Function at 0x42bef0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a115d
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x39c
mov eax, dword [0x4c506c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [ebp + 8]
call fcn.004056c0
movzx eax, al
test eax, eax
jne 0x42bf40
mov ecx, dword [ebp + 0xc]
call fcn.004056c0
movzx ecx, al
test ecx, ecx
je 0x42bf47
xor eax, eax
jmp 0x42c2f7
mov dword [ebp - 0x384], 0
mov byte [ebp - 0x379], 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00425640
add esp, 0xc
mov dword [ebp - 4], 0
call fcn.00421970
cmp eax, 1
jg 0x42bfa4
lea ecx, [ebp - 0x2c]
call fcn.00404610
push eax
push str.begin_to_find_exist_updater_process_window__find_path_is__s
push 1
push 0x4bd6f4
push 0xba
push 0x4bd704
call fcn.00421d50
add esp, 0x18
mov byte [ebp - 4], 1
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
jne 0x42c017
call fcn.00421970
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 1
jg 0x42bff3
push str.CreateToolhelp32Snapshot_failed
push 1
push 0x4bd74c
push 0xc0
push 0x4bd75c
call fcn.00421d50
add esp, 0x14
mov dword [ebp - 0x390], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404630
mov eax, dword [ebp - 0x390]
jmp 0x42c2f7
push 0x128
push 0
lea edx, [ebp - 0x378]
push edx
call fcn.00477ee0
add esp, 0xc
mov dword [ebp - 0x378], 0x128
lea eax, [ebp - 0x378]
push eax
mov ecx, dword [ebp - 0x380]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x42c1f9
lea edx, [ebp - 0x354]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00404610
push eax
call fcn.004867b1
add esp, 8
test eax, eax
jne 0x42c1dd
call fcn.00421970
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 1
jg 0x42c0a5
push str.find_exist_updater_process__check_work_dir
push 1
push 0x4bd7b0
push 0xcb
push 0x4bd7c0
call fcn.00421d50
add esp, 0x14
mov eax, dword [ebp - 0x370]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0xffffffff
jne 0x42c101
call fcn.00421970
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 1
jg 0x42c0fc
mov ecx, dword [ebp - 0x370]
push ecx
push str.CreateToolhelp32Snapshot_failed__process_id_is__ld
push 1
push 0x4bd81c
push 0xcf
push 0x4bd82c
call fcn.00421d50
add esp, 0x18
jmp 0x42c1dd
mov dword [ebp - 0x250], 0x224
lea edx, [ebp - 0x250]
push edx
mov eax, dword [ebp - 0x388]
push eax
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x42c1c3
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00404610
push eax
call fcn.004867b1
add esp, 8
test eax, eax
jne 0x42c18a
mov edx, dword [ebp - 0x248]
mov dword [ebp - 0x384], edx
mov byte [ebp - 0x379], 1
call fcn.00421970
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 1
jg 0x42c188
push str.find_exist_updater_process__check_work_dir_success
push 1
push 0x4bd888
push 0xdb
push 0x4bd898
call fcn.00421d50
add esp, 0x14
jmp 0x42c1c3
call fcn.00421970
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 1
jg 0x42c1c3
lea eax, [ebp - 0x130]
push eax
push str.find_exist_updater_process__but_check_work_dir_failed__exist_updater_process_work_dir_is__s
push 1
push 0x4bd91c
push 0xdf
push 0x4bd92c
call fcn.00421d50
add esp, 0x18
mov ecx, dword [ebp - 0x388]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [ebp - 0x379]
test edx, edx
je 0x42c1dd
jmp 0x42c1f9
lea eax, [ebp - 0x378]
push eax
mov ecx, dword [ebp - 0x380]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x42c053
mov edx, dword [ebp - 0x380]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42c21e
mov dword [ebp - 4], 0
jmp 0x42c241
movzx eax, byte [ebp - 0x379]
test eax, eax
je 0x42c2b0
cmp dword [ebp - 0x384], 0
jbe 0x42c2b0
call fcn.00421970
cmp eax, 1
jg 0x42c284
mov ecx, dword [ebp - 0x384]
push ecx
push str.finded_exist_updater_process__process_id_is__ld
push 1
push 0x4bd984
push 0xf4
push 0x4bd994
call fcn.00421d50
add esp, 0x18
mov edx, dword [ebp - 0x384]
push edx
call fcn.0042beb0
add esp, 4
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404630
mov eax, dword [ebp - 0x3a8]
jmp 0x42c2f7
call fcn.00421970
cmp eax, 1
jg 0x42c2d8
push str.finded_no_exist_updater_process
push 1
push str.FindUpdateWnd
push 0xf8
push 0x4bd9ec
call fcn.00421d50
add esp, 0x14
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404630
mov eax, dword [ebp - 0x3ac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00475c6f
mov esp, ebp
pop ebp
ret