Function at 0x414ef0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x48e8dd
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x4b82d8]
xor eax, esp
mov dword [esp + 0x2b4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b82d8]
xor eax, esp
push eax
lea eax, [esp + 0x2cc]
mov dword fs:[0], eax
lea eax, [esp + 0x17]
push eax
lea ecx, [esp + 0x1b]
push ecx
xor ebx, ebx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1f], bl
call fcn.00416890
push 0xc
xor edx, edx
mov ebp, 7
push str.uTorrent.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x2dc], ebx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], dx
call fcn.00405210
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2dc], 1
call fcn.00417880
mov edi, 8
mov byte [esp + 0x2d4], bl
cmp dword [esp + 0x30], edi
jb 0x414fa9
mov edx, dword [esp + 0x1c]
push edx
call fcn.00419bc5
add esp, 4
push 0xb
xor eax, eax
push str.BitPump.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], ax
call fcn.00405210
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2dc], 2
call fcn.00417880
mov byte [esp + 0x2d4], bl
cmp dword [esp + 0x30], edi
jb 0x414ffd
mov eax, dword [esp + 0x1c]
push eax
call fcn.00419bc5
add esp, 4
xor ecx, ecx
push 0xc
mov word [esp + 0x20], cx
push str.Shareaza.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
call fcn.00405210
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2dc], 3
call fcn.00417880
mov byte [esp + 0x2d4], bl
cmp dword [esp + 0x30], edi
jb 0x415051
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00419bc5
add esp, 4
push ebp
xor edx, edx
push str.ABC.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], dx
call fcn.00405210
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2dc], 4
call fcn.00417880
mov byte [esp + 0x2d4], bl
cmp dword [esp + 0x30], edi
jb 0x4150a4
mov edx, dword [esp + 0x1c]
push edx
call fcn.00419bc5
add esp, 4
push 0xe
xor eax, eax
push str.BitTorrent.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], ax
call fcn.00405210
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2dc], 5
call fcn.00417880
mov byte [esp + 0x2d4], bl
cmp dword [esp + 0x30], edi
jb 0x4150f8
mov eax, dword [esp + 0x1c]
push eax
call fcn.00419bc5
add esp, 4
xor ecx, ecx
push 0xc
mov word [esp + 0x20], cx
push str.BitComet.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
call fcn.00405210
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2dc], 6
call fcn.00417880
mov byte [esp + 0x2d4], bl
cmp dword [esp + 0x30], edi
jb 0x41514c
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00419bc5
add esp, 4
push 0xe
xor edx, edx
push str.BitTornado.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], dx
call fcn.00405210
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2dc], 7
call fcn.00417880
mov byte [esp + 0x2d4], bl
cmp dword [esp + 0x30], edi
jb 0x4151a0
mov edx, dword [esp + 0x1c]
push edx
call fcn.00419bc5
add esp, 4
push 0xe
xor eax, eax
push str.XBT_Client.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], ax
call fcn.00405210
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2dc], 8
call fcn.00417880
mov byte [esp + 0x2d4], bl
cmp dword [esp + 0x30], edi
jb 0x4151f4
mov eax, dword [esp + 0x1c]
push eax
call fcn.00419bc5
add esp, 4
xor ecx, ecx
push 0xd
mov word [esp + 0x20], cx
push str.G3Torrent.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
call fcn.00405210
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2dc], 9
call fcn.00417880
mov byte [esp + 0x2d4], bl
cmp dword [esp + 0x30], edi
jb 0x415248
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00419bc5
add esp, 4
push 9
xor edx, edx
push str.Burst.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], dx
call fcn.00405210
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2dc], 0xa
call fcn.00417880
cmp dword [esp + 0x30], edi
jb 0x415295
mov edx, dword [esp + 0x1c]
push edx
call fcn.00419bc5
add esp, 4
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
push 0x228
lea eax, [esp + 0xa4]
push ebx
push eax
mov dword [esp + 0x4c], esi
call fcn.0045cf50
add esp, 0xc
lea ecx, [esp + 0x9c]
push ecx
push esi
mov dword [esp + 0xa4], 0x22c
call sub.KERNEL32.dll_Process32FirstW
xor edx, edx
mov dword [esp + 0x98], ebp
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], dx
xor ecx, ecx
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x78], ebx
mov word [esp + 0x68], cx
mov byte [esp + 0x2d4], 0xc
cmp eax, ebx
je 0x415442
lea esp, [esp]
lea eax, [esp + 0xc0]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x415320
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0xc4]
push edx
lea ecx, [esp + 0x88]
call fcn.00411f20
push 1
push 0x4964c0
lea ecx, [esp + 0x88]
call fcn.00411f20
xor eax, eax
mov word [esp + 0x1c], ax
lea eax, [esp + 0xc0]
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x415370
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0xc4]
push ecx
lea ecx, [esp + 0x20]
call fcn.00405210
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x4c]
call fcn.00416560
cmp dword [esp + 0x30], 8
mov esi, dword [eax]
mov edi, dword [eax + 4]
jb 0x4153bd
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00419bc5
add esp, 4
xor edx, edx
mov dword [esp + 0x30], ebp
mov ebp, dword [esp + 0x5c]
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
cmp esi, ebx
je 0x4153da
cmp esi, dword [esp + 0x44]
je 0x4153df
call fcn.0045d981
cmp edi, ebp
je 0x41541c
cmp esi, ebx
jne 0x415528
call fcn.0045d981
xor esi, esi
cmp edi, dword [esi + 0x18]
jne 0x4153fc
call fcn.0045d981
push 0xffffffffffffffff
lea eax, [edi + 0xc]
push ebx
push eax
lea ecx, [esp + 0x70]
call fcn.00409920
push 1
push 0x4964c4
lea ecx, [esp + 0x6c]
call fcn.00411f20
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x9c]
push eax
push ecx
call sub.KERNEL32.dll_Process32NextW
mov ebp, 7
cmp eax, ebx
jne 0x415310
mov esi, dword [esp + 0x40]
lea edi, [ebp + 1]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x78], ebx
je 0x415499
push 0x87
push 0x4964c8
lea ecx, [esp + 0x6c]
call fcn.00405210
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x414e00
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4b9850], eax
mov eax, dword [esp + 0x68]
cmp dword [esp + 0x7c], edi
jae 0x41548a
lea eax, [esp + 0x68]
push 0x30
push 0x4965d8
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [esp + 0x7c], edi
jb 0x4154ac
mov edx, dword [esp + 0x68]
push edx
call fcn.00419bc5
add esp, 4
xor eax, eax
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x78], ebx
mov word [esp + 0x68], ax
cmp dword [esp + 0x98], edi
jb 0x4154d4
mov ecx, dword [esp + 0x84]
push ecx
call fcn.00419bc5
add esp, 4
xor edx, edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x98], ebp
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], dx
mov dword [esp + 0x2d4], 0xffffffff
call fcn.00417e60
mov ecx, dword [esp + 0x2cc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.0045cd9b
add esp, 0x2c4
ret
mov esi, dword [esi]
jmp 0x4153f2