0
push 2
mov dword [esp + 0x154], eax
mov dword [esp + 0x28], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x14], ebx
cmp ebx, 0xffffffff
je 0x496f98
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 1
jne 0x496f95
nop word [eax + eax]
lea eax, [esp + 0x44]
mov dword [esp + 0x263], 0x78652e72
push eax
lea eax, [esp + 0x260]
mov dword [esp + 0x260], 0x6c707865
push eax
mov word [esp + 0x269], 0x6572
mov word [esp + 0x26f], 0x65
mov byte [esp + 0x268], 0x6f
call fcn.0041e7ae
add esp, 8
test eax, eax
jne 0x496eac
push dword [esp + 0x28]
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x496eac
lea eax, [esp + 0x18]
push eax
push 8
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x496ea9
lea eax, [esp + 0x150]
push eax
push dword [esp + 0x154]
lea eax, [esp + 0x15c]
push eax
push 0xc
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x496e7e
mov eax, dword [esp + 0x14c]
cmp eax, dword [esp + 0x154]
je 0x496edd
mov eax, dword [esp + 0x18]
test eax, eax
je 0x496e91
push eax
call esi
mov dword [esp + 0x18], 0
push edi
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x496eac
push eax
call esi
mov dword [esp + 0x18], 0
jmp 0x496eac
push edi
call esi
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x496dd0
push ebx
call esi
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [esp + 0x15c]
mov dword [esp + 0x150], 0
push 0
push eax
call fcn.004179d0
add esp, 0xc
lea eax, [esp + 0x14c]
push eax
push 0x100
lea eax, [esp + 0x160]
push eax
push 1
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x496f7f
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x15c]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
je 0x496f7f
mov edx, dword [esp + 0x1c]
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x496f43
sub ecx, ebx
cmp ecx, 0x104
jae 0x496f74
push edx
push 0x4b7e5c
push 0x104
push dword [esp + 0x1c]
call fcn.0040ba60
mov edx, dword [esp + 0x2c]
add esp, 0x10
mov byte [esp + 0xf], 1
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x496f92
push eax
call esi
mov dword [esp + 0x18], 0
push edi
call esi
push ebx
call esi
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x26c]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041553e
mov esp, ebp
pop ebp
ret