Function at 0x48fefa
Capabilities:
Enumerate processes

Disassembly:
push 0x59c
mov eax, 0x510b26
call fcn.004f41e2
mov esi, ecx
mov dword [ebp - 0x588], esi
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x5a4]
call fcn.004404f9
and dword [ebp - 4], 0
lea eax, [esi + 0x42b8]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x5a4]
call fcn.004e6dba
xor edi, edi
mov dword [ebp - 0x598], edi
call fcn.004e3cd3
xor ecx, ecx
mov byte [ebp - 0x57e], al
xor eax, eax
inc ecx
cmp dword [esi + 0x4aac], eax
je 0x48ff68
cmp dword [esi + 0x4370], eax
cmove edi, ecx
mov dword [ebp - 0x598], edi
push 0xa0
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.004f5a90
add esp, 0xc
push 0x28
pop edi
cmp dword [ebp + 0xc], edi
cmovbe edi, dword [ebp + 0xc]
xor eax, eax
cmp dword [esi + 0x5fc], eax
je 0x48ffaa
cmp dword [esi + 0x5f4], eax
jne 0x48ffaa
inc eax
mov ecx, esi
cmp edi, eax
seta al
movzx eax, al
push eax
call fcn.00484069
mov edx, dword [esi + 0x5f4]
test edx, edx
je 0x490000
mov eax, dword [ebx]
mov dword [ebp - 0xb0], eax
xor eax, eax
push 2
inc eax
mov dword [ebp - 0xac], edx
pop ecx
mov dword [ebp - 0x57c], ecx
cmp edi, eax
jbe 0x49001e
mov esi, ecx
mov ecx, dword [ebx + eax*4]
test ecx, ecx
je 0x48ffe7
cmp ecx, edx
je 0x48ffe7
mov dword [ebp + esi*4 - 0xb0], ecx
inc esi
inc eax
cmp eax, edi
jb 0x48ffd4
mov dword [ebp - 0x57c], esi
mov esi, dword [ebp - 0x588]
mov ecx, dword [ebp - 0x57c]
jmp 0x49001e
mov eax, edi
shl eax, 2
push eax
lea eax, [ebp - 0xb0]
push ebx
push eax
call fcn.004f5d30
mov ecx, edi
add esp, 0xc
mov dword [ebp - 0x57c], ecx
xor ebx, ebx
mov byte [ebp - 0x582], bl
mov eax, ebx
mov byte [ebp - 0x575], bl
mov byte [ebp - 0x57d], bl
mov dword [ebp - 0x58c], eax
mov dword [ebp - 0x594], eax
test ecx, ecx
je 0x490082
lea ebx, [esi + 0x4580]
mov esi, dword [ebp - 0x57c]
mov edi, dword [ebp + eax*4 - 0xb0]
xor edx, edx
mov ecx, ebx
cmp dword [ecx], edi
je 0x49006d
inc edx
add ecx, 4
cmp edx, 0x80
jb 0x49005b
jmp 0x490075
and dword [ebp + eax*4 - 0xb0], 0
inc eax
cmp eax, esi
jb 0x490050
mov esi, dword [ebp - 0x588]
xor ebx, ebx
mov edx, ebx
cmp dword [esi + 0x4578], ebx
jbe 0x4900ce
lea ebx, [esi + 0x4378]
xor eax, eax
mov ecx, ebx
cmp dword [ecx], eax
je 0x4900c0
cmp dword [ebp - 0x57c], 0
jbe 0x4900b8
mov edi, dword [ebx + edx*4]
cmp dword [ebp + eax*4 - 0xb0], edi
je 0x4900be
inc eax
cmp eax, dword [ebp - 0x57c]
jb 0x4900a6
xor eax, eax
mov dword [ecx], eax
jmp 0x4900c0
xor eax, eax
inc edx
add ecx, 4
cmp edx, dword [esi + 0x4578]
jb 0x490096
xor ebx, ebx
mov eax, dword [esi + 0x4360]
mov edx, ebx
mov edi, 0x98
test eax, eax
jle 0x490159
mov ecx, ebx
mov eax, dword [esi + 0x436c]
inc edx
mov byte [eax + ecx + 0x13], bl
add ecx, edi
mov eax, dword [esi + 0x4360]
cmp edx, eax
jl 0x4900e1
test eax, eax
jle 0x490159
mov edx, dword [ebp - 0x57c]
xor eax, eax
mov edi, eax
mov ecx, dword [esi + 0x436c]
test edx, edx
je 0x490142
mov edx, dword [ebp + eax*4 - 0xb0]
