Function at 0x4b0520
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6cddea
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x80236c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], 0
mov dword [ebp - 4], 0
call fcn.004bdb10
push 0
push 2
mov dword [ebp - 0x294], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, eax
mov dword [ebp - 0x2c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x28c], ecx
xor eax, eax
movq qword [ebp - 0x34], xmm0
xor esi, esi
mov dword [ebp - 0x290], eax
xor edi, edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
cmp ecx, 0xffffffff
jne 0x4b05b8
xor bl, bl
jmp 0x4b0ad3
lea eax, [ebp - 0x280]
mov dword [ebp - 0x280], 0x22c
push eax
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4b0ac5
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b0600
sub ecx, edx
lea eax, [ebp - 0x25c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0049d7d0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edx, 8
mov eax, dword [ebp - 0x18]
cmovae ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebp - 0x288], ecx
cmp eax, 0xb
jb 0x4b0675
add eax, 0xfffffff6
lea edx, [ecx + eax*2]
mov eax, ecx
mov dword [ebp - 0x284], edx
nop
mov ecx, edx
sub ecx, eax
sar ecx, 1
je 0x4b0672
nop dword [eax + eax]
cmp word [eax], 0x41
je 0x4b07f2
add eax, 2
sub ecx, 1
jne 0x4b0660
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x4b06ad
lea edx, [edx*2 + 2]
mov eax, ebx
cmp edx, 0x1000
jb 0x4b06a3
mov ebx, dword [ebx - 4]
add edx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b0b54
push edx
push ebx
call fcn.00669b1d
add esp, 8
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 0x28c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4b05e0
mov ebx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x288], ebx
cmp ebx, edi
je 0x4b0ac3
push dword [ebp - 0x2a0]
mov eax, edi
sub eax, ebx
sar eax, 2
push eax
push edi
push ebx
call fcn.004ae770
add esp, 0x10
mov dword [ebp - 0x284], ebx
mov esi, ebx
nop dword [eax + eax]
push dword [esi]
call fcn.004be550
add esp, 4
cmp eax, dword [ebp - 0x294]
jne 0x4b092a
push dword [esi]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x29c], ebx
test ebx, ebx
je 0x4b0926
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
xorps xmm0, xmm0
push ebx
movlpd qword [ebp - 0x3c], xmm0
call fcn.004afe20
mov esi, dword [ebp - 0x28]
add esp, 8
test al, al
je 0x4b08ca
mov ecx, dword [ebp + 0x20]
mov edx, ecx
cmp dword [ecx + 0x14], 0x10
jb 0x4b0778
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push edx
push dword [ebp - 0x18]
cmovae eax, esi
push eax
call fcn.0049e4b0
add esp, 0x10
test eax, eax
jne 0x4b08ca
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x4b0954
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp edx, 0x10
jb 0x4b0901
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4b07eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b0b54
push edx
push ecx
jmp 0x4b08f9
mov edx, 0x72805c
mov edi, eax
mov esi, 0xb
sub edi, edx
mov cx, word [edx + edi]
cmp cx, word [edx]
jne 0x4b0870
add edx, 2
sub esi, 1
jne 0x4b0800
sub eax, dword [ebp - 0x288]
sar eax, 1
cmp eax, 0xffffffff
je 0x4b0672
lea eax, [ebp - 0x278]
push eax
call fcn.004aae60
add esp, 4
test al, al
je 0x4b087e
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp eax, 8
jb 0x4b06ad
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4b086a
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b0b54
push ecx
jmp 0x4b06a4
mov edx, dword [ebp - 0x284]
add eax, 2
jmp 0x4b0650
lea eax, [ebp - 0x278]
push eax
call fcn.004aae70
add esp, 4
test al, al
jne 0x4b0835
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x290]
je 0x4b08ac
mov eax, dword [ebp - 0x278]
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x30], ecx
jmp 0x4b0835
lea eax, [ebp - 0x278]
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.004ad6e0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x290], eax
jmp 0x4b0835
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp eax, 0x10
jb 0x4b0901
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x4b08f7
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b0b54
push ecx
push esi
call fcn.00669b1d
add esp, 8
push ebx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x284]
jmp 0x4b092a
mov byte [ebp - 4], 1
add esi, 4
mov dword [ebp - 0x284], esi
cmp esi, edi
jne 0x4b0700
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x288]
xor bl, bl
jmp 0x4b0ad3
mov eax, dword [ebp - 0x3c]
mov ebx, 0xe57a42bd
mul ebx
mov edi, 0xd6bf94d5
mov dword [ebp - 0x298], eax
mov esi, edx
mov eax, dword [ebp - 0x3c]
mul edi
mov edi, eax
mov dword [ebp - 0x294], edx
mov eax, dword [ebp - 0x38]
mul ebx
mov ebx, edx
mov ecx, eax
mov eax, dword [ebp - 0x38]
mov edx, 0xd6bf94d5
mul edx
add ecx, esi
mov dword [ebp - 0x284], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [ebp - 0x294]
adc ecx, 0
mov dword [ebp - 0x2a8], edi
xor eax, eax
add ebx, ecx
mov ecx, dword [ebp - 0x284]
adc eax, eax
add ecx, ebx
adc edx, eax
shrd ecx, edx, 0x17
shr edx, 0x17
sub ecx, 0xb6109100
mov dword [ebp - 0x298], ecx
lea ecx, [ebp - 0x28]
sbb edx, 2
mov dword [ebp - 0x294], edx
call fcn.00487aa0
push dword [ebp - 0x29c]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x2a0]
mov eax, dword [ebx + 0x10]
lea esi, [ebx + 0x10]
test eax, eax
je 0x4b0aa6
inc eax
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x29c], 1
call fcn.004ad040
push 1
push 0x727f90
lea ecx, [ebp - 0x28]
call fcn.0049a4d0
cmp dword [ebx + 0x14], 0x10
jb 0x4b0a4c
mov ebx, dword [ebx]
push dword [esi]
lea ecx, [ebp - 0x28]
push ebx
call fcn.0049a4d0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp + 8]
push eax
call fcn.0049a4d0
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp edx, 0x10
jb 0x4b0aa6
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4b0a9c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b0b54
push edx
push ecx
call fcn.00669b1d
add esp, 8
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x298]
push eax
call fcn.004b0b60
mov esi, dword [ebp - 0x288]
add esp, 8
mov bl, al
jmp 0x4b0ad3
mov esi, ebx
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
test esi, esi
je 0x4b0b06
mov ecx, dword [ebp - 0x290]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4b0afc
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b0b54
push ecx
push esi
call fcn.00669b1d
add esp, 8
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x4b0b36
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4b0b2c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b0b54
push edx
push ecx
call fcn.00669b1d
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00669adc
mov esp, ebp
pop ebp
ret
call fcn.006892c4
int3