Function at 0x4cf673
Capabilities:
Enumerate processes

Disassembly:
push 0x4ac
mov eax, 0x553bce
call fcn.00514880
push 0x59
pop ecx
mov esi, str.rrNWnoEJ3HnPNKvjJBZmDEsg0nijVfqzsuog4c1UOp3yd33vu4HpU4lgXcOrcaw9uLwbTQCjQKswceuZjxxTNV5wgpIlXQY2PsWoGuOInhQfbj0NxEgqlRZWSXyXUvupHTpz4VyrM3atNMul3lToySYBzO1lWpYPvLr2NPAjdvFLTBXMbTiQC3UHMBycO0RCYBDWPUWc7VQFrhA4qOkc77CsyAkiT6RowoiewsSAJ2I43UwTFVc0cF2CSjpdlzpiWjKw2JKWFWfXxYBq4QdKYHghqqv87XV9Zwmo60RSKvdJwZwbqu02sI2CTVMSE4wfecFlUPAI7m1A0DcweOTDAmO9c5HhK5EgNpjvO
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x250]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x35
pop ecx
mov dword [ebp - 0x4b8], eax
movsw word es:[edi], word [esi]
mov esi, str.FMgH9j8RrPhb1bb6wxQQVDlnH0D2RMp4IQzzyXUXi40bl8zmWC8uaWNjHeN9GxVOazW3C6RhWqpGBH9PWRn3FyC9yLzqTjutnldOfnF0spBzOUbkdx34PL2z0F3drsGGVYYSA7kzw1v91vD4DTnjJqWl9COuVubKTiJTuJWZpfVVdMuNfRNCa60MNDjcptQdppVtcMv9GpidVMhRuvOS
mov dword [ebp - 0x4b4], eax
lea edi, [ebp - 0xe8]
mov dword [ebp - 0x4b0], eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x268]
lea eax, [ebp - 0x250]
push eax
call fcn.004057d0
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x4b8]
call fcn.00407f90
xor edi, edi
mov byte [ebp - 4], 0
push 0
inc edi
lea ecx, [ebp - 0x268]
push edi
call fcn.00479e2e
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0x268]
call fcn.004057d0
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x4b8]
call fcn.00407f90
push 0
push edi
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0
call fcn.00479e2e
test ebx, ebx
jne 0x4cf741
xor esi, esi
jmp 0x4cf869
push ebx
lea ecx, [ebp - 0x280]
call fcn.004024f0
lea eax, [ebp - 0x280]
mov byte [ebp - 4], 3
push eax
call fcn.004daf09
mov dword [esp], 0x22c
lea eax, [ebp - 0x4ac]
xor ebx, ebx
push ebx
push eax
call fcn.004f14e0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4cf85a
lea eax, [ebp - 0x4ac]
mov dword [ebp - 0x4ac], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4cf84b
xor eax, eax
mov dword [ebp - 0x254], 7
mov dword [ebp - 0x258], ebx
mov word [ebp - 0x268], ax
cmp word [ebp - 0x488], ax
jne 0x4cf7cb
mov eax, ebx
jmp 0x4cf7d8
lea eax, [ebp - 0x488]
push eax
call fcn.005017a9
pop ecx
push eax
lea eax, [ebp - 0x488]
push eax
lea ecx, [ebp - 0x268]
call fcn.00402650
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 4
push eax
call fcn.004daf09
cmp dword [ebp - 0x26c], 8
lea eax, [ebp - 0x280]
pop ecx
push dword [ebp - 0x270]
cmovae eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x268]
push eax
push dword [ebp - 0x258]
push ebx
call fcn.00426720
test eax, eax
je 0x4cf87c
push ebx
push edi
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 3
call fcn.00402590
lea eax, [ebp - 0x4ac]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4cf7a5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push ebx
push edi
lea ecx, [ebp - 0x280]
call fcn.00402590
lea ecx, [ebp - 0x4b8]
call fcn.00479e80
mov eax, esi
call fcn.0051483b
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x4a4]
lea ecx, [ebp - 0x268]
push ebx
push edi
call fcn.00402590
jmp 0x4cf85c