Function at 0x42dd10
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c8e66
mov eax, dword fs:[0]
push eax
mov eax, 0x1478
call fcn.00477a70
mov eax, dword [0x5036e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1248]
push eax
call fcn.0042e100
cmp dword [ebp - 0x1234], 8
lea ecx, [ebp - 0x1248]
mov edx, dword [ebp - 0x1248]
lea edi, [ebp - 0x1248]
mov eax, dword [ebp - 0x1238]
cmovae ecx, edx
push fcn.004a3590
cmovae edi, edx
mov dword [ebp - 4], 0
push edi
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x1248]
cmovae ecx, edx
lea eax, [ebp - 0x1484]
push ecx
push eax
call fcn.0042d670
add esp, 0x18
xor bl, bl
mov byte [ebp - 0x1475], bl
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x147c], eax
cmp eax, 0xffffffff
je 0x42e080
push 0x228
lea eax, [ebp - 0x1470]
push 0
push eax
call fcn.00499120
add esp, 0xc
mov dword [ebp - 0x1474], 0x22c
lea eax, [ebp - 0x1474]
push eax
push dword [ebp - 0x147c]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42e074
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.00499120
mov edi, dword [ebp - 0x146c]
add esp, 0xc
push edi
push 0
push 0x410
call ebx
mov esi, eax
test esi, esi
jne 0x42de3c
push edi
push eax
push 0x1010
call ebx
mov esi, eax
test esi, esi
je 0x42df13
push 0x800
lea eax, [ebp - 0xa18]
push 0
push eax
call fcn.00499120
add esp, 0xc
lea eax, [ebp - 0xa18]
push 0x400
push eax
push 0
push esi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x42dedb
push 0x800
lea eax, [ebp - 0x1218]
push 0
push eax
call fcn.00499120
lea eax, [ebp - 0xa18]
push 0x7e
push eax
call fcn.0049982d
add esp, 0x14
test eax, eax
je 0x42deb9
push 0x400
lea eax, [ebp - 0x1218]
push eax
lea eax, [ebp - 0xa18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
lea eax, [ebp - 0x1218]
jbe 0x42debf
lea eax, [ebp - 0xa18]
push 0x104
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004a368e
add esp, 0x10
jmp 0x42df0c
push 0x400
lea eax, [ebp - 0xa18]
push eax
push esi
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
test eax, eax
je 0x42df0c
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa18]
push eax
call fcn.0042daf0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x1220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x121c], 7
mov word [ebp - 0x1230], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42df40
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1230]
call fcn.0040edb0
cmp dword [ebp - 0x121c], 8
lea eax, [ebp - 0x1230]
mov ebx, dword [ebp - 0x1230]
lea ecx, [ebp - 0x1230]
mov esi, dword [ebp - 0x1220]
cmovae eax, ebx
cmovae ecx, ebx
mov byte [ebp - 4], 1
lea eax, [eax + esi*2]
lea esi, [ebp - 0x1230]
mov edx, eax
cmovae esi, ebx
xor edi, edi
sub edx, esi
inc edx
shr edx, 1
cmp esi, eax
cmova edx, edi
mov dword [ebp - 0x1484], edx
test edx, edx
je 0x42dfd5
sub ecx, esi
mov ebx, ecx
movzx eax, word [esi]
push eax
call fcn.004a3590
inc edi
mov word [esi + ebx], ax
add esp, 4
lea esi, [esi + 2]
cmp edi, dword [ebp - 0x1484]
jne 0x42dfb3
mov ebx, dword [ebp - 0x1230]
mov esi, dword [ebp - 0x121c]
lea eax, [ebp - 0x1230]
mov edx, dword [ebp - 0x1238]
lea ecx, [ebp - 0x1248]
cmp esi, 8
cmovae eax, ebx
cmp dword [ebp - 0x1234], 8
cmovae ecx, dword [ebp - 0x1248]
cmp edx, dword [ebp - 0x1220]
jne 0x42e01c
push edx
push eax
push ecx
call fcn.0041f2e0
add esp, 0xc
test eax, eax
je 0x42e0b4
mov byte [ebp - 4], 0
cmp esi, 8
jb 0x42e054
lea ecx, [esi*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x42e04a
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42e0eb
push ecx
push ebx
call fcn.0047771f
add esp, 8
lea eax, [ebp - 0x1474]
push eax
push dword [ebp - 0x147c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42ddf7
mov bl, byte [ebp - 0x1475]
push dword [ebp - 0x147c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1234]
cmp edx, 8
jb 0x42e0cd
mov ecx, dword [ebp - 0x1248]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42e0c3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42e0eb
jmp 0x42e0c3
lea ecx, [ebp - 0x1230]
mov bl, 1
call fcn.0040b030
jmp 0x42e074
push edx
push ecx
call fcn.0047771f
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004779e3
mov esp, ebp
pop ebp
ret
call fcn.0049c69a
int3