Function at 0x405a58
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5bc
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov ebx, eax
push ecx
push ecx
je 0x405aac
lea eax, [ebp - 0x548]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x548], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
push edx
push edx
jne 0x405ad4
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
push eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x29
mov dword [esp], eax
call fcn.00403f73
jmp 0x405d68
lea eax, [ebp - 0x584]
mov dword [esp + 4], 0x8000
mov dword [esp], eax
call fcn.00411ee0
mov dword [esp], 0x413b34
call fcn.00405455
mov dword [esp + 4], str.GetModuleFileNameExA
mov dword [esp], eax
call fcn.00405469
test eax, eax
mov esi, eax
jne 0x405b2a
mov dword [esp], 0x413b53
call fcn.00405455
mov dword [esp + 4], str.GetModuleFileNameExA
mov dword [esp], eax
call fcn.00405469
mov esi, eax
mov eax, dword [ebp - 0x540]
mov dword [esp + 4], 0
mov dword [esp], 0x410
mov dword [esp + 8], eax
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
test eax, eax
mov edi, eax
setne byte [ebp - 0x599]
je 0x405b82
test esi, esi
je 0x405b82
lea eax, [ebp - 0x21c]
mov dword [esp + 0xc], 0x204
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edi
call esi
sub esp, 0x10
test eax, eax
jne 0x405ba0
lea eax, [ebp - 0x21c]
mov dword [esp + 8], 0x204
mov dword [esp + 4], 0x413b60
mov dword [esp], eax
call fcn.0040ad48
lea eax, [ebp - 0x58c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x594]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_GetProcessTimes
xor edx, edx
sub esp, 0x14
test eax, eax
je 0x405bd9
xor edx, edx
cmp dword [ebp - 0x594], 0
setne dl
test edx, edx
je 0x405c59
lea eax, [ebp - 0x578]
mov dword [esp + 4], eax
lea eax, [ebp - 0x594]
mov dword [esp], eax
call sub.KERNEL32.dll_FileTimeToSystemTime
push eax
push eax
movzx eax, word [ebp - 0x56c]
mov dword [esp + 8], str._.2d__.2d__d__.2d:_.2d:_.2d
mov dword [esp + 4], 0x20
mov dword [esp + 0x20], eax
movzx eax, word [ebp - 0x56e]
mov dword [esp + 0x1c], eax
movzx eax, word [ebp - 0x570]
mov dword [esp + 0x18], eax
movzx eax, word [ebp - 0x578]
mov dword [esp + 0x14], eax
movzx eax, word [ebp - 0x576]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x572]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x568]
mov dword [esp], eax
call fcn.0040afa3
jmp 0x405c77
lea eax, [ebp - 0x568]
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x413b60
mov dword [esp], eax
call fcn.0040ad48
cmp byte [ebp - 0x599], 0
je 0x405c89
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
push ecx
lea eax, [ebp - 0x568]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x21c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x540]
lea edi, [ebp - 0x420]
mov dword [esp + 8], str._s_a_d_a_s_a_s_a
mov dword [esp + 4], 0x204
mov dword [esp], edi
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x524]
mov dword [esp + 0xc], eax
call fcn.0040afa3
test eax, eax
jle 0x405ce9
mov dword [esp + 8], eax
lea eax, [ebp - 0x584]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00411fcc
lea eax, [ebp - 0x548]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
push edx
push edx
jne 0x405b2a
mov dword [esp], ebx
lea ebx, [ebp - 0x584]
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x57c], 0
push eax
je 0x405d3d
mov dword [esp], ebx
call fcn.004120b4
mov dword [esp + 4], 0x28
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x584]
mov dword [esp + 8], eax
jmp 0x405d55
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x29
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00403f73
mov dword [esp], ebx
call fcn.00411f25
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret