Function at 0x402f10
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x234
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
push edi
xor ebx, ebx
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x120]
mov dword [esp + 0x11c], ebx
push ebx
push 2
rep stosd dword es:[edi], eax
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x403266
lea eax, [esp + 0x11c]
mov dword [esp + 0x11c], 0x128
push eax
push edi
call sub.kernel32.dll_Process32First
test eax, eax
je 0x4030f5
lea ecx, [esp + 0x140]
lea edx, [esp + 0x18]
push ecx
push 0x4bc748
push edx
call fcn.004a76b1
add esp, 0xc
lea esi, [esp + 0x18]
mov eax, 0x4bc738
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402fb2
cmp cl, bl
je 0x402fae
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402fb2
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402f8e
xor eax, eax
jmp 0x402fb7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4030d9
lea esi, [esp + 0x18]
mov eax, 0x4bc730
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402fec
cmp cl, bl
je 0x402fe8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402fec
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402fc8
xor eax, eax
jmp 0x402ff1
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4030d9
lea esi, [esp + 0x18]
mov eax, 0x4bc720
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403026
cmp cl, bl
je 0x403022
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403026
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403002
xor eax, eax
jmp 0x40302b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4030d9
lea esi, [esp + 0x18]
mov eax, 0x4bc714
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403060
cmp cl, bl
je 0x40305c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403060
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40303c
xor eax, eax
jmp 0x403065
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4030d9
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x11c]
push ecx
push edi
mov dword [eax + 0x72e2c], ebx
call sub.kernel32.dll_Process32Next
test eax, eax
je 0x4030f5
lea edx, [esp + 0x140]
lea eax, [esp + 0x18]
push edx
push 0x4bc748
push eax
call fcn.004a76b1
add esp, 0xc
lea esi, [esp + 0x18]
mov eax, 0x4bc738
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4030cc
cmp cl, bl
je 0x4030c8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4030cc
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4030a8
xor eax, eax
jmp 0x4030d1
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402fbf
mov ecx, dword [esp + 0x10]
push 1
push 0xa
push 0x4bc6d4
mov dword [ecx + 0x72e2c], 1
call fcn.004117a0
mov ebp, dword [sym.imp.kernel32.dll_CloseHandle]
push edi
call ebp
push ebx
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x403266
lea eax, [esp + 0x11c]
mov dword [esp + 0x11c], 0x128
push eax
push edi
call sub.kernel32.dll_Process32First
test eax, eax
je 0x403263
lea ecx, [esp + 0x140]
lea edx, [esp + 0x18]
push ecx
push 0x4bc748
push edx
call fcn.004a76b1
add esp, 0xc
lea esi, [esp + 0x18]
mov eax, 0x4bc6c8
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403179
cmp cl, bl
je 0x403175
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403179
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403155
xor eax, eax
jmp 0x40317e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4031b8
lea esi, [esp + 0x18]
mov eax, 0x4bc6b8
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4031af
cmp cl, bl
je 0x4031ab
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4031af
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40318b
xor eax, eax
jmp 0x4031b4
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4031c4
mov esi, dword [esp + 0x10]
inc dword [esi + 0x738d4]
jmp 0x4031c8
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x738d4], 2
jl 0x403243
add esi, 0x731b8
mov ecx, esi
call fcn.004a6fd0
test eax, eax
jge 0x40320f
lea eax, [esp + 0x14]
mov ecx, esi
push eax
mov dword [esp + 0x18], 2
call fcn.004a6fb0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 1
lea ecx, [edx + 0x72e54]
jmp 0x40323e
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x738d4], 2
jl 0x403243
lea ecx, [esi + 0x731b8]
call fcn.004a6fd0
test eax, eax
jle 0x403243
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
lea ecx, [esi + 0x72e54]
call fcn.004a6fb0
lea ecx, [esp + 0x11c]
push ecx
push edi
call sub.kernel32.dll_Process32Next
test eax, eax
jne 0x403132
mov edx, dword [esp + 0x10]
mov dword [edx + 0x738d4], ebx
push edi
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret