Function at 0x415470
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push 0xffffffffffffffff
push 0x42c6
push 0x7926
push 0xa35a
call fcn.00410c40
add esp, 0xc
push eax
call fcn.00414c60
add esp, 8
mov eax, dword [0x4191c4]
add eax, 1
mov dword [0x4191c4], eax
push 0x1eae
push 0xc6a8
call fcn.00410ba0
add esp, 8
mov dword [ebp - 0x1f4], eax
push 0x1473
push 0x655c
push 0xc2d9
push 0xc63
push 0xaf6b
push 0xca1
push 0xc9cc
call fcn.00410a70
add esp, 0x1c
mov dword [ebp - 0x1f0], eax
push 0x6d22
push 0xd5c
push 0x1035
call fcn.00410920
add esp, 0xc
mov dword [ebp - 0x1ec], eax
push 0x999b
push 0xcd24
push 0x6f16
call fcn.00410720
add esp, 0xc
mov dword [ebp - 0x1e8], eax
push 0x2dc7
push 0x97e1
push 0x226d
push 0xe1bd
push 0x6e4d
push 0x2840
push 0xc6fd
call fcn.00410560
add esp, 0x1c
mov dword [ebp - 0x1e4], eax
push 0xa43
push 0xc203
push 0xdbda
push 0x737a
call fcn.00410490
add esp, 0x10
mov dword [ebp - 0x1e0], eax
push 0xf1ee
push 0xa9ca
push 0xc455
push 0x628f
call fcn.00410260
add esp, 0x10
mov dword [ebp - 0x1dc], eax
push 0xb99d
push 0x706b
call fcn.00410190
add esp, 8
mov dword [ebp - 0x1d8], eax
push 0x42d4
push 0x36e6
push 0xdc63
push 0xb5e
call fcn.00410060
add esp, 0x10
mov dword [ebp - 0x1d4], eax
push 0x3a11
push 0xa02d
push 0xf4ee
push 0xf42d
call fcn.0040ff90
add esp, 0x10
mov dword [ebp - 0x1d0], eax
push 0x1884
push 0xa080
push 0x4eaf
push 0x8d1b
push 0x1881
push 0x6978
push 0xad33
push 0x3ea6
call fcn.0040fe90
add esp, 0x20
mov dword [ebp - 0x1cc], eax
push 0x2003
push 0x20fa
push 0xf46c
push 0xd99a
call fcn.0040fd80
add esp, 0x10
mov dword [ebp - 0x1c8], eax
push 0x44cf
push 0x1081
push 0x483
push 0xe421
push 0x354b
call fcn.0040fb30
add esp, 0x14
mov dword [ebp - 0x1c4], eax
push 0x7c95
push 0x3dd4
push 0x3954
push 0xf0da
push 0x588a
call fcn.0040f910
add esp, 0x14
mov dword [ebp - 0x1c0], eax
push 0x33e
push 0x3ae1
push 0xa0c
call fcn.0040f800
add esp, 0xc
mov dword [ebp - 0x1bc], eax
push 0xf5c
push 0x769b
push 0x2870
push 0xcc47
push 0xfceb
push 0x6a9b
call fcn.0040f640
add esp, 0x18
mov dword [ebp - 0x1b8], eax
push 0xc574
push 0x1ee8
push 0x764f
push 0x5ccb
push 0x13a
call fcn.0040f560
add esp, 0x14
mov dword [ebp - 0x1b4], eax
push 0x96f4
push 0xe8b9
push 0x8914
push 0xc587
call fcn.0040f3a0
add esp, 0x10
mov dword [ebp - 0x1b0], eax
push 0x2703
push 0x55fb
push 0x2334
push 0xdd40
push 0xf171
push 0xc63e
push 0x864e
push 0x4ce2
push 0x42cc
push 0xec20
call fcn.0040f1b0
add esp, 0x28
mov dword [ebp - 0x1ac], eax
push 0xf159
push 0xb4fa
push 0xbc81
push 0x883f
push 0x98c0
call fcn.0040efc0
add esp, 0x14
