Function at 0x452860
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511e30
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x274], esi
test esi, esi
je 0x452ab5
cmp dword [esi + 0x188], 4
jbe 0x452aa6
push 0x22c
lea eax, [ebp - 0x26c]
push ebx
push eax
call fcn.004ab2f0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x278], eax
cmp eax, 0xffffffff
je 0x452aa6
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x452a9a
lea ebx, [esi + 0x178]
mov dword [ebp - 0x27c], ebx
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00402400
add esp, 8
cmp dword [ebx + 0x14], 8
mov dword [ebp - 4], 0
jb 0x452929
mov eax, dword [ebx]
jmp 0x45292b
mov eax, ebx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004024f0
add esp, 8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
mov esi, dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
cmp edx, 0x10
mov byte [ebp - 4], 1
lea ebx, [ebp - 0x40]
cmovae eax, esi
cmovae ecx, esi
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x30]
add eax, ecx
cmp edx, 0x10
mov edi, eax
cmovae ebx, esi
xor ecx, ecx
sub edi, ebx
xor esi, esi
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x452998
movsx ax, byte [esi + ebx]
movzx eax, ax
push eax
call fcn.004bec3d
mov ecx, dword [ebp - 0x270]
add esp, 4
mov byte [esi + ecx], al
inc esi
cmp esi, edi
jne 0x452976
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmp esi, 0x10
lea ebx, [ebp - 0x28]
cmovae eax, edi
cmovae ecx, edi
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x18]
add eax, ecx
cmp esi, 0x10
cmovae ebx, edi
mov edi, eax
sub edi, ebx
xor ecx, ecx
xor esi, esi
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x4529f4
movsx ax, byte [esi + ebx]
movzx eax, ax
push eax
call fcn.004bec3d
mov ecx, dword [ebp - 0x270]
add esp, 4
mov byte [esi + ecx], al
inc esi
cmp esi, edi
jne 0x4529d2
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 0x10
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004acf10
add esp, 8
test eax, eax
jne 0x452a7b
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x452a2c
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004092a0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x10
jb 0x452a5a
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004092a0
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x278]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x452a92
mov ebx, dword [ebp - 0x27c]
jmp 0x452905
lea ecx, [ebp - 0x28]
mov ebx, 1
call fcn.00408cf0
lea ecx, [ebp - 0x40]
call fcn.00408cf0
jmp 0x452a94
xor ebx, ebx
mov esi, dword [ebp - 0x274]
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x188], 0
mov eax, 1
cmove ebx, eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret