Function at 0x426dd7
Capabilities:
Enumerate processes

Disassembly:
push 0x294
mov eax, 0x5a1f5e
call fcn.004348d9
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x290], eax
mov eax, ecx
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 0x298], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x294], ecx
call fcn.0043a9ef
test al, al
je 0x426e37
cmp byte [edi], cl
inc esi
scasd eax, dword es:[edi]
test byte [edi + 0x1f4ec894], ch
scasb al, byte es:[edi]
jmp 0x426e8f
call fcn.0043a6f8
test al, al
je 0x426e5f
lcall 0x5771, 0x97336d61
scasd eax, dword es:[edi]
cmc
fnstcw word [ebp + 0x1820672]
pushal
pushal
add ecx, 0xfffffff3
mov eax, dword [edx + 0x39]
fmul st(4), st(0)
xor al, 0xc4
sub byte [esi], al
bnd call fcn.0043a515
call fcn.0043a515
test al, al
je 0x426e7e
stosb byte es:[edi], al
shl byte [esp + ebp*8 + 0x29], cl
loop 0x426e51
adc eax, 0xd9e4cae9
lea esi, [esi]
movsd dword es:[edi], dword [esi]
xor dword [ebx - 0x3d], ecx
test al, 0x10
lodsb al, byte [esi]
out 0x68, eax
sub al, 2
add byte [eax], al
push 0x22c
lea eax, [ebp - 0x284]
push 0
push eax
call fcn.00445350
add dword [eax], eax
add esp, 0xc
lea ecx, [ebp - 0x58]
push dword [ebp - 0x28c]
call fcn.00401870
push dword [ebp - 0x290]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00401870
mov byte [ebp - 4], 2
call fcn.0043a851
test al, al
je 0x426ed8
mov al, byte [0x645a9691]
invalid
call fcn.0043a5e4
test al, al
je 0x426ef9
pop es
and eax, 0x49a90f8b
sub al, 0x77
sub edi, dword [ecx]
loop 0x426f3d
pop dword [edx - 0x53f8bbf5]
push es
test eax, 0xee195152
call fcn.0043a66e
test al, al
je 0x426f1a
outsd dx, dword [esi]
insb byte es:[edi], dx
sub dword [0x1f886fc8], 0x332ffe2d
mov cl, 0xc
pop edx
adc dword [edi - 0x67], 0xe63cf4b9
mov dword [esi + 0x50a8458d], ebp
lea eax, [ebp - 0x58]
push eax
call int.0042119b
lea eax, [ebp - 0x40]
push eax
call int.0042119b
pop ecx
pop ecx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x28c], edi
cmp edi, 0xffffffff
jne 0x426f4b
invalid
xor ebx, ebx
jmp 0x42717c
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x427070
invalid
call fcn.0043a6f8
test al, al
je 0x426f8e
pop ebp
nop
scasb al, byte es:[edi]
insd dword es:[edi], dx
xchg edi, eax
sbb dword [edx], eax
sub byte [ebx + 0x6dad94fd], bl
xor ah, byte [edx + 6]
sub al, 0x1a
xchg ecx, eax
loope 0x426f4f
test esp, esp
invalid
call fcn.0043a59f
test al, al
je 0x426fb5
aas
xor eax, dword [eax - 0x101835f1]
std
cdq
test al, al
push 0xfffffffffffffffd
pop ds
mov esp, 0x19014a5
jl 0x426fc4
and byte [edi], dh
cmc
mov bh, 0x5f
in al, 0xa6
or byte [ebx + ecx*4], ah
inc ebp
or byte [ecx], bh
test dword [ebp + edi*8 - 0x7bf00001], eax
add dword [eax], 0
add byte [ebx + 0x3300e865], al
rol bh, 0x45
in al, dx
pop es
add byte [eax], al
add byte [esi - 0x77], ah
inc ebp
fsub dword [esi + 0x39]
test dword [eax + 0x74fffffd], esp
or eax, 0xfda0858d
invalid
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x27c], eax
je 0x427047
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x426feb
lea eax, [ebp - 0x260]
push eax
call fcn.004532f1
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00401a60
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
call int.0042119b
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402fe0
test eax, eax
jne 0x427037
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x290]
push eax
call fcn.0042775c
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004019a0
mov edi, dword [ebp - 0x28c]
lea eax, [ebp - 0x284]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x426f6a
mov esi, dword [ebp - 0x2a0]
mov dword [ebp - 0x288], esi
jmp 0x427076
mov esi, dword [ebp - 0x288]
mov ch, 0x78
std
invalid
call fcn.0043a59f
test al, al
je 0x42709e
mov al, byte [0xb80b10b8]
mov ch, 0xd6
xor byte [ebp + 0x1d], ah
or al, 0xad
jo 0x427025
lea eax, [eax - 0x42]
and byte ds:[edx - 0x25d43e15], bh
popfd
sub ch, byte [edx + 0x57]
and eax, 0xff57a1ac
adc eax, sym.imp.KERNEL32.dll_CloseHandle
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42716a
call fcn.0043a851
test al, al
je 0x4270ca
add byte [eax + eax*8 - 0x950e88c], al
push es
outsb dx, byte [esi]
scasd eax, dword es:[edi]
test byte [esi], 0x6e
xchg dword [eax + 0x6f], ebx
sub byte [eax - 0x30], dh
mov al, 6
dec ebp
outsb dx, byte [esi]
invalid
call fcn.0043a5e4
test al, al
je 0x4270f1
dec esp
xchg ebp, eax
pop ecx
jb 0x427071
adc dword [edx], ebx
cld
xor dword [eax - 0x54], edx
xchg esp, edi
jne 0x4270ae
mov edx, 0x8648f00
xor al, 0xa0
lds edi, [ebx + ecx*4]
mov ch, 0x78
std
invalid
call fcn.0043a66e
test al, al
je 0x427118
int3
push dword [esi]
lea eax, [ebp - 0x28]
push eax
call fcn.00426816
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
call int.0042119b
add esp, 0xc
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x28]
cmovae eax, dword [ebp - 0x40]
push dword [ebp - 0x30]
push 0
push eax
call fcn.00405320
lea ecx, [ebp - 0x28]
push 0
push 1
cmp eax, 0xffffffff
jg 0x4271a7
mov byte [ebp - 4], 2
call fcn.004019a0
add esi, 4
mov dword [ebp - 0x288], esi
cmp esi, dword [ebp - 0x29c]
jne 0x4270aa
mov ebx, dword [ebp - 0x294]
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.004019a0
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.004019a0
lea ecx, [ebp - 0x2a0]
call fcn.004273f3
mov eax, ebx
call fcn.00434894
ret
xor ebx, ebx
inc ebx
call fcn.004019a0
jmp 0x42717c