Function at 0x4c1ad0
Capabilities:
Enumerate processes

Disassembly:
push 0x530
mov eax, 0x543e14
call fcn.00506b61
push 0x39
pop ecx
mov esi, str.GR99wCLZWbeIpFfUeHXfTjbsZOuM5bsijdKzAibeTCPo8iUu5ykREzrFTsUDPIbNiby8GIhNVK8mJLvdCGJbsiQZ6aJHzcVPMOC627y8V2u2i97Ihq0Hl5eRqG1yw53zNH29CldevjGOxv2AlEf3zVDKkJ3z0uP9UWFL63YSlAGM0xm24J23k0cQ667iLeVXKQgFSG6y7VPg3GIHIBZHr5DAgwtC14M58c1k6
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0xf8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x77
pop ecx
mov dword [ebp - 0x53c], eax
movsw word es:[edi], word [esi]
mov esi, str.JL5LLeQFUpCJx4zezHvyfbpQISXXAwff3XnF3Z6BCGpioiUQAOTcnaOxHqbu5CLYTAKbZxl9ArRjWFnYtBEK0uTw9iOd4FWnvn0CX2DhAgA7C6jo3vznKZHNVJS2iuxmJpPiylyOPECqYRlBoP1HS64NjnmShasYeWaxNUZnDBIf4mFAiV4hgwrNF13j3JHBMT936HdYudjPqZyTkfpJBfrc5IhGmaqxrb4lQu7mQv1Gc4ATaZeZ2cCRFVoLbWimve7QPDQ4aKCfhOYj8xOmeOy6Q7FAGq160yP55yIBOvhxbXver9yta5BCUEQChHfiOtonXzhN2ycnmyRjveF9iWy0mxJsGZOeIXMpFBcphC7OT582QGERavWAwhGvHMOeagUVddPe13ZQ8jvCzqkamesNT5hwhPA7KUlHYUqcencKR30Ch7iANTQYS5XRKAsn3CFCUnDbcT3h6xxpaXidC47ggG0
mov dword [ebp - 0x538], eax
lea edi, [ebp - 0x2d4]
mov dword [ebp - 0x534], eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2ec]
lea eax, [ebp - 0xf8]
push eax
call fcn.00405820
lea eax, [ebp - 0x2ec]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x53c]
call fcn.00407e30
xor edi, edi
mov byte [ebp - 4], 0
push 0
inc edi
lea ecx, [ebp - 0x2ec]
push edi
call fcn.0046d37e
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.00405820
lea eax, [ebp - 0x2ec]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x53c]
call fcn.00407e30
push 0
push edi
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 0
call fcn.0046d37e
test ebx, ebx
jne 0x4c1b9d
xor esi, esi
jmp 0x4c1cc5
push ebx
lea ecx, [ebp - 0x304]
call fcn.004024f0
lea eax, [ebp - 0x304]
mov byte [ebp - 4], 3
push eax
call fcn.004cd323
mov dword [esp], 0x22c
lea eax, [ebp - 0x530]
xor ebx, ebx
push ebx
push eax
call fcn.004e37a0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4c1cb6
lea eax, [ebp - 0x530]
mov dword [ebp - 0x530], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4c1ca7
xor eax, eax
mov dword [ebp - 0x2d8], 7
mov dword [ebp - 0x2dc], ebx
mov word [ebp - 0x2ec], ax
cmp word [ebp - 0x50c], ax
jne 0x4c1c27
mov eax, ebx
jmp 0x4c1c34
lea eax, [ebp - 0x50c]
push eax
call fcn.004f3a59
pop ecx
push eax
lea eax, [ebp - 0x50c]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.00402650
lea eax, [ebp - 0x2ec]
mov byte [ebp - 4], 4
push eax
call fcn.004cd323
cmp dword [ebp - 0x2f0], 8
lea eax, [ebp - 0x304]
pop ecx
push dword [ebp - 0x2f4]
cmovae eax, dword [ebp - 0x304]
lea ecx, [ebp - 0x2ec]
push eax
push dword [ebp - 0x2dc]
push ebx
call fcn.004169a0
test eax, eax
je 0x4c1cd8
push ebx
push edi
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 3
call fcn.00402590
lea eax, [ebp - 0x530]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4c1c01
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push ebx
push edi
lea ecx, [ebp - 0x304]
call fcn.00402590
lea ecx, [ebp - 0x53c]
call fcn.0046d3d0
mov eax, esi
call fcn.00506b0b
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x528]
lea ecx, [ebp - 0x2ec]
push ebx
push edi
call fcn.00402590
jmp 0x4c1cb8