Function at 0x4a7bd8
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push 0x264
mov eax, 0x5d4628
call fcn.00506dfb
mov eax, dword [ebp + 8]
xor edi, edi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp + 0xc]
push 0x22c
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x23c]
push edi
push eax
mov dword [ebp - 0x244], esi
call fcn.0056b050
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4a804a
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.00413f09
and dword [ebp - 4], 0
lea ecx, [ebp - 0x240]
push 0x5ffb9c
call fcn.0042e69b
test eax, eax
je 0x4a8018
push 0x5ffbe8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a8018
push 0x5ffc34
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a8013
push 0x5ffc88
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a8013
push 0x5ffcd4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a800e
push 0x5ffcf0
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a800e
push 0x5ffd48
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a8009
push 0x5ffd9c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a8009
push 0x5ffe3c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a8004
push 0x5ffe88
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a8004
push 0x5ffed4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a8004
push 0x5fff7c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fff
push 0x5fff94
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fff
push 0x600010
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7ffa
push 0x600040
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7ffa
push 0x6000b8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7ff2
push 0x6000d4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7ff2
push 0x600114
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x4a7e0f
or edi, 0x100
jmp 0x4a801b
push 0x60019c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x4a7e2e
or edi, 0x200
jmp 0x4a801b
push 0x6001d4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x4a7e4d
or edi, 0x400
jmp 0x4a801b
push 0x600228
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x4a7e6c
or edi, 0x800
jmp 0x4a801b
push 0x6002d0
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fea
push 0x6002f4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fea
push 0x60034c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fe2
push 0x60036c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fe2
push 0x6003a8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fe2
push 0x600414
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fe2
push 0x60043c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x4a7f1b
or edi, 0x4000
jmp 0x4a801b
push 0x600490
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x4a7f3a
or edi, 0x8000
jmp 0x4a801b
push 0x6004b0
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fda
push 0x6004cc
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fda
push 0x6004f8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fda
push 0x600540
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fd2
push 0x60056c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fd2
push 0x600594
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x4a7fd2
push 0x60060c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x4a801b
or edi, 0x40000
jmp 0x4a801b
or edi, 0x20000
jmp 0x4a801b
or edi, 0x10000
jmp 0x4a801b
or edi, 0x2000
jmp 0x4a801b
or edi, 0x1000
jmp 0x4a801b
or edi, 0x80
jmp 0x4a801b
or edi, 0x40
jmp 0x4a801b
or edi, 0x20
jmp 0x4a801b
or edi, 0x10
jmp 0x4a801b
or edi, 8
jmp 0x4a801b
or edi, 4
jmp 0x4a801b
or edi, 2
jmp 0x4a801b
or edi, 1
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
mov ecx, dword [ebp - 0x240]
mov esi, eax
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00412ac4
test esi, esi
jne 0x4a7c42
mov esi, dword [ebp - 0x244]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0041279d
push eax
lea ecx, [ebp - 0x250]
call fcn.00411d94
push edi
lea eax, [ebp - 0x250]
mov dword [ebp - 4], 1
push 0x600624
push eax
call fcn.00412690
mov eax, dword [ebp - 0x248]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00412393
add eax, 0x10
add esp, 0x10
mov dword [ebp - 0x240], eax
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 2
call fcn.0042ca82
push ecx
mov ecx, esp
mov dword [ebp - 0x254], esp
push 0x600634
mov byte [ebp - 4], 3
call fcn.00413f09
push ecx
push esp
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 4
call fcn.0043944c
lea eax, [ebp - 0x24c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x270]
call fcn.00434114
push dword [ebp - 0x24c]
mov byte [ebp - 4], 5
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a8159
push dword [ebp - 0x24c]
lea eax, [ebp - 0x248]
push eax
call fcn.0048ba90
push eax
lea eax, [ebp - 0x244]
mov byte [ebp - 4], 6
push 0x6006a4
push eax
call fcn.0042e01c
add esp, 0x14
mov eax, dword [eax]
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 7
push dword [eax - 0xc]
push eax
call fcn.00412114
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x248]
mov byte [ebp - 4], 5
lea ecx, [ecx - 0x10]
call fcn.00412ac4
call fcn.0041279d
push eax
lea ecx, [ebp - 0x248]
call fcn.00411d94
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 8
push eax
call fcn.0048a07f
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x244]
push 0x6006b8
push eax
call fcn.0042e01c
add esp, 0x10
mov eax, dword [eax]
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 9
push dword [eax - 0xc]
push eax
call fcn.00412114
mov ecx, dword [ebp - 0x244]
mov byte [ebp - 4], 8
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x244]
push 0x6006d0
push eax
call fcn.0042e01c
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0xa
push dword [eax - 0xc]
push eax
call fcn.00412114
mov ecx, dword [ebp - 0x244]
mov byte [ebp - 4], 8
lea ecx, [ecx - 0x10]
call fcn.00412ac4
call fcn.0041279d
push eax
lea ecx, [ebp - 0x244]
call fcn.00411d94
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0xb
push 0
push eax
call fcn.0048ba90
push dword [esi]
mov byte [ebp - 4], 0xc
push dword [eax]
lea eax, [ebp - 0x244]
push 0x6006f4
push eax
call fcn.00412690
mov ecx, dword [ebp - 0x254]
add esp, 0x18
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push dword [ebp + 0x14]
mov esi, dword [ebp - 0x244]
mov edi, dword [ebp - 0x240]
push esi
push edi
push dword [ebp - 0x258]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esi - 0x10]
mov ebx, eax
call fcn.00412ac4
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp - 0x24c]
add ecx, 0xfffffff0
call fcn.00412ac4
lea ecx, [ebp - 0x270]
call fcn.0042e60b
mov ecx, dword [ebp - 0x260]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [edi - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x250]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, ebx
call fcn.00506da5
ret