Function at 0x401e90
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x407fd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14c
mov eax, dword [0x40b0e0]
push ebx
push ebp
push esi
mov dword [esp + 0x154], eax
push edi
push 0
push 0xf
mov dword [esp + 0x16c], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x30]
push ecx
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x38], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402086
mov edi, edi
lea eax, [esp + 0x54]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401f10
sub eax, edx
push eax
lea edx, [esp + 0x58]
push edx
lea ecx, [esp + 0x1c]
call fcn.00401b90
mov ebx, dword [esp + 0x2c]
cmp ebx, 0x10
mov esi, dword [esp + 0x18]
mov byte [esp + 0x164], 1
mov edi, esi
jae 0x4020c7
lea edi, [esp + 0x18]
mov eax, edi
cmp ebx, 0x10
mov edx, dword [esp + 0x28]
lea ebp, [edx + eax]
jae 0x401f59
lea esi, [esp + 0x18]
cmp esi, ebp
je 0x401f7c
sub edi, esi
nop
movsx eax, byte [esi]
push eax
call fcn.00403a1c
add esp, 4
mov byte [edi + esi], al
inc esi
cmp esi, ebp
jne 0x401f60
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x184]
cmp esi, 0x10
mov edi, dword [esp + 0x170]
jae 0x4020ce
lea edi, [esp + 0x170]
mov eax, edi
mov ecx, dword [esp + 0x180]
cmp esi, 0x10
mov esi, dword [esp + 0x170]
lea ebp, [eax + ecx]
jae 0x401fb9
lea esi, [esp + 0x170]
cmp esi, ebp
je 0x401fe3
sub edi, esi
nop
movsx ecx, byte [esi]
push ecx
call fcn.00403a1c
add esp, 4
mov byte [edi + esi], al
inc esi
cmp esi, ebp
jne 0x401fc0
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x180]
cmp dword [esp + 0x184], 0x10
mov edi, dword [esp + 0x170]
jae 0x401ffb
lea edi, [esp + 0x170]
xor ebp, ebp
cmp edx, ebp
je 0x40202a
cmp edx, ecx
jae 0x402007
mov ecx, edx
cmp ebx, 0x10
mov esi, dword [esp + 0x18]
jae 0x402014
lea esi, [esp + 0x18]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40201f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x40203d
mov ecx, dword [esp + 0x180]
cmp edx, ecx
jb 0x40203d
xor eax, eax
cmp edx, ecx
setne al
cmp eax, ebp
je 0x4020da
cmp ebx, 0x10
mov byte [esp + 0x164], 0
jb 0x402057
mov edx, dword [esp + 0x18]
push edx
call fcn.004034fd
add esp, 4
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x30]
push eax
push esi
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401ef0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x184], 0x10
jb 0x4020a0
mov ecx, dword [esp + 0x170]
push ecx
call fcn.004034fd
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x14c]
pop ebx
call fcn.00403533
add esp, 0x158
ret
mov eax, esi
jmp 0x401f49
mov eax, dword [esp + 0x170]
jmp 0x401f9c
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x38]
mov edi, 0x10
cmp eax, edi
jb 0x402103
mov edx, dword [esp + 0x18]
push edx
call fcn.004034fd
add esp, 4
cmp dword [esp + 0x184], edi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebp
mov byte [esp + 0x18], 0
jb 0x40212d
mov eax, dword [esp + 0x170]
push eax
call fcn.004034fd
add esp, 4
mov eax, esi
jmp 0x4020a2