Function at 0x4fb404
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4f
push 0
push 0
dec ecx
jne 0x4fb40c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4fb959
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
mov dword [ebp - 0x234], 0x22c
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fb930
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 6], 0
jne 0x4fb665
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_Process32FirstW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x4fb65b
xor ebx, ebx
mov esi, 0x50de00
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.00406c50
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00411c14
mov eax, dword [ebp - 0x238]
push eax
lea edx, [ebp - 0x240]
mov eax, dword [esi]
call fcn.00411c14
mov edx, dword [ebp - 0x240]
pop eax
call fcn.00407128
jne 0x4fb4fa
mov byte [ebp - 6], 1
lea edx, [ebp - 0x244]
mov eax, dword [esi + 4]
call fcn.00411c14
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x3e8
call fcn.00406a68
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [eax + 0x3ec], ebx
jmp 0x4fb507
inc ebx
add esi, 8
cmp ebx, 7
jne 0x4fb47b
cmp byte [ebp - 6], 0
je 0x4fb550
mov byte [ebp - 6], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x3ec]
mov eax, dword [eax*8 + 0x50de04]
call fcn.00406af4
push eax
push 0
call sub.user32.dll_FindWindowW
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x3b0], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x3b0], 0
je 0x4fb550
mov byte [ebp - 6], 1
cmp byte [ebp - 6], 0
jne 0x4fb63c
xor ebx, ebx
mov edi, 0x50dce4
lea eax, [ebp - 0x24c]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.00406c50
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x248]
call fcn.00411c14
mov eax, dword [ebp - 0x248]
push eax
lea edx, [ebp - 0x250]
mov eax, dword [edi]
call fcn.00411c14
mov edx, dword [ebp - 0x250]
pop eax
call fcn.00407128
jne 0x4fb5e3
mov byte [ebp - 6], 1
lea edx, [ebp - 0x254]
mov eax, dword [edi + 8]
call fcn.00411c14
mov edx, dword [ebp - 0x254]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x3e8
call fcn.00406a68
lea eax, [ebx + 6]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x3ec], eax
jmp 0x4fb5f0
inc ebx
add edi, 0xc
cmp ebx, 5
jne 0x4fb561
cmp byte [ebp - 6], 0
je 0x4fb63c
mov byte [ebp - 6], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x3ec]
lea eax, [eax + eax*2]
mov eax, dword [eax*4 + 0x50dca0]
call fcn.00406af4
push eax
push 0
call sub.user32.dll_FindWindowW
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x3b0], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x3b0], 0
je 0x4fb63c
mov byte [ebp - 6], 1
cmp byte [ebp - 6], 0
jne 0x4fb665
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_Process32NextW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
jne 0x4fb474
cmp byte [ebp - 6], 0
jne 0x4fb7c7
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_Process32FirstW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x4fb76d
lea eax, [ebp - 0x25c]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.00406c50
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 0x258]
call fcn.00411c14
mov eax, dword [ebp - 0x258]
push eax
lea edx, [ebp - 0x260]
mov eax, 0x4fb978
call fcn.00411c14
mov edx, dword [ebp - 0x260]
pop eax
call fcn.00407128
je 0x4fb725
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.00406c50
mov eax, dword [ebp - 0x268]
lea edx, [ebp - 0x264]
call fcn.00411c14
mov eax, dword [ebp - 0x264]
push eax
lea edx, [ebp - 0x26c]
mov eax, 0x4fb9a0
call fcn.00411c14
mov edx, dword [ebp - 0x26c]
pop eax
call fcn.00407128
jne 0x4fb74e
mov byte [ebp - 6], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x3e8
mov edx, 0x4fb9cc
call fcn.00406a68
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [eax + 0x3ec], 0xb
cmp byte [ebp - 6], 0
jne 0x4fb777
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_Process32NextW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
jne 0x4fb68d
cmp byte [ebp - 6], 0
je 0x4fb7c7
mov byte [ebp - 6], 0
xor ebx, ebx
mov esi, 0x50ddb8
mov eax, dword [esi]
call fcn.00406af4
push eax
push 0
call sub.user32.dll_FindWindowW
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [eax + 0x3b0], edi
mov eax, dword [ebp + 8]
test edi, edi
je 0x4fb7be
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [eax + 0x3f0], ebx
mov byte [ebp - 6], 1
jmp 0x4fb7c7
inc ebx
add esi, 4
cmp ebx, 9
jne 0x4fb788
cmp byte [ebp - 6], 0
jne 0x4fb919
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_Process32FirstW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x4fb8c8
xor ebx, ebx
mov esi, 0x50dd98
lea eax, [ebp - 0x274]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.00406c50
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 0x270]
call fcn.00411c14
mov eax, dword [ebp - 0x270]
push eax
lea edx, [ebp - 0x278]
mov eax, dword [esi]
call fcn.00411c14
mov edx, dword [ebp - 0x278]
pop eax
call fcn.00407128
jne 0x4fb89c
mov byte [ebp - 6], 1
mov eax, ebx
sub eax, 1
jb 0x4fb84e
je 0x4fb868
jmp 0x4fb880
mov ecx, dword [esi + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x3e8
mov edx, 0x4fb9e8
call fcn.00406f24
jmp 0x4fb880
mov ecx, dword [esi + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x3e8
mov edx, 0x4fb9fc
call fcn.00406f24
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [eax + 0x3ec], 0x13
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [eax + 0x3f4], ebx
inc ebx
add esi, 8
cmp ebx, 2
jne 0x4fb7f6
cmp byte [ebp - 6], 0
jne 0x4fb8d2
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_Process32NextW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
jne 0x4fb7ef
cmp byte [ebp - 6], 0
je 0x4fb919
mov byte [ebp - 6], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x3f4]
mov eax, dword [eax*8 + 0x50dd9c]
call fcn.00406af4
push eax
push 0
mov eax, dword [0x50e760]
mov eax, dword [eax]
call eax
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [eax + 0x3b0], ebx
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x4fb919
mov byte [ebp - 6], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb937
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret