Function at 0x4647d9
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb20
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
push 0
push 2
mov ebx, ecx
mov dword [ebp - 0xb20], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x464b00
push 0x228
lea eax, [ebp - 0xb08]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xb0c], 0x22c
lea eax, [ebp - 0xb0c]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x464af9
push esi
push dword [ebp - 0xb04]
mov ecx, ebx
call fcn.004657c2
test eax, eax
je 0x464ae3
push dword [ebp - 0xb04]
lea eax, [ebp - 0x81c]
push eax
call fcn.00464b16
cmp dword [ebp - 0x808], 8
lea eax, [ebp - 0x81c]
pop ecx
pop ecx
jb 0x464881
mov eax, dword [ebp - 0x81c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x880]
call fcn.004108e3
and dword [ebp - 0x824], 0
xor eax, eax
and dword [ebp - 0xb10], eax
mov word [ebp - 0x834], ax
lea eax, [ebp - 0xb10]
push eax
mov dword [ebp - 0x820], 7
call fcn.0043e8d8
mov eax, dword [ebp - 0xb10]
pop ecx
test eax, eax
je 0x464977
cmp dword [ebp - 0x808], 8
lea edx, [ebp - 0x81c]
jb 0x4648e4
mov edx, dword [ebp - 0x81c]
mov ecx, dword [eax]
push 1
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x464977
mov eax, dword [ebp - 0xb10]
lea edx, [ebp - 0xb14]
and dword [ebp - 0xb14], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov esi, dword [ebp - 0xb14]
test esi, esi
je 0x464977
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi]
lea ecx, [ebp - 0x804]
add esp, 0xc
push 0x400
push ecx
push 2
push esi
call dword [eax + 0x10]
test eax, eax
je 0x464967
lea eax, [ebp - 0x804]
push eax
call sub.msvcrt.dll_wcslen
pop ecx
push eax
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x834]
call fcn.00410dd4
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0x464977
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x808], 8
lea esi, [ebp - 0x81c]
jb 0x46498c
mov esi, dword [ebp - 0x81c]
push str._._colorrgb_0_0_0____.___
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x8e0]
push str._._colorrgb_6_6_254____._
push eax
call fcn.0042ba61
add esp, 0xc
push eax
lea eax, [ebp - 0x8c8]
push eax
call fcn.00424243
add esp, 0xc
lea ecx, [ebp - 0x834]
cmp dword [ebp - 0x820], 8
jb 0x4649d1
mov ecx, dword [ebp - 0x834]
push dword [ebp - 0x824]
push ecx
mov ecx, eax
call fcn.00422558
xor ecx, ecx
mov byte [ebp - 0xb18], cl
push dword [ebp - 0xb18]
mov dword [ebp - 0x858], ecx
mov dword [ebp - 0x854], ecx
lea ecx, [ebp - 0x868]
push eax
call fcn.00410cac
xor eax, eax
mov dword [ebp - 0x850], esi
mov byte [ebp - 0xb1c], al
lea ecx, [ebp - 0x84c]
push dword [ebp - 0xb1c]
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x868]
push eax
call fcn.00410cac
lea eax, [ebp - 0x84c]
push eax
lea ecx, [ebp - 0x8b0]
call fcn.004243ad
push dword [ebp - 0x850]
lea ecx, [ebp - 0x898]
call fcn.004108e3
mov esi, dword [ebp - 0xb20]
lea eax, [ebp - 0x8b0]
push eax
mov ecx, esi
push dword [esi]
call fcn.0043eaed
lea ecx, [ebp - 0x898]
call fcn.00410d88
lea ecx, [ebp - 0x8b0]
call fcn.00410d88
lea ecx, [ebp - 0x84c]
call fcn.00410d88
lea ecx, [ebp - 0x868]
call fcn.00410d88
lea ecx, [ebp - 0x8c8]
call fcn.00410d88
lea ecx, [ebp - 0x8e0]
call fcn.00410d88
mov eax, dword [ebp - 0xb10]
test eax, eax
je 0x464ac2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x834]
call fcn.00410d88
lea ecx, [ebp - 0x880]
call fcn.00410d88
lea ecx, [ebp - 0x81c]
call fcn.00410d88
lea eax, [ebp - 0xb0c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x464843
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret 4