Function at 0x40fe8c
Capabilities:
Enumerate processes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5cc
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
push edx
push edx
je 0x40fee0
mov ebx, eax
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0x128
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
push ebp
push ebp
jne 0x40ff0c
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
push edi
mov eax, dword [esp + 0x5e0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xbf
mov dword [esp], eax
call fcn.00405d7d
jmp 0x410188
lea eax, [esp + 0x54]
mov dword [esp + 4], 0x8000
mov dword [esp], eax
call fcn.0041236c
mov dword [esp], str.Ed5FWSQid_4idLCldjfD
call fcn.004081aa
mov dword [esp], str.psapi.dll
mov esi, eax
call fcn.00407f7a
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov edi, eax
jne 0x40ff74
mov dword [esp], str.Ed5FWSQid_4idLCldjfD
call fcn.004081aa
mov dword [esp], 0x424367
mov esi, eax
call fcn.00407f7a
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00407f8e
mov edi, eax
lea ebp, [esp + 0x3bc]
mov eax, dword [esp + 0x98]
mov dword [esp + 4], 0
mov dword [esp], 0x410
mov dword [esp + 8], eax
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x40ffc7
test edi, edi
je 0x40ffc7
mov dword [esp + 0xc], 0x204
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
sub esp, 0x10
test eax, eax
jne 0x40ffdf
mov dword [esp + 8], 0x204
mov dword [esp + 4], 0x424374
mov dword [esp], ebp
call fcn.00412548
lea eax, [esp + 0x4c]
lea edx, [esp + 0x44]
mov dword [esp], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x3c], edx
call sub.KERNEL32.dll_GetProcessTimes
sub esp, 0x14
test eax, eax
je 0x410167
cmp dword [esp + 0x44], 0
mov edx, dword [esp + 0x3c]
je 0x410167
lea eax, [esp + 0x60]
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FileTimeToSystemTime
push eax
push eax
movzx eax, word [esp + 0x6c]
mov dword [esp + 8], str._.2d__.2d__d__.2d:_.2d:_.2d
mov dword [esp + 4], 0x20
mov dword [esp + 0x20], eax
movzx eax, word [esp + 0x6a]
mov dword [esp + 0x1c], eax
movzx eax, word [esp + 0x68]
mov dword [esp + 0x18], eax
movzx eax, word [esp + 0x60]
mov dword [esp + 0x14], eax
movzx eax, word [esp + 0x62]
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0x66]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.004127a8
test esi, esi
je 0x41008e
mov dword [esp], esi
call sub.KERNEL32.dll_CloseHandle
push esi
lea eax, [esp + 0x70]
lea esi, [esp + 0x1b8]
mov dword [esp + 0x14], ebp
mov dword [esp + 8], str._s_a_d_a_s_a_s_a
mov dword [esp + 4], 0x204
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x98]
mov dword [esp], esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0xb4]
mov dword [esp + 0xc], eax
call fcn.004127a8
test eax, eax
jle 0x4100e7
mov dword [esp + 8], eax
lea eax, [esp + 0x54]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00412458
lea eax, [esp + 0x90]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
push ecx
push ecx
jne 0x40ff7b
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
push edx
cmp dword [esp + 0x5c], 0
lea ebx, [esp + 0x54]
je 0x410136
mov dword [esp], ebx
call fcn.00412540
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], 0xbe
mov dword [esp + 8], eax
jmp 0x41014e
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xbf
mov eax, dword [esp + 0x5e0]
mov dword [esp], eax
call fcn.00405d7d
mov dword [esp], ebx
call fcn.004123b1
jmp 0x410188
lea eax, [esp + 0x70]
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x424374
mov dword [esp], eax
call fcn.00412548
jmp 0x410081
add esp, 0x5cc
pop ebx
pop esi
pop edi
pop ebp
ret