test edx, edx
je 0x490120
cmp edx, dword [ecx + edi]
je 0x49012d
mov edx, dword [ebp - 0x57c]
inc eax
cmp eax, edx
jb 0x490110
jmp 0x490142
xor edx, edx
inc edx
and dword [ebp + eax*4 - 0xb0], 0
mov byte [ecx + edi + 0x13], dl
mov edx, dword [ebp - 0x57c]
inc ebx
add edi, 0x98
push 0
pop eax
cmp ebx, dword [esi + 0x4360]
jl 0x490106
mov edi, 0x98
mov ecx, dword [ebp - 0x57c]
xor edx, edx
mov eax, edx
test ecx, ecx
je 0x490186
cmp dword [ebp + eax*4 - 0xb0], edx
jne 0x490179
inc eax
cmp eax, ecx
jb 0x490167
mov bl, dl
jmp 0x490188
xor eax, eax
inc eax
mov bl, al
mov byte [ebp - 0x575], bl
jmp 0x490188
mov bl, al
mov ecx, edx
mov edx, dword [esi + 0x4360]
test edx, edx
jle 0x4901b6
mov eax, dword [esi + 0x436c]
add eax, 0x13
cmp byte [eax], 0
je 0x4901b1
inc ecx
add eax, edi
cmp ecx, edx
jl 0x49019d
mov al, byte [ebp - 0x57d]
jmp 0x4901b8
xor eax, eax
inc eax
jmp 0x4901b8
mov al, cl
test bl, bl
jne 0x4901c4
test al, al
je 0x4904e5
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x588], ebx
cmp ebx, 0xffffffff
jne 0x49020b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2b0]
push str.Cant_create_process_snapshot__ErrCode0x_08X
push eax
call fcn.00409bde
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x2b0]
add esp, 0xc
push 0
push eax
call fcn.0040e34d
jmp 0x4904e5
xor eax, eax
mov edx, eax
cmp dword [esi + 0x4360], eax
jle 0x490231
mov ecx, eax
mov eax, dword [esi + 0x436c]
inc edx
mov byte [eax + ecx + 0x12], 0
add ecx, edi
cmp edx, dword [esi + 0x4360]
jl 0x490219
xor eax, eax
mov edi, 0x22c
push edi
push eax
lea eax, [ebp - 0x574]
push eax
call fcn.004f5a90
push 0x200
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x574], edi
push 0
push eax
call fcn.004f5a90
add esp, 0x18
lea eax, [ebp - 0x574]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4904da
lea ecx, [esi + 0x4580]
mov edx, dword [ebp - 0x56c]
xor eax, eax
mov edi, edx
cmp dword [ecx], edx
je 0x490298
inc eax
add ecx, 4
cmp eax, 0x80
jb 0x490285
xor ecx, ecx
jmp 0x4902a7
xor ecx, ecx
mov dword [ebp + eax*4 - 0x2b0], 1
mov edi, ecx
test edi, edi
je 0x49049b
cmp byte [ebp - 0x575], 0
je 0x49041e
mov eax, dword [ebp - 0x57c]
mov ebx, ecx
test eax, eax
je 0x490418
mov edi, dword [ebp + ebx*4 - 0xb0]
test edi, edi
je 0x49040d
cmp edi, edx
jne 0x49040d
mov cl, byte [ebp - 0x582]
push 1
movzx eax, cl
test cl, cl
pop ecx
cmove eax, ecx
push 0x98
mov byte [ebp - 0x582], al
lea eax, [ebp - 0x348]
push 0
push eax
call fcn.004f5a90
mov eax, dword [ebp - 0x55c]
add esp, 0xc
mov dword [ebp - 0x344], eax
mov ecx, esi
lea eax, [ebp - 0x550]
mov dword [ebp - 0x348], edi
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.0048fb7d
xor eax, eax
inc eax
cmp dword [ebp - 0x334], 0
mov byte [ebp - 0x336], al
mov byte [ebp - 0x335], al
jne 0x4903df
cmp byte [ebp - 0x57e], 0
je 0x4903d5
push 0
push dword [ebp - 0x348]
call fcn.004e64d5
mov dword [ebp - 0x334], eax
pop ecx
pop ecx
test eax, eax
