Function at 0x41c210
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x41de10
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x426304]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x426304]
xor eax, esp
push eax
lea eax, [esp + 0x274]
mov dword fs:[0], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x27c], 0
cmp esi, 0xffffffff
jne 0x41c2ac
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], str.Could_not_get_process_snapshot.
call fcn.0040680e
mov byte [esp + 0x27c], 1
mov dword [esp + 0x18], vtable.std::runtime_error.0
mov byte [esp + 0x27c], 0
push 0x424220
lea ecx, [esp + 0x1c]
push ecx
call fcn.0040b8f9
push 0x228
lea edx, [esp + 0x4c]
push 0
push edx
mov dword [esp + 0x50], 0x22c
call fcn.0040ca80
add esp, 0xc
lea eax, [esp + 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x41c429
xor ecx, ecx
lea eax, [esp + 0x68]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], cx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c300
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x6c]
lea esi, [esp + 0x2c]
call fcn.004014c0
mov byte [esp + 0x27c], 2
mov ecx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
mov edi, ebx
cmp ecx, 8
jae 0x41c3b3
mov edi, esi
mov eax, esi
mov edx, dword [esp + 0x38]
lea ebp, [eax + edx*2]
mov esi, ebx
cmp ecx, 8
jae 0x41c34a
lea esi, [esp + 0x28]
cmp esi, ebp
je 0x41c373
sub edi, esi
movzx edx, word [esi]
push edx
call fcn.00406dfd
mov word [edi + esi], ax
add esi, 2
add esp, 4
cmp esi, ebp
jne 0x41c350
mov ecx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x284]
cmp dword [eax + 0x14], 8
mov esi, dword [eax + 0x10]
jb 0x41c385
mov eax, dword [eax]
cmp edx, esi
jb 0x41c38b
mov edx, esi
mov ebp, 8
cmp ecx, ebp
mov ecx, ebx
jae 0x41c39a
lea ecx, [esp + 0x28]
xor edi, edi
cmp edx, edi
jbe 0x41c3c1
mov bx, word [ecx]
cmp bx, word [eax]
jne 0x41c3b7
add ecx, 2
add eax, 2
dec edx
jne 0x41c3a0
jmp 0x41c3c1
mov eax, ebx
jmp 0x41c338
sbb eax, eax
and eax, 0xfffffffe
inc eax
cmp eax, edi
jne 0x41c3d9
mov eax, dword [esp + 0x38]
cmp eax, esi
jae 0x41c3ce
or eax, 0xffffffff
jmp 0x41c3d7
xor edx, edx
cmp eax, esi
setne dl
mov eax, edx
cmp eax, edi
sete al
test al, al
jne 0x41c466
mov byte [esp + 0x27c], al
cmp dword [esp + 0x3c], ebp
jb 0x41c3fe
mov eax, dword [esp + 0x28]
push eax
call fcn.00406e29
add esp, 4
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x44]
push edx
xor ecx, ecx
push eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], edi
mov word [esp + 0x30], cx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, edi
jne 0x41c2dc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], str.Could_not_find_process.
call fcn.0040680e
mov byte [esp + 0x27c], 3
mov dword [esp + 0x18], vtable.std::runtime_error.0
mov byte [esp + 0x27c], 0
push 0x424220
lea ecx, [esp + 0x1c]
push ecx
call fcn.0040b8f9
mov byte [esp + 0x27c], 0
cmp dword [esp + 0x3c], ebp
jb 0x41c481
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00406e29
add esp, 4
mov esi, dword [esp + 0x4c]
xor edx, edx
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], edi
mov word [esp + 0x28], dx
mov dword [esp + 0x27c], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41c4b6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], edi
mov eax, esi
mov ecx, dword [esp + 0x274]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.004063c1
add esp, 0x26c
ret 4