Function at 0x41d920
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x29c
mov dword [ebp - 0x244], 0x22c
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
cmp eax, 0xffffffff
mov dword [ebp - 0x280], eax
je 0x41dd60
lea eax, [ebp - 0x244]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x280]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32FirstW
sub esp, 8
test eax, eax
je 0x41dbee
nop
lea eax, [ebp - 0x220]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], eax
lea eax, [ebp - 0x258]
mov dword [esp], eax
call dword [method.QString.fromUtf16_unsigned_short_const__int_]
mov eax, dword [ebp - 0x23c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0041d190
mov dword [esp + 4], 1
mov dword [esp], 0x46aabd
call dword [method.QString.fromAscii_helper_char_const__int_]
mov dword [ebp - 0x248], eax
mov dword [esp + 4], 1
mov dword [esp], 0x46ab14
call dword [method.QString.fromAscii_helper_char_const__int_]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x248]
mov dword [esp + 8], 1
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x27c], eax
mov dword [esp + 4], eax
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x278], eax
mov dword [esp], eax
call dword [method.QString.replace_QString_const__QString_const__Qt::CaseSensitivity_]
mov dword [ebp - 0x274], eax
lea ecx, [ebp - 0x258]
lea eax, [ebp - 0x250]
sub esp, 0xc
mov dword [ebp - 0x26c], eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [method.QString.toLower_helper_QString_const_]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx], 1
jbe 0x41da60
mov ecx, eax
call fcn.0045a480
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov ebx, dword [ecx + 0xc]
test ebx, ebx
je 0x41dd53
mov dword [ebp - 0x270], 0
mov edi, dword [sym.imp.Qt5Core.dll_operator__QString_const__QString_const_]
jmp 0x41da94
mov eax, dword [ebx + 4]
mov dword [ebp - 0x270], ebx
mov esi, 1
test eax, eax
je 0x41dab3
mov ebx, eax
mov eax, dword [ebp - 0x26c]
mov dword [esp + 4], eax
lea eax, [ebx + 0xc]
mov dword [esp], eax
call edi
test al, al
je 0x41da80
mov eax, dword [ebx + 8]
xor esi, esi
test eax, eax
jne 0x41da92
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x41dc10
mov eax, dword [ebp - 0x270]
add eax, 0xc
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x26c]
mov dword [esp], eax
call edi
test al, al
jne 0x41dc10
mov ecx, dword [ebp - 0x270]
mov eax, dword [ebp - 0x274]
add ecx, 0x10
mov dword [esp], eax
call dword [method.QString.operator_QString_const_]
sub esp, 4
mov eax, dword [ebp - 0x250]
mov edx, dword [eax]
test edx, edx
jne 0x41dc92
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x24c]
mov edx, dword [eax]
test edx, edx
jne 0x41dd30
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x248]
mov edx, dword [eax]
test edx, edx
jne 0x41dce0
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
lea eax, [ebp - 0x244]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x280]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32NextW
mov edx, dword [ebp - 0x254]
mov ebx, eax
sub esp, 8
mov eax, dword [edx]
test eax, eax
jne 0x41dcb5
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], edx
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov edx, dword [ebp - 0x258]
mov eax, dword [edx]
test eax, eax
jne 0x41dd03
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], edx
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
test ebx, ebx
jne 0x41d980
mov eax, dword [ebp - 0x280]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, esi
movzx esi, al
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 4
mov dword [esp], 0x14
call dword [method.QMapDataBase.createNode_int__int__QMapNodeBase__bool_]
sub esp, 0x10
cmp eax, 0xfffffff4
je 0x41dc59
mov edx, dword [ebp - 0x250]
mov esi, dword [edx]
mov dword [eax + 0xc], edx
lea ecx, [esi + 1]
cmp ecx, 1
jbe 0x41dc59
lock add dword [edx], 1
setne cl
cmp eax, 0xfffffff0
je 0x41dafc
mov edi, dword [ebp - 0x274]
mov edx, dword [edi]
mov dword [eax + 0x10], edx
mov eax, dword [edx]
add eax, 1
cmp eax, 1
jbe 0x41dafc
lock add dword [edx], 1
setne al
mov eax, dword [ebp - 0x250]
