Function at 0x4272d5
Capabilities:
Enumerate processes

Disassembly:
push 0x464
mov eax, 0x46c944
call fcn.0042dc0b
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
mov edi, ebx
mov dword [ebp - 4], ebx
mov esi, ebx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], edi
mov dword [ebp - 0x468], esi
push ebx
push 2
mov byte [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x45c], eax
cmp eax, 0xffffffff
jne 0x427374
mov ecx, dword [ebp - 0x460]
lea eax, [ebp - 0x458]
push eax
call fcn.0042560d
mov esi, dword [ebp - 0x458]
test esi, esi
je 0x4275c6
push 0x18
mov edi, esi
pop ebx
jmp 0x427367
mov ecx, edi
call fcn.00403f00
add edi, ebx
cmp edi, dword [ebp - 0x454]
jne 0x42735e
jmp 0x42757b
push 0x228
lea eax, [ebp - 0x440]
push ebx
push eax
call fcn.0042f1f0
add esp, 0xc
mov dword [ebp - 0x444], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x44c], ebx
call fcn.0042f1f0
add esp, 0xc
jmp 0x427509
cmp dword [ebp - 0x43c], ebx
jne 0x42742f
push ebx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x448], eax
test eax, eax
je 0x4274cd
push 0x486d10
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00436682
add esp, 0xc
mov dword [ebp - 0x464], 0x104
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x42744e
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x45c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4273bc
jmp 0x4274d6
mov eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0x450]
je 0x427470
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x458]
call fcn.004252ac
jmp 0x427483
lea ecx, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x458]
call fcn.004253c6
cmp edi, esi
je 0x427494
mov dword [edi], ebx
add edi, 4
mov dword [ebp - 0x46c], edi
jmp 0x4274b3
lea eax, [ebp - 0x44c]
push eax
push edi
lea ecx, [ebp - 0x470]
call fcn.0040bc3b
mov esi, dword [ebp - 0x468]
mov edi, dword [ebp - 0x46c]
mov ebx, dword [ebp - 0x42c]
push dword [ebp - 0x448]
mov dword [ebp - 0x44c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4274d6
or ebx, 0xffffffff
mov dword [ebp - 0x44c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x427523
cmp ebx, 0xffffffff
je 0x427523
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
je 0x427523
mov eax, dword [ebp - 0x470]
cmp eax, edi
je 0x427509
cmp dword [eax], ebx
je 0x427505
add eax, 4
cmp eax, edi
jne 0x4274fa
cmp eax, edi
jne 0x427523
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x45c]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4273bc
push dword [ebp - 0x45c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x460]
lea eax, [ebp - 0x458]
push eax
call fcn.0042560d
mov eax, dword [ebp - 0x470]
test eax, eax
je 0x427559
sub esi, eax
and esi, 0xfffffffc
push esi
push eax
call fcn.00401d6d
pop ecx
pop ecx
mov esi, dword [ebp - 0x458]
test esi, esi
je 0x4275c6
push 0x18
mov edi, esi
pop ebx
jmp 0x427573
mov ecx, edi
call fcn.00403f00
add edi, ebx
cmp edi, dword [ebp - 0x454]
jne 0x42756a
mov eax, dword [ebp - 0x450]
sub eax, esi
mov dword [ebp - 0x448], esi
cdq
idiv ebx
imul eax, eax, 0x18
mov dword [ebp - 0x44c], eax
cmp eax, 0x1000
jb 0x4275bd
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x448]
push eax
call fcn.00401311
mov esi, dword [ebp - 0x448]
mov eax, dword [ebp - 0x44c]
pop ecx
pop ecx
push eax
push esi
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x460]
call fcn.0042dbb5
ret