mov dword [ebp - 0x1a8], eax
push 0xec4e
push 0xe2c2
push 0x8cfd
push 0x8fb6
push 0xedb7
push 0x42ee
push 0x12fd
call fcn.0040ee80
add esp, 0x1c
mov dword [ebp - 0x1a4], eax
push 0x1110
push 0xaccf
push 0x8142
push 0xcead
push 0xa082
push 0xc41
push 0xcaea
push 0x647e
push 0x6316
call fcn.0040ec10
add esp, 0x24
mov dword [ebp - 0x1a0], eax
push 0x130d
push 0x8c84
push 0x4451
push 0xa99e
push 0xd79d
push 0x8713
push 0xc469
push 0x4b90
push 0x9e9b
call fcn.0040e9e0
add esp, 0x24
mov dword [ebp - 0x19c], eax
push 0xd454
push 0xb7c0
push 0x621d
call fcn.0040e860
add esp, 0xc
mov dword [ebp - 0x198], eax
push 0x2083
push 0xae79
push 0xc081
push 0xc883
push 0x5ce
push 0x4654
call fcn.0040e670
add esp, 0x18
mov dword [ebp - 0x194], eax
push 0x5740
push 0x1e88
push 0xd6a0
call fcn.0040e520
add esp, 0xc
mov dword [ebp - 0x190], eax
push 0x20af
push 0x280
push 0x1bcc
push 0xe9bd
call fcn.0040e360
add esp, 0x10
mov dword [ebp - 0x18c], eax
push 0xdd1c
call fcn.0040e260
add esp, 4
mov dword [ebp - 0x188], eax
push 0xccf5
push 0x618e
call fcn.0040e0f0
add esp, 8
mov dword [ebp - 0x184], eax
push 0x2ebe
call fcn.0040e020
add esp, 4
mov dword [ebp - 0x180], eax
push 0xb2e7
push 0x2d18
call fcn.0040de30
add esp, 8
mov dword [ebp - 0x17c], eax
push 0x3116
push 0x6a0e
push 0x300c
push 0xb328
call fcn.0040dcf0
add esp, 0x10
mov dword [ebp - 0x178], eax
push 0xc5aa
call fcn.0040db60
add esp, 4
mov dword [ebp - 0x174], eax
push 0x24a0
call fcn.0040da70
add esp, 4
mov dword [ebp - 0x170], eax
push 0xd22b
call fcn.0040d8f0
add esp, 4
mov dword [ebp - 0x16c], eax
push 0xdd1c
push 0x386d
push 0xa288
push 0xb64b
push 0x5256
push 0x53af
push 0x4197
call fcn.0040d730
add esp, 0x1c
mov dword [ebp - 0x168], eax
push 0xdef
push 0x2f6
push 0xd17a
push 0xd100
push 0xf8f
call fcn.0040d590
add esp, 0x14
mov dword [ebp - 0x164], eax
push 0x1148
call fcn.0040d3f0
add esp, 4
mov dword [ebp - 0x160], eax
push 0xa85d
push 0x5558
push 0x618a
push 0xe279
call fcn.0040d1b0
add esp, 0x10
mov dword [ebp - 0x15c], eax
push 0xf341
call fcn.0040d000
add esp, 4
mov dword [ebp - 0x158], eax
push 0x22ae
push 0x37af
push 0x7fcc
push 0x3c8b
push 0x98c5
push 0x38db
push 0x24f
push 0xbe6a
push 0x786
push 0x852b
call fcn.0040cf00
add esp, 0x28
mov dword [ebp - 0x154], eax
push 0x7c64
push 0x33c
call fcn.0040cd50
add esp, 8
mov dword [ebp - 0x150], eax
push 0x1448
push 0x5510
push 0xb0cc
push 0xff25
push 0x6972
call fcn.0040cc00
add esp, 0x14
mov dword [ebp - 0x14c], eax
push 0x1f69
push 0x9f4a
push 0x42bd
call fcn.0040ca50
add esp, 0xc
mov dword [ebp - 0x148], eax
push 0x3821
push 0xf6e6
