Function at 0x478043
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push 0x268
mov eax, 0x5ce472
call fcn.00506dfb
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00412393
add eax, 0x10
mov dword [ebp - 0x248], eax
xor ebx, ebx
lea eax, [ebp - 0x244]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0048ba90
mov esi, eax
push 0x605dfc
lea eax, [ebp - 0x24c]
mov byte [ebp - 4], 1
push edi
push eax
call fcn.0042dfbd
push esi
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 2
push eax
call fcn.0043910d
add esp, 0x24
mov ecx, dword [ebp - 0x24c]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x244]
mov byte [ebp - 4], 5
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov esi, 0x22c
lea eax, [ebp - 0x23c]
push esi
push ebx
push eax
call fcn.0056b050
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x23c], esi
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x478511
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.00413f09
push 0x605e94
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 6
call fcn.0042e69b
test eax, eax
je 0x4784e5
push 0x605eb4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784e5
push 0x605f9c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784e0
push 0x605fc4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784e0
push 0x6060d8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784db
push 0x6060f8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784db
push 0x606144
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784d6
push 0x60618c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784d6
push 0x606268
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784d1
push 0x606288
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784d1
push 0x6062c0
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784d1
push 0x606320
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784cc
push 0x606348
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784cc
push 0x6063b8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784c7
push 0x6063dc
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784c7
push 0x6064a4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784bf
push 0x6064c0
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784bf
push 0x606534
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x4782dc
or ebx, 0x100
jmp 0x4784e8
push 0x6065a4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x4782fb
or ebx, 0x200
jmp 0x4784e8
push 0x606660
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x47831a
or ebx, 0x400
jmp 0x4784e8
push 0x60672c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x478339
or ebx, 0x800
jmp 0x4784e8
push 0x6067c4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784b7
push 0x6067e0
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784b7
push 0x606838
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784af
push 0x60686c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784af
push 0x60689c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784af
push 0x6068d4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784af
push 0x606980
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x4783e8
or ebx, 0x4000
jmp 0x4784e8
push 0x606a0c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x478407
or ebx, 0x8000
jmp 0x4784e8
push 0x606b50
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784a7
push 0x606bbc
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784a7
push 0x606c18
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4784a7
push 0x606d44
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47849f
push 0x606de8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47849f
push 0x606e60
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47849f
push 0x606ea8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x4784e8
or ebx, 0x40000
jmp 0x4784e8
or ebx, 0x20000
jmp 0x4784e8
or ebx, 0x10000
jmp 0x4784e8
or ebx, 0x2000
jmp 0x4784e8
or ebx, 0x1000
jmp 0x4784e8
or ebx, 0x80
jmp 0x4784e8
or ebx, 0x40
jmp 0x4784e8
or ebx, 0x20
jmp 0x4784e8
or ebx, 0x10
jmp 0x4784e8
or ebx, 8
jmp 0x4784e8
or ebx, 4
jmp 0x4784e8
or ebx, 2
jmp 0x4784e8
or ebx, 1
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
mov ecx, dword [ebp - 0x240]
mov esi, eax
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.00412ac4
test esi, esi
jne 0x47810f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0041279d
push eax
lea ecx, [ebp - 0x254]
call fcn.00411d94
push ebx
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 7
push 0x606ec4
push eax
call fcn.00412690
add esp, 0xc
lea ecx, [ebp - 0x274]
call fcn.0042ca82
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push 0x606ef4
mov byte [ebp - 4], 8
call fcn.00413f09
push ecx
push esp
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 9
call fcn.0043944c
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x274]
call fcn.00434114
push dword [ebp - 0x250]
mov byte [ebp - 4], 0xa
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4785ff
push dword [ebp - 0x250]
lea eax, [ebp - 0x24c]
push eax
call fcn.0048ba90
push eax
lea eax, [ebp - 0x244]
mov byte [ebp - 4], 0xb
push 0x606f54
push eax
call fcn.0042e01c
add esp, 0x14
mov eax, dword [eax]
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xc
push dword [eax - 0xc]
push eax
call fcn.00412114
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x24c]
mov byte [ebp - 4], 0xa
lea ecx, [ecx - 0x10]
call fcn.00412ac4
call fcn.0041279d
push eax
lea ecx, [ebp - 0x240]
call fcn.00411d94
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 0xd
push eax
call fcn.0048a07f
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x244]
push 0x606fcc
push eax
call fcn.0042e01c
add esp, 0x10
mov eax, dword [eax]
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xe
push dword [eax - 0xc]
push eax
call fcn.00412114
mov ecx, dword [ebp - 0x244]
mov byte [ebp - 4], 0xd
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x244]
push 0x607034
push eax
call fcn.0042e01c
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xf
push dword [eax - 0xc]
push eax
call fcn.00412114
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push dword [ebp + 0x14]
mov esi, dword [ebp - 0x248]
push dword [ebp - 0x258]
push esi
push dword [ebp - 0x25c]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x240]
mov edi, eax
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
call fcn.00412ac4
lea ecx, [ebp - 0x274]
call fcn.0042e60b
mov ecx, dword [ebp - 0x264]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x254]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x258]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [esi - 0x10]
call fcn.00412ac4
mov eax, edi
call fcn.00506da5
ret