Function at 0x4913a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68bc4a
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x7994f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], 0
mov dword [ebp - 4], 0
call fcn.0049fc90
push 0
push 2
mov dword [ebp - 0x294], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, eax
mov dword [ebp - 0x2c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x28c], ecx
xor eax, eax
movq qword [ebp - 0x34], xmm0
xor esi, esi
mov dword [ebp - 0x290], eax
xor edi, edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
cmp ecx, 0xffffffff
jne 0x491438
xor bl, bl
jmp 0x491953
lea eax, [ebp - 0x280]
mov dword [ebp - 0x280], 0x22c
push eax
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x491945
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x491480
sub ecx, edx
lea eax, [ebp - 0x25c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0048bd90
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edx, 8
mov eax, dword [ebp - 0x18]
cmovae ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebp - 0x288], ecx
cmp eax, 0xb
jb 0x4914f5
add eax, 0xfffffff6
lea edx, [ecx + eax*2]
mov eax, ecx
mov dword [ebp - 0x284], edx
nop
mov ecx, edx
sub ecx, eax
sar ecx, 1
je 0x4914f2
nop dword [eax + eax]
cmp word [eax], 0x41
je 0x491672
add eax, 2
sub ecx, 1
jne 0x4914e0
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x49152d
lea edx, [edx*2 + 2]
mov eax, ebx
cmp edx, 0x1000
jb 0x491523
mov ebx, dword [ebx - 4]
add edx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4919d4
push edx
push ebx
call fcn.006051f2
add esp, 8
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 0x28c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x491460
mov ebx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x288], ebx
cmp ebx, edi
je 0x491943
push dword [ebp - 0x2a0]
mov eax, edi
sub eax, ebx
sar eax, 2
push eax
push edi
push ebx
call fcn.0048f560
add esp, 0x10
mov dword [ebp - 0x284], ebx
mov esi, ebx
nop dword [eax + eax]
push dword [esi]
call fcn.004a06b0
add esp, 4
cmp eax, dword [ebp - 0x294]
jne 0x4917aa
push dword [esi]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x29c], ebx
test ebx, ebx
je 0x4917a6
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
xorps xmm0, xmm0
push ebx
movlpd qword [ebp - 0x3c], xmm0
call fcn.00490ca0
mov esi, dword [ebp - 0x28]
add esp, 8
test al, al
je 0x49174a
mov ecx, dword [ebp + 0x20]
mov edx, ecx
cmp dword [ecx + 0x14], 0x10
jb 0x4915f8
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push edx
push dword [ebp - 0x18]
cmovae eax, esi
push eax
call fcn.0048f660
add esp, 0x10
test eax, eax
jne 0x49174a
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x4917d4
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp edx, 0x10
jb 0x491781
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49166b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4919d4
push edx
push ecx
jmp 0x491779
mov edx, 0x6dc63c
mov edi, eax
mov esi, 0xb
sub edi, edx
mov cx, word [edx + edi]
cmp cx, word [edx]
jne 0x4916f0
add edx, 2
sub esi, 1
jne 0x491680
sub eax, dword [ebp - 0x288]
sar eax, 1
cmp eax, 0xffffffff
je 0x4914f2
lea eax, [ebp - 0x278]
push eax
call fcn.004a4c30
add esp, 4
test al, al
je 0x4916fe
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp eax, 8
jb 0x49152d
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4916ea
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4919d4
push ecx
jmp 0x491524
mov edx, dword [ebp - 0x284]
add eax, 2
jmp 0x4914d0
lea eax, [ebp - 0x278]
push eax
call fcn.004a4c40
add esp, 4
test al, al
jne 0x4916b5
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x290]
je 0x49172c
mov eax, dword [ebp - 0x278]
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x30], ecx
jmp 0x4916b5
lea eax, [ebp - 0x278]
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.0048e4d0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x290], eax
jmp 0x4916b5
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp eax, 0x10
jb 0x491781
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x491777
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4919d4
push ecx
push esi
call fcn.006051f2
add esp, 8
push ebx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x284]
jmp 0x4917aa
mov byte [ebp - 4], 1
add esi, 4
mov dword [ebp - 0x284], esi
cmp esi, edi
jne 0x491580
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x288]
xor bl, bl
jmp 0x491953
mov eax, dword [ebp - 0x3c]
mov ebx, 0xe57a42bd
mul ebx
mov edi, 0xd6bf94d5
mov dword [ebp - 0x298], eax
mov esi, edx
mov eax, dword [ebp - 0x3c]
mul edi
mov edi, eax
mov dword [ebp - 0x294], edx
mov eax, dword [ebp - 0x38]
mul ebx
mov ebx, edx
mov ecx, eax
mov eax, dword [ebp - 0x38]
mov edx, 0xd6bf94d5
mul edx
add ecx, esi
mov dword [ebp - 0x284], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [ebp - 0x294]
adc ecx, 0
mov dword [ebp - 0x2a8], edi
xor eax, eax
add ebx, ecx
mov ecx, dword [ebp - 0x284]
adc eax, eax
add ecx, ebx
adc edx, eax
shrd ecx, edx, 0x17
shr edx, 0x17
sub ecx, 0xb6109100
mov dword [ebp - 0x298], ecx
lea ecx, [ebp - 0x28]
sbb edx, 2
mov dword [ebp - 0x294], edx
call fcn.0047aca0
push dword [ebp - 0x29c]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x2a0]
mov eax, dword [ebx + 0x10]
lea esi, [ebx + 0x10]
test eax, eax
je 0x491926
inc eax
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x29c], 1
call fcn.00493990
push 1
push 0x6dc570
lea ecx, [ebp - 0x28]
call fcn.0048bb10
cmp dword [ebx + 0x14], 0x10
jb 0x4918cc
mov ebx, dword [ebx]
push dword [esi]
lea ecx, [ebp - 0x28]
push ebx
call fcn.0048bb10
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp + 8]
push eax
call fcn.0048bb10
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp edx, 0x10
jb 0x491926
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49191c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4919d4
push edx
push ecx
call fcn.006051f2
add esp, 8
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x298]
push eax
call fcn.004919e0
mov esi, dword [ebp - 0x288]
add esp, 8
mov bl, al
jmp 0x491953
mov esi, ebx
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
test esi, esi
je 0x491986
mov ecx, dword [ebp - 0x290]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x49197c
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4919d4
push ecx
push esi
call fcn.006051f2
add esp, 8
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x4919b6
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4919ac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4919d4
push edx
push ecx
call fcn.006051f2
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060565a
mov esp, ebp
pop ebp
ret
call fcn.00611192
int3