push 0x96fb
push 0x34e2
push 0xdbb0
push 0xed7b
push 0xaade
call fcn.0040c820
add esp, 0x1c
mov dword [ebp - 0x144], eax
push 0xad51
push 0x3643
push 0x3d8e
push 0x48cb
push 0x96d
push 0x44c6
call fcn.0040c6d0
add esp, 0x18
mov dword [ebp - 0x140], eax
push 0x1990
push 0xffe4
push 0xa954
push 0xdf1d
call fcn.0040c540
add esp, 0x10
mov dword [ebp - 0x13c], eax
push 0xa086
push 0xbcfc
push 0x2e50
push 0xe25d
push 0xb06f
push 0x23e2
push 0xe280
push 0xb998
call fcn.0040c4c0
add esp, 0x20
mov dword [ebp - 0x138], eax
push 0x3289
push 0x152
push 0x5ec
call fcn.0040c2e0
add esp, 0xc
mov dword [ebp - 0x134], eax
push 0xfc61
push 0xe184
push 0xd5cb
push 0x6a65
push 0x9b36
call fcn.0040c1e0
add esp, 0x14
mov dword [ebp - 0x130], eax
push 0x785f
push 0x19bb
call fcn.0040c0c0
add esp, 8
mov dword [ebp - 0x12c], eax
push 0x2b3a
push 0x1439
push 0x22b4
push 0x712d
call fcn.0040be70
add esp, 0x10
mov dword [ebp - 0x128], eax
push 0xcd61
push 0x826f
push 0x201f
push 0x3f1b
push 0x4e5a
push 0x75af
push 0x9943
push 0x73b2
call fcn.0040bc70
add esp, 0x20
mov dword [ebp - 0x124], eax
push 0x9238
push 0x2010
push 0x9313
push 0x52d
push 0x3a86
push 0xac4b
push 0xb1d8
push 0xbfef
push 0xe3b9
call fcn.0040bbb0
add esp, 0x24
mov dword [ebp - 0x120], eax
push 0x5119
push 0x5544
call fcn.0040ba80
add esp, 8
mov dword [ebp - 0x11c], eax
push 0x37bf
push 0xad53
call fcn.0040b980
add esp, 8
mov dword [ebp - 0x118], eax
push 0xe354
push 0xbe90
push 0x6062
push 0xa6f7
push 0xdbaf
call fcn.0040b850
add esp, 0x14
mov dword [ebp - 0x114], eax
push 0x4a06
push 0x4ed7
push 0x6a71
push 0x8b0e
push 0xdfbb
push 0x3f2a
push 0x6475
push 0x255
push 0x5db7
call fcn.0040b6b0
add esp, 0x24
mov dword [ebp - 0x110], eax
push 0xb46e
push 0xeae8
push 0xd587
push 0xb57f
push 0xc0a1
push 0xa81d
call fcn.0040b580
add esp, 0x18
mov dword [ebp - 0x10c], eax
push 0x2494
push 0x2fe0
push 0xff25
push 0x321b
push 0x5f95
push 0x1ac6
push 0x6b7a
call fcn.0040b3e0
add esp, 0x1c
mov dword [ebp - 0x108], eax
push 0xa160
push 0xf0e4
push 0x8bb8
push 0x7999
push 0x45fb
push 0x8a43
push 0x4934
push 0x89f9
push 0xe353
push 0x9a76
call fcn.0040b190
add esp, 0x28
mov dword [ebp - 0x104], eax
push 0x7102
push 0x53ac
push 0x681c
push 0xf10b
push 0x9e06
push 0x9674
push 0x36e7
push 0x63a3
call fcn.0040b030
add esp, 0x20
mov dword [ebp - 0x100], eax
push 0xa9af
push 0x80dc
push 0xc708
push 0xdbc0
call fcn.0040adc0
add esp, 0x10
mov dword [ebp - 0xfc], eax
push 0x2449
push 0x939b
call fcn.0040ab80
add esp, 8
mov dword [ebp - 0xf8], eax
push 0xed20
push 0x4c92
push 0x1911
push 0xd4ba
call fcn.0040aa00
