Function at 0x4526e3
Capabilities:
Enumerate processes

Disassembly:
push 0x464
mov eax, 0x4923f9
call fcn.00458f67
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
mov edi, ebx
mov dword [ebp - 4], ebx
mov esi, ebx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], edi
mov dword [ebp - 0x468], esi
push ebx
push 2
mov byte [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x45c], eax
cmp eax, 0xffffffff
jne 0x452782
mov ecx, dword [ebp - 0x460]
lea eax, [ebp - 0x458]
push eax
call fcn.004509a5
mov esi, dword [ebp - 0x458]
test esi, esi
je 0x4529d4
push 0x18
mov edi, esi
pop ebx
jmp 0x452775
mov ecx, edi
call fcn.00403bdf
add edi, ebx
cmp edi, dword [ebp - 0x454]
jne 0x45276c
jmp 0x452989
push 0x228
lea eax, [ebp - 0x440]
push ebx
push eax
call fcn.0045b1d0
add esp, 0xc
mov dword [ebp - 0x444], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x44c], ebx
call fcn.0045b1d0
add esp, 0xc
jmp 0x452917
cmp dword [ebp - 0x43c], ebx
jne 0x45283d
push ebx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x448], eax
test eax, eax
je 0x4528db
push 0x4b5990
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0045ed7b
add esp, 0xc
mov dword [ebp - 0x464], 0x104
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x45285c
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x45c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4527ca
jmp 0x4528e4
mov eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0x450]
je 0x45287e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x458]
call fcn.004506a5
jmp 0x452891
lea ecx, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x458]
call fcn.004507bf
cmp edi, esi
je 0x4528a2
mov dword [edi], ebx
add edi, 4
mov dword [ebp - 0x46c], edi
jmp 0x4528c1
lea eax, [ebp - 0x44c]
push eax
push edi
lea ecx, [ebp - 0x470]
call fcn.00412eb1
mov esi, dword [ebp - 0x468]
mov edi, dword [ebp - 0x46c]
mov ebx, dword [ebp - 0x42c]
push dword [ebp - 0x448]
mov dword [ebp - 0x44c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4528e4
or ebx, 0xffffffff
mov dword [ebp - 0x44c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x452931
cmp ebx, 0xffffffff
je 0x452931
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
je 0x452931
mov eax, dword [ebp - 0x470]
cmp eax, edi
je 0x452917
cmp dword [eax], ebx
je 0x452913
add eax, 4
cmp eax, edi
jne 0x452908
cmp eax, edi
jne 0x452931
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x45c]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4527ca
push dword [ebp - 0x45c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x460]
lea eax, [ebp - 0x458]
push eax
call fcn.004509a5
mov eax, dword [ebp - 0x470]
test eax, eax
je 0x452967
sub esi, eax
and esi, 0xfffffffc
push esi
push eax
call fcn.00404196
pop ecx
pop ecx
mov esi, dword [ebp - 0x458]
test esi, esi
je 0x4529d4
push 0x18
mov edi, esi
pop ebx
jmp 0x452981
mov ecx, edi
call fcn.00403bdf
add edi, ebx
cmp edi, dword [ebp - 0x454]
jne 0x452978
mov eax, dword [ebp - 0x450]
sub eax, esi
mov dword [ebp - 0x448], esi
cdq
idiv ebx
imul eax, eax, 0x18
mov dword [ebp - 0x44c], eax
cmp eax, 0x1000
jb 0x4529cb
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x448]
push eax
call fcn.00403184
mov esi, dword [ebp - 0x448]
mov eax, dword [ebp - 0x44c]
pop ecx
pop ecx
push eax
push esi
call fcn.00458ecf
pop ecx
pop ecx
mov eax, dword [ebp - 0x460]
call fcn.00458f11
ret