Function at 0x4a85f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bd2fd
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x7ef784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 4], 0
call fcn.004c6560
push 0
push 2
mov dword [ebp - 0x268], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x260], ecx
xor edi, edi
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 1
cmp ecx, 0xffffffff
jne 0x4a8682
xor bl, bl
jmp 0x4a8bfd
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x22c
push eax
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4a8bef
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a86c0
sub ecx, edx
lea eax, [ebp - 0x230]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0049de00
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edx, 8
mov eax, dword [ebp - 0x18]
cmovae ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebp - 0x25c], ecx
cmp eax, 0xb
jb 0x4a8735
add eax, 0xfffffff6
lea edx, [ecx + eax*2]
mov eax, ecx
mov dword [ebp - 0x258], edx
nop
mov ecx, edx
sub ecx, eax
sar ecx, 1
je 0x4a8732
nop dword [eax + eax]
cmp word [eax], 0x41
je 0x4a88c2
add eax, 2
sub ecx, 1
jne 0x4a8720
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x4a876d
lea edx, [edx*2 + 2]
mov eax, ebx
cmp edx, 0x1000
jb 0x4a8763
mov ebx, dword [ebx - 4]
add edx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a8c7e
push edx
push ebx
call fcn.006391f8
add esp, 8
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4a86a1
mov ebx, dword [ebp - 0x280]
mov edi, dword [ebp - 0x27c]
mov dword [ebp - 0x25c], ebx
cmp ebx, edi
je 0x4a8bed
push dword [ebp - 0x274]
mov eax, edi
sub eax, ebx
sar eax, 2
push eax
push edi
push ebx
call fcn.004a6800
add esp, 0x10
mov dword [ebp - 0x258], ebx
mov esi, ebx
push dword [esi]
call fcn.004c6f80
add esp, 4
cmp eax, dword [ebp - 0x268]
jne 0x4a8a06
push dword [esi]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x270], ebx
test ebx, ebx
je 0x4a8a02
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
xorps xmm0, xmm0
push ebx
movlpd qword [ebp - 0x288], xmm0
call fcn.004a7e20
mov esi, dword [ebp - 0x28]
add esp, 8
test al, al
je 0x4a89a6
mov ecx, dword [ebp + 0x20]
mov edx, ecx
cmp dword [ecx + 0x14], 0x10
jb 0x4a883c
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push edx
push dword [ebp - 0x18]
cmovae eax, esi
push eax
call fcn.0049fe20
add esp, 0x10
test eax, eax
jne 0x4a89a6
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x288]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x4a8a30
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp edx, 0x10
jb 0x4a89dd
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a88bb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a8c7e
push edx
push ecx
jmp 0x4a89d5
mov edx, 0x717410
mov edi, eax
mov esi, 0xb
sub edi, edx
mov cx, word [edi + edx]
cmp cx, word [edx]
jne 0x4a8940
add edx, 2
sub esi, 1
jne 0x4a88d0
sub eax, dword [ebp - 0x25c]
sar eax, 1
cmp eax, 0xffffffff
je 0x4a8732
lea eax, [ebp - 0x24c]
push eax
call fcn.0061f610
add esp, 4
test al, al
je 0x4a894e
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp eax, 8
jb 0x4a876d
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4a893a
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a8c7e
push ecx
jmp 0x4a8764
mov edx, dword [ebp - 0x258]
add eax, 2
jmp 0x4a8710
lea eax, [ebp - 0x24c]
push eax
call fcn.0061f620
add esp, 4
test al, al
jne 0x4a8905
mov ecx, dword [ebp - 0x27c]
cmp ecx, dword [ebp - 0x264]
je 0x4a8982
mov eax, dword [ebp - 0x24c]
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x27c], ecx
jmp 0x4a8905
lea eax, [ebp - 0x24c]
push eax
push ecx
lea ecx, [ebp - 0x280]
call fcn.004a5890
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x264], eax
jmp 0x4a8905
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp eax, 0x10
jb 0x4a89dd
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x4a89d3
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a8c7e
push ecx
push esi
call fcn.006391f8
add esp, 8
push ebx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x258]
jmp 0x4a8a06
mov byte [ebp - 4], 1
add esi, 4
mov dword [ebp - 0x258], esi
cmp esi, edi
jne 0x4a87c1
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x25c]
xor bl, bl
jmp 0x4a8bfd
mov eax, dword [ebp - 0x288]
mov ebx, 0xe57a42bd
mul ebx
mov edi, 0xd6bf94d5
mov byte [ebp - 4], 3
mov dword [ebp - 0x26c], eax
mov esi, edx
mov eax, dword [ebp - 0x288]
mul edi
mov dword [ebp - 0x268], edx
mov edi, eax
mov eax, dword [ebp - 0x284]
mul ebx
mov ebx, edx
mov ecx, eax
mov eax, dword [ebp - 0x284]
mov edx, 0xd6bf94d5
mul edx
add ecx, esi
mov dword [ebp - 0x258], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [ebp - 0x268]
adc ecx, 0
mov dword [ebp - 0x2a8], edi
xor eax, eax
add ebx, ecx
mov ecx, dword [ebp - 0x258]
adc eax, eax
add ecx, ebx
adc edx, eax
shrd ecx, edx, 0x17
shr edx, 0x17
sub ecx, 0xb6109100
mov dword [ebp - 0x26c], ecx
sbb edx, 2
mov dword [ebp - 0x268], edx
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4a8af3
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8ae9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a8c7e
push edx
push ecx
call fcn.006391f8
add esp, 8
push dword [ebp - 0x270]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x274]
mov eax, dword [ebx + 0x10]
lea esi, [ebx + 0x10]
test eax, eax
je 0x4a8bd0
inc eax
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x270], 1
call fcn.004aaad0
push 1
push 0x717344
lea ecx, [ebp - 0x28]
call fcn.0049dbb0
cmp dword [ebx + 0x14], 0x10
jb 0x4a8b76
mov ebx, dword [ebx]
push dword [esi]
lea ecx, [ebp - 0x28]
push ebx
call fcn.0049dbb0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp + 8]
push eax
call fcn.0049dbb0
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp edx, 0x10
jb 0x4a8bd0
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8bc6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a8c7e
push edx
push ecx
call fcn.006391f8
add esp, 8
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.004a8c90
mov esi, dword [ebp - 0x25c]
add esp, 8
mov bl, al
jmp 0x4a8bfd
mov esi, ebx
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
test esi, esi
je 0x4a8c30
mov ecx, dword [ebp - 0x264]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4a8c26
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a8c7e
push ecx
push esi
call fcn.006391f8
add esp, 8
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x4a8c60
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8c56
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a8c7e
push edx
push ecx
call fcn.006391f8
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006391b7
mov esp, ebp
pop ebp
ret
call fcn.00657f14
int3