add esp, 0x10
mov dword [ebp - 0xf4], eax
push 0x55fa
push 0x2002
push 0x7178
push 0xb586
push 0x7724
push 0x28a
push 0xb773
push 0xfa1f
push 0x16e7
push 0x1e89
call fcn.0040a7b0
add esp, 0x28
mov dword [ebp - 0xf0], eax
push 0xd769
call fcn.0040a5f0
add esp, 4
mov dword [ebp - 0xec], eax
push 0xbe41
push 0x390e
push 0x131c
push 0x6905
push 0x16e4
call fcn.0040a3d0
add esp, 0x14
mov dword [ebp - 0xe8], eax
push 0xf8c7
push 0xd883
push 0xc467
push 0x70b6
push 0x2702
push 0x6c5c
push 0x1fe9
push 0x8094
push 0xd822
push 0x881e
call fcn.0040a280
add esp, 0x28
mov dword [ebp - 0xe4], eax
push 0xe129
push 0xca64
push 0xd485
call fcn.0040a090
add esp, 0xc
mov dword [ebp - 0xe0], eax
push 0x63d4
call fcn.00409fd0
add esp, 4
mov dword [ebp - 0xdc], eax
push 0xc386
push 0x2c7f
push 0x67f2
call fcn.00409f00
add esp, 0xc
mov dword [ebp - 0xd8], eax
push 0x6bdc
push 0x5e6d
push 0x6edd
push 0xea23
push 0x7a55
push 0x6c6c
push 0x8e48
call fcn.00409c10
add esp, 0x1c
mov dword [ebp - 0xd4], eax
push 0xc530
push 0x43e
push 0xbcb9
push 0xffa8
push 0xe987
push 0x22de
push 0x726
call fcn.00409a40
add esp, 0x1c
mov dword [ebp - 0xd0], eax
push 0x81e6
push 0x91e
push 0x3089
push 0x240a
push 0x50df
push 0x85c4
call fcn.00409940
add esp, 0x18
mov dword [ebp - 0xcc], eax
push 0x9506
push 0x2afb
push 0xd865
push 0x963a
push 0xb80a
push 0x5fe
push 0xb511
call fcn.00409700
add esp, 0x1c
mov dword [ebp - 0xc8], eax
push 0xdfa6
push 0x4cc1
push 0x8f7
push 0xa11c
push 0x213f
push 0x3267
call fcn.004095c0
add esp, 0x18
mov dword [ebp - 0xc4], eax
push 0x3897
push 0x258d
push 0x6bcb
push 0x2deb
push 0x71c2
push 0x5be7
push 0xabd0
call fcn.00409500
add esp, 0x1c
mov dword [ebp - 0xc0], eax
push 0x4408
push 0x7570
call fcn.00409420
add esp, 8
mov dword [ebp - 0xbc], eax
push 0x274
push 0xea8a
push 0x43f2
push 0x3ba7
call fcn.00409390
add esp, 0x10
mov dword [ebp - 0xb8], eax
push 0x1562
push 0xaf6b
push 0xc97f
push 0x50d0
call fcn.004092e0
add esp, 0x10
mov dword [ebp - 0xb4], eax
push 0x78cf
push 0x4e1
push 0x38d1
push 0x3faa
push 0x1d2b
push 0x47d9
push 0xe24d
push 0x1884
push 0xe914
call fcn.004091b0
add esp, 0x24
mov dword [ebp - 0xb0], eax
push 0x369f
push 0xc281
call fcn.00408f90
add esp, 8
mov dword [ebp - 0xac], eax
push 0xf413
push 0xdc5e
call fcn.00408de0
add esp, 8
mov dword [ebp - 0xa8], eax
push 0xb15e
push 0x77f1
call fcn.00408ce0
add esp, 8
mov dword [ebp - 0xa4], eax
push 0x3c83
push 0xaecb
push 0xee4c
push 0xa031
push 0x64eb
push 0x5768
push 0xd67a
push 0x70a2
call fcn.00408b50
add esp, 0x20
mov dword [ebp - 0xa0], eax
push 0xa370
push 0xb482
