Function at 0x415ea4
Capabilities:
Enumerate processes

Disassembly:
push edi
push esi
push ebx
sub esp, 0x5c0
mov dword [esp + 0x5b8], 0
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [esp + 0x5b4], eax
cmp dword [esp + 0x5b4], 0xffffffff
jne 0x415f0c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xbf
mov eax, dword [esp + 0x5d0]
mov dword [esp], eax
call fcn.00408b8f
jmp 0x4162ec
mov dword [esp + 0x70], 0x128
lea eax, [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x5b4]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
jne 0x415f70
mov eax, dword [esp + 0x5b4]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xbf
mov eax, dword [esp + 0x5d0]
mov dword [esp], eax
call fcn.00408b8f
jmp 0x4162ec
mov dword [esp + 4], 0x8000
lea eax, [esp + 0x5a0]
mov dword [esp], eax
call fcn.004195d4
mov dword [esp], str.Ed5FWSQid_4idLCldjfD
call fcn.0040b60e
mov ebx, eax
mov dword [esp], str.psapi.dll
call fcn.0040b4e9
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0040b4ff
mov dword [esp + 0x5bc], eax
cmp dword [esp + 0x5bc], 0
jne 0x415feb
mov dword [esp], str.Ed5FWSQid_4idLCldjfD
call fcn.0040b60e
mov ebx, eax
mov dword [esp], 0x4201ab
call fcn.0040b4e9
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0040b4ff
mov dword [esp + 0x5bc], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x410
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
mov dword [esp + 0x5b0], eax
cmp dword [esp + 0x5b0], 0
je 0x41607b
cmp dword [esp + 0x5bc], 0
je 0x41607b
mov dword [esp + 0xc], 0x204
lea eax, [esp + 0x198]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x5b0]
mov dword [esp], eax
mov eax, dword [esp + 0x5bc]
call eax
sub esp, 0x10
test eax, eax
jne 0x41609a
mov dword [esp + 8], 0x204
mov dword [esp + 4], 0x4201b8
lea eax, [esp + 0x198]
mov dword [esp], eax
call fcn.00419918
jmp 0x41609a
mov dword [esp + 8], 0x204
mov dword [esp + 4], 0x4201b8
lea eax, [esp + 0x198]
mov dword [esp], eax
call fcn.00419918
lea eax, [esp + 0x60]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x60]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x60]
mov dword [esp + 8], eax
lea eax, [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x5b0]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcessTimes
sub esp, 0x14
test eax, eax
setne al
mov byte [esp + 0x5af], al
cmp byte [esp + 0x5af], 0
je 0x4160f1
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4160f1
mov eax, 1
jmp 0x4160f6
mov eax, 0
mov byte [esp + 0x5af], al
and byte [esp + 0x5af], 1
cmp byte [esp + 0x5af], 0
je 0x41618c
lea eax, [esp + 0x50]
mov dword [esp + 4], eax
lea eax, [esp + 0x68]
mov dword [esp], eax
call sub.KERNEL32.dll_FileTimeToSystemTime
sub esp, 8
movzx eax, word [esp + 0x5c]
movzx edi, ax
movzx eax, word [esp + 0x5a]
movzx esi, ax
movzx eax, word [esp + 0x58]
movzx ebx, ax
movzx eax, word [esp + 0x50]
movzx ecx, ax
movzx eax, word [esp + 0x52]
movzx edx, ax
movzx eax, word [esp + 0x56]
movzx eax, ax
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._.2d__.2d__d__.2d:_.2d:_.2d
mov dword [esp + 4], 0x20
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.00419fa8
jmp 0x4161a8
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x4201b8
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.00419918
cmp dword [esp + 0x5b0], 0
je 0x4161c4
mov eax, dword [esp + 0x5b0]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [esp + 0x78]
lea edx, [esp + 0x30]
mov dword [esp + 0x18], edx
lea edx, [esp + 0x198]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x70]
add eax, 0x24
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_a_d_a_s_a_s_a
mov dword [esp + 4], 0x204
lea eax, [esp + 0x39c]
mov dword [esp], eax
call fcn.00419fa8
mov dword [esp + 0x5b8], eax
cmp dword [esp + 0x5b8], 0
jle 0x41623f
mov eax, dword [esp + 0x5b8]
mov dword [esp + 8], eax
lea eax, [esp + 0x39c]
mov dword [esp + 4], eax
lea eax, [esp + 0x5a0]
mov dword [esp], eax
call fcn.0041972e
lea eax, [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x5b4]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
jne 0x415feb
mov eax, dword [esp + 0x5b4]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [esp + 0x5a8]
test eax, eax
je 0x4162b5
lea eax, [esp + 0x5a0]
mov dword [esp], eax
call fcn.00419910
mov edx, dword [esp + 0x5a0]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0xbe
mov eax, dword [esp + 0x5d0]
mov dword [esp], eax
call fcn.00408b8f
jmp 0x4162dc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xbf
mov eax, dword [esp + 0x5d0]
mov dword [esp], eax
call fcn.00408b8f
lea eax, [esp + 0x5a0]
mov dword [esp], eax
call fcn.00419639
nop
add esp, 0x5c0
pop ebx
pop esi
pop edi
ret