mov edx, dword [eax]
test edx, edx
je 0x41db0c
cmp edx, 0xffffffff
je 0x41db25
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41db25
mov eax, dword [ebp - 0x250]
jmp 0x41db0c
cmp eax, 0xffffffff
je 0x41dbbd
lock sub dword [edx], 1
setne al
test al, al
jne 0x41dbbd
mov edx, dword [ebp - 0x254]
jmp 0x41dba4
cmp edx, 0xffffffff
je 0x41db77
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41db77
mov eax, dword [ebp - 0x248]
jmp 0x41db5e
cmp eax, 0xffffffff
je 0x41dbe6
lock sub dword [edx], 1
setne al
test al, al
jne 0x41dbe6
mov edx, dword [ebp - 0x258]
jmp 0x41dbcd
cmp edx, 0xffffffff
je 0x41db4e
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41db4e
mov eax, dword [ebp - 0x24c]
jmp 0x41db35
lea ebx, [ecx + 8]
mov esi, 1
jmp 0x41dc1a
lea edi, [ebp - 0x260]
mov dword [esp + 4], 0xc
mov dword [esp], 0x46aad7
mov esi, dword [method.QString.fromAscii_helper_char_const__int_]
call esi
mov dword [esp], edi
mov dword [ebp - 0x24c], eax
call dword [method.QDir.currentPath__]
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax]
mov dword [ebp - 0x25c], eax
lea edx, [ecx + 1]
cmp edx, 1
jbe 0x41dda9
lock add dword [eax], 1
setne dl
lea eax, [ebp - 0x248]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 0x46aae4
mov dword [ebp - 0x27c], eax
mov dword [esp], eax
call dword [method.QString.fromUtf8_helper_char_const__int_]
mov eax, dword [ebp - 0x27c]
lea ebx, [ebp - 0x25c]
mov ecx, ebx
mov dword [esp], eax
call dword [method.QString.append_QString_const_]
mov eax, dword [ebp - 0x248]
sub esp, 4
mov edx, dword [eax]
test edx, edx
jne 0x41dfda
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
lea eax, [ebp - 0x24c]
mov dword [esp + 0x1c], 0x48d07c
mov dword [esp + 0x18], 0x48d080
mov dword [esp + 0x10], ebx
mov dword [ebp - 0x248], 4
mov dword [ebp - 0x278], eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x250], 0x5a
mov dword [ebp - 0x254], 0x300000
mov dword [ebp - 0x258], 2
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x250]
mov dword [ebp - 0x26c], eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x254]
mov dword [esp + 4], eax
lea eax, [ebp - 0x258]
mov dword [esp], eax
call fcn.00452320
mov eax, dword [ebp - 0x25c]
mov edx, dword [eax]
test edx, edx
jne 0x41e07e
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x260]
mov edx, dword [eax]
test edx, edx
jne 0x41e05b
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x24c]
mov edx, dword [eax]
test edx, edx
jne 0x41e038
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov dword [ebp - 0x248], 2
movzx ebx, byte [0x469004]
mov dword [esp + 4], 0x24
mov dword [esp], str.CreateToolhelp32Snapshot
call esi
mov dword [esp + 4], 0
mov dword [ebp - 0x24c], eax
mov dword [esp], 0x46aa62
call esi
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x27c]
mov dword [esp + 0x18], 0x215
mov dword [esp + 0x14], str.PackagingZC_Common.cpp
mov dword [esp + 0xc], 4
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x278]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x26c]
mov dword [esp], eax
call fcn.004550b0
mov eax, dword [ebp - 0x250]
mov edx, dword [eax]
test edx, edx
jne 0x41e01d
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x24c]
mov edx, dword [eax]
test edx, edx
jne 0x41dffd
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x41dc00
cmp edx, 0xffffffff
je 0x41de11
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41de11
mov eax, dword [ebp - 0x248]
jmp 0x41ddf8
cmp edx, 0xffffffff
je 0x41dc00
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41dc00
mov eax, dword [ebp - 0x24c]
jmp 0x41dfbc
cmp edx, 0xffffffff
je 0x41dfb0
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41dfb0
mov eax, dword [ebp - 0x250]
jmp 0x41df97
cmp edx, 0xffffffff
je 0x41df0a
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41df0a
mov eax, dword [ebp - 0x24c]
jmp 0x41def1
cmp edx, 0xffffffff
je 0x41dee1
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41dee1
mov eax, dword [ebp - 0x260]
jmp 0x41dec8
cmp edx, 0xffffffff
je 0x41deb8
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41deb8
mov eax, dword [ebp - 0x25c]
jmp 0x41de9f