Function at 0x480960
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be9ee
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x228
lea eax, [ebp - 0x254]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 2
mov dword [ebp - 0x258], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x260], esi
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 4], 0
call fcn.00480870
add esp, 4
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x480c69
mov ebx, dword [0x55cb48]
mov dword [ebp - 0x25c], ebx
lea edx, [ebp - 0x258]
push edx
push esi
mov byte [ebp - 4], 2
call sub.KERNEL32.dll_Process32FirstW
lea esp, [esp]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebx - 0xc], 1
lea edi, [ebx - 0xc]
mov esi, eax
jg 0x480a1d
cmp esi, dword [ebx - 4]
jle 0x480a5e
add ebx, 0xfffffff4
cmp ebx, dword [0x55c608]
je 0x480a48
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x480a3c
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
mov ecx, dword [0x55cb48]
mov dword [ebp - 0x25c], ecx
push esi
lea ecx, [ebp - 0x25c]
call fcn.00435470
mov ebx, dword [ebp - 0x25c]
test eax, eax
je 0x480a82
lea edi, [esi + esi]
lea edx, [edi + 2]
cmp edx, edi
jb 0x480a79
push edi
lea eax, [ebp - 0x234]
push eax
push ebx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
xor ecx, ecx
mov dword [ebx - 8], esi
mov word [edi + ebx], cx
mov ecx, 0x4c7da0
mov eax, ebx
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480ab6
test dx, dx
je 0x480ab2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480ab6
add eax, 4
add ecx, 4
test dx, dx
jne 0x480a90
xor eax, eax
jmp 0x480abb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x480be1
mov ecx, 0x4c7d80
mov eax, ebx
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480af6
test dx, dx
je 0x480af2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480af6
add eax, 4
add ecx, 4
test dx, dx
jne 0x480ad0
xor eax, eax
jmp 0x480afb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x480be1
mov ecx, 0x4c7d90
mov eax, ebx
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480b36
test dx, dx
je 0x480b32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480b36
add eax, 4
add ecx, 4
test dx, dx
jne 0x480b10
xor eax, eax