call fcn.00408960
add esp, 8
mov dword [ebp - 0x9c], eax
push 0xdc3c
push 0x59d3
call fcn.00408750
add esp, 8
mov dword [ebp - 0x98], eax
push 0x3e76
push 0x9dbd
push 0x3da
push 0xb579
push 0x78df
push 0xe6ec
push 0xe7b7
push 0x8b04
call fcn.00408570
add esp, 0x20
mov dword [ebp - 0x94], eax
push 0xd88e
push 0xe6a0
push 0x8173
push 0xfee
push 0x853d
push 0x7329
push 0xdc41
push 0x79f6
call fcn.004084c0
add esp, 0x20
mov dword [ebp - 0x90], eax
push 0xe5c2
push 0xaada
call fcn.004083f0
add esp, 8
mov dword [ebp - 0x8c], eax
push 0x70e5
push 0xeeb0
push 0x1905
push 0xf2de
push 0xe2e7
push 0xb5f6
push 0xb6c4
call fcn.00408340
add esp, 0x1c
mov dword [ebp - 0x88], eax
push 0x9f72
call fcn.00408150
add esp, 4
mov dword [ebp - 0x84], eax
push 0x3760
call fcn.00407f30
add esp, 4
mov dword [ebp - 0x80], eax
push 0xdf46
push 0x1c9b
push 0xcbd8
push 0x9530
push 0x3206
push 0x9018
push 0xad55
push 0xc709
push 0x5aa1
push 0xe1dc
call fcn.00407cd0
add esp, 0x28
mov dword [ebp - 0x7c], eax
push 0xeac2
push 0xc7ec
push 0xa31
push 0x68f1
call fcn.00407a80
add esp, 0x10
mov dword [ebp - 0x78], eax
push 0x2df8
push 0x2f8e
push 0x82d2
push 0x18a1
push 0x4f78
push 0xbc00
push 0x7bdf
call fcn.00407940
add esp, 0x1c
mov dword [ebp - 0x74], eax
push 0x63f9
push 0x243e
call fcn.00407770
add esp, 8
mov dword [ebp - 0x70], eax
push 0x80de
push 0x9cf2
push 0x85d0
call fcn.00407610
add esp, 0xc
mov dword [ebp - 0x6c], eax
push 0x584b
push 0x49d
push 0xa96a
push 0x7257
push 0xae3b
push 0x88a9
call fcn.00407480
add esp, 0x18
mov dword [ebp - 0x68], eax
push 0x68d3
call fcn.00407410
add esp, 4
mov dword [ebp - 0x64], eax
push 0x63fb
push 0x8013
push 0xcb98
push 0x5d37
push 0x92c7
push 0xfef3
push 0x8594
push 0x83ed
push 0x30ec
push 0x8c74
call fcn.00407360
add esp, 0x28
mov dword [ebp - 0x60], eax
push 0xae3c
push 0x3b09
push 0x7179
call fcn.00407290
add esp, 0xc
mov dword [ebp - 0x5c], eax
push 0xea98
push 0xaf2a
push 0x944f
push 0xd58b
push 0xe200
push 0xc0be
push 0x93a8
push 0xe6b1
push 0xf1eb
call fcn.00407160
add esp, 0x24
mov dword [ebp - 0x58], eax
push 0x79d2
push 0x17b2
push 0x200a
push 0x44db
call fcn.004070e0
add esp, 0x10
mov dword [ebp - 0x54], eax
push 0xc0a7
push 0xb974
push 0xd481
call fcn.00406f60
add esp, 0xc
mov dword [ebp - 0x50], eax
push 0x68f0
push 0x9ce6
push 0xcfd
push 0xb2ff
push 0xd7ca
push 0x8f66
push 0xc924
push 0x710b
push 0x21f1
push 0x5854
call fcn.00406d60
add esp, 0x28
mov dword [ebp - 0x4c], eax
push 0x31ed
push 0xd9be
push 0x3727
push 0xcb92
push 0x9611
push 0xaf1d
push 0x8369
call fcn.00406cb0
add esp, 0x1c
mov dword [ebp - 0x48], eax