jne 0x4903df
mov eax, dword [ebp - 0x58c]
test eax, eax
jne 0x4903b9
push 0x81c
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x5a8], eax
xor ecx, ecx
inc ecx
mov byte [ebp - 4], cl
test eax, eax
je 0x4903a3
mov ecx, eax
call fcn.00403c60
jmp 0x4903a5
xor eax, eax
mov dword [ebp - 0x58c], eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x594], eax
test eax, eax
je 0x4903df
lea ecx, [ebp - 0x334]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp - 0x348]
mov ecx, eax
call fcn.00405498
jmp 0x4903df
mov dword [ebp - 0x334], 0x20
push 0x12c
lea ecx, [ebp - 0x5a4]
call fcn.004e6f5a
lea eax, [ebp - 0x348]
push eax
lea ecx, [esi + 0x435c]
call fcn.00497eca
mov edx, dword [ebp - 0x56c]
mov eax, dword [ebp - 0x57c]
inc ebx
cmp ebx, eax
jb 0x4902cc
xor ecx, ecx
mov ebx, dword [ebp - 0x588]
mov eax, ecx
mov dword [ebp - 0x590], eax
cmp dword [esi + 0x4360], ecx
jle 0x49049b
mov ebx, ecx
mov edi, dword [esi + 0x436c]
add edi, ebx
cmp dword [edi], edx
jne 0x490480
xor edx, edx
inc edx
cmp byte [edi + 0x10], 0
mov byte [edi + 0x12], dl
jne 0x49047a
mov cl, byte [ebp - 0x582]
test cl, cl
movzx eax, cl
mov ecx, esi
cmove eax, edx
mov byte [ebp - 0x582], al
lea eax, [ebp - 0x550]
push eax
push edi
call fcn.0048fb7d
mov eax, dword [ebp - 0x55c]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x590]
mov edx, dword [ebp - 0x56c]
inc eax
add ebx, 0x98
mov dword [ebp - 0x590], eax
cmp eax, dword [esi + 0x4360]
jl 0x490430
mov ebx, dword [ebp - 0x588]
lea eax, [ebp - 0x574]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
lea ecx, [esi + 0x4580]
test eax, eax
jne 0x49027b
xor edx, edx
lea ecx, [esi + 0x4580]
mov eax, edx
cmp dword [ecx], edx
je 0x4904cf
cmp dword [ebp + eax*4 - 0x2b0], edx
jne 0x4904cf
mov dword [ecx], edx
inc eax
add ecx, 4
cmp eax, 0x80
jb 0x4904c0
test ebx, ebx
je 0x4904e5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, eax
cmp dword [esi + 0x4360], eax
jle 0x49054b
mov ebx, eax
mov eax, dword [esi + 0x436c]
cmp byte [eax + ebx + 0x12], 0
je 0x490510
cmp byte [eax + ebx + 0x13], 0
je 0x490510
inc edi
add ebx, 0x98
jmp 0x490543
mov cl, byte [ebp - 0x582]
movzx eax, cl
test cl, cl
push 1
pop ecx
cmove eax, ecx
lea ecx, [ebp - 0x5a4]
push 0x12c
mov byte [ebp - 0x582], al
call fcn.004e6f5a
push edi
lea ecx, [esi + 0x435c]
call fcn.00496dd7
cmp edi, dword [esi + 0x4360]
jl 0x4904f3
xor eax, eax
lea ecx, [ebp - 0x5a4]
inc eax
push eax
call fcn.004e7049
test eax, eax
je 0x49057f
lea ecx, [ebp - 0x5a4]
call fcn.004e6fd1
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x42b8]
push eax
lea ecx, [ebp - 0x5a4]
call fcn.004e6dba
lea eax, [ebp - 0x594]
push eax
call fcn.0048203b
pop ecx
push dword [ebp - 0x582]
mov ecx, esi
call fcn.004905c9
xor ecx, ecx
test al, al
push 1
movzx ebx, cl
pop eax
cmovne ebx, eax
cmp dword [ebp - 0x598], ecx
je 0x4905b4
mov dword [esi + 0x4aac], ecx
lea ecx, [ebp - 0x5a4]
call fcn.004e6c72
mov al, bl
call fcn.004f418c
ret 8