Function at 0x4a9d50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bfc4d
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x7f3784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 4], 0
call fcn.004c7dd0
push 0
push 2
mov dword [ebp - 0x268], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x260], ecx
xor edi, edi
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 1
cmp ecx, 0xffffffff
jne 0x4a9de2
xor bl, bl
jmp 0x4aa35d
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x22c
push eax
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4aa34f
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a9e20
sub ecx, edx
lea eax, [ebp - 0x230]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0049f4a0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edx, 8
mov eax, dword [ebp - 0x18]
cmovae ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebp - 0x25c], ecx
cmp eax, 0xb
jb 0x4a9e95
add eax, 0xfffffff6
lea edx, [ecx + eax*2]
mov eax, ecx
mov dword [ebp - 0x258], edx
nop
mov ecx, edx
sub ecx, eax
sar ecx, 1
je 0x4a9e92
nop dword [eax + eax]
cmp word [eax], 0x41
je 0x4aa022
add eax, 2
sub ecx, 1
jne 0x4a9e80
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x4a9ecd
lea edx, [edx*2 + 2]
mov eax, ebx
cmp edx, 0x1000
jb 0x4a9ec3
mov ebx, dword [ebx - 4]
add edx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa3de
push edx
push ebx
call fcn.0063bb18
add esp, 8
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4a9e01
mov ebx, dword [ebp - 0x280]
mov edi, dword [ebp - 0x27c]
mov dword [ebp - 0x25c], ebx
cmp ebx, edi
je 0x4aa34d
push dword [ebp - 0x274]
mov eax, edi
sub eax, ebx
sar eax, 2
push eax
push edi
push ebx
call fcn.004a7f60
add esp, 0x10
mov dword [ebp - 0x258], ebx
mov esi, ebx
push dword [esi]
call fcn.004c87f0
add esp, 4
cmp eax, dword [ebp - 0x268]
jne 0x4aa166
push dword [esi]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x270], ebx
test ebx, ebx
je 0x4aa162
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
xorps xmm0, xmm0
push ebx
movlpd qword [ebp - 0x288], xmm0
call fcn.004a9580
mov esi, dword [ebp - 0x28]
add esp, 8
test al, al
je 0x4aa106
mov ecx, dword [ebp + 0x20]
mov edx, ecx
cmp dword [ecx + 0x14], 0x10
jb 0x4a9f9c
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push edx
push dword [ebp - 0x18]
cmovae eax, esi
push eax
call fcn.004a14b0
add esp, 0x10
test eax, eax
jne 0x4aa106
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x288]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x4aa190
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp edx, 0x10
jb 0x4aa13d
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4aa01b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa3de
push edx
push ecx
jmp 0x4aa135
mov edx, 0x71a548
mov edi, eax
mov esi, 0xb
sub edi, edx
mov cx, word [edi + edx]
cmp cx, word [edx]
jne 0x4aa0a0
add edx, 2
sub esi, 1
jne 0x4aa030
sub eax, dword [ebp - 0x25c]
sar eax, 1
cmp eax, 0xffffffff
je 0x4a9e92
lea eax, [ebp - 0x24c]
push eax
call fcn.00621e30
add esp, 4
test al, al
je 0x4aa0ae
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp eax, 8
jb 0x4a9ecd
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4aa09a
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa3de
push ecx
jmp 0x4a9ec4
mov edx, dword [ebp - 0x258]
add eax, 2
jmp 0x4a9e70
lea eax, [ebp - 0x24c]
push eax
call fcn.00621e40
add esp, 4
test al, al
jne 0x4aa065
mov ecx, dword [ebp - 0x27c]
cmp ecx, dword [ebp - 0x264]
je 0x4aa0e2
mov eax, dword [ebp - 0x24c]
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x27c], ecx
jmp 0x4aa065
lea eax, [ebp - 0x24c]
push eax
push ecx
lea ecx, [ebp - 0x280]
call fcn.004a6ff0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x264], eax
jmp 0x4aa065
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp eax, 0x10
jb 0x4aa13d
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x4aa133
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa3de
push ecx
push esi
call fcn.0063bb18
add esp, 8
push ebx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x258]
jmp 0x4aa166
mov byte [ebp - 4], 1
add esi, 4
mov dword [ebp - 0x258], esi
cmp esi, edi
jne 0x4a9f21
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x25c]
xor bl, bl
jmp 0x4aa35d
mov eax, dword [ebp - 0x288]
mov ebx, 0xe57a42bd
mul ebx
mov edi, 0xd6bf94d5
mov byte [ebp - 4], 3
mov dword [ebp - 0x26c], eax
mov esi, edx
mov eax, dword [ebp - 0x288]
mul edi
mov dword [ebp - 0x268], edx
mov edi, eax
mov eax, dword [ebp - 0x284]
mul ebx
mov ebx, edx
mov ecx, eax
mov eax, dword [ebp - 0x284]
mov edx, 0xd6bf94d5
mul edx
add ecx, esi
mov dword [ebp - 0x258], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [ebp - 0x268]
adc ecx, 0
mov dword [ebp - 0x2a8], edi
xor eax, eax
add ebx, ecx
mov ecx, dword [ebp - 0x258]
adc eax, eax
add ecx, ebx
adc edx, eax
shrd ecx, edx, 0x17
shr edx, 0x17
sub ecx, 0xb6109100
mov dword [ebp - 0x26c], ecx
sbb edx, 2
mov dword [ebp - 0x268], edx
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4aa253
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4aa249
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa3de
push edx
push ecx
call fcn.0063bb18
add esp, 8
push dword [ebp - 0x270]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x274]
mov eax, dword [ebx + 0x10]
lea esi, [ebx + 0x10]
test eax, eax
je 0x4aa330
inc eax
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x270], 1
call fcn.004ac230
push 1
push 0x71a47c
lea ecx, [ebp - 0x28]
call fcn.0049f250
cmp dword [ebx + 0x14], 0x10
jb 0x4aa2d6
mov ebx, dword [ebx]
push dword [esi]
lea ecx, [ebp - 0x28]
push ebx
call fcn.0049f250
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp + 8]
push eax
call fcn.0049f250
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp edx, 0x10
jb 0x4aa330
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4aa326
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa3de
push edx
push ecx
call fcn.0063bb18
add esp, 8
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.004aa3f0
mov esi, dword [ebp - 0x25c]
add esp, 8
mov bl, al
jmp 0x4aa35d
mov esi, ebx
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
test esi, esi
je 0x4aa390
mov ecx, dword [ebp - 0x264]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4aa386
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa3de
push ecx
push esi
call fcn.0063bb18
add esp, 8
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x4aa3c0
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4aa3b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa3de
push edx
push ecx
call fcn.0063bb18
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret
call fcn.0065a824
int3