push 0xbbd
call fcn.00406b60
add esp, 4
mov dword [ebp - 0x44], eax
push 0x44da
push 0xbbfc
push 0xc793
call fcn.00406ab0
add esp, 0xc
mov dword [ebp - 0x40], eax
push 0x7758
push 0xd8c
call fcn.00406a10
add esp, 8
mov dword [ebp - 0x3c], eax
push 0xeead
push 0xfc3f
push 0x671
push 0xaf7e
push 0xd74f
push 0x2541
call fcn.00406910
add esp, 0x18
mov dword [ebp - 0x38], eax
push 0x8f93
push 0x9457
call fcn.004067d0
add esp, 8
mov dword [ebp - 0x34], eax
push 0x26a3
push 0x4d07
push 0xecae
push 0x3355
push 0xc7a2
push 0xbe5c
push 0xf074
push 0x6096
push 0xc3ef
push 0x25d3
call fcn.00406670
add esp, 0x28
mov dword [ebp - 0x30], eax
push 0x685b
push 0x97ae
push 0x861d
push 0x350e
push 0x8724
push 0x2c9b
call fcn.00406560
add esp, 0x18
mov dword [ebp - 0x2c], eax
push 0x4ef4
call fcn.004064a0
add esp, 4
mov dword [ebp - 0x28], eax
push 0x1f11
push 0xfc90
push 0x6dc3
push 0x2da4
push 0xfda
push 0xf4c2
call fcn.00406230
add esp, 0x18
mov dword [ebp - 0x24], eax
push 0x5234
call fcn.00406150
add esp, 4
mov dword [ebp - 0x20], eax
push 0x5d3d
push 0x724f
push 0x6e10
push 0xc755
push 0xc2b1
push 0xdd2d
push 0x9467
call fcn.00405f80
add esp, 0x1c
mov dword [ebp - 0x1c], eax
push 0xc5b0
push 0x70
push 0xe048
push 0x9db
push 0x2901
call fcn.00405e00
add esp, 0x14
mov dword [ebp - 0x18], eax
push 0xe1fe
push 0xb9ef
push 0x61ce
push 0x39b
push 0x13e9
push 0x6a01
push 0x4439
push 0x46f4
push 0x890a
push 0xbd58
call fcn.00405cd0
add esp, 0x28
mov dword [ebp - 0x14], eax
push 0x5d10
push 0xeb4f
push 0x6daa
call fcn.00405af0
add esp, 0xc
mov dword [ebp - 0x10], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x416744
mov dword [ebp - 0x420], 0x22c
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 8], 0
jmp 0x416697
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x7a
jae 0x4166d4
lea ecx, [ebp - 0x3fc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x1f4]
push eax
call fcn.004149b0
add esp, 4
push eax
call fcn.00414a40
add esp, 8
test eax, eax
je 0x4166d2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x416746
jmp 0x41668e
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x41673a
mov dword [ebp - 0xc], 0
jmp 0x4166fb
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x7a
jae 0x416738
lea edx, [ebp - 0x3fc]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x1f4]
push ecx
call fcn.004149b0
add esp, 4
push eax
call fcn.00414a40
add esp, 8
test eax, eax
je 0x416736
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x416746
jmp 0x4166f2
jmp 0x4166d4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov esp, ebp
pop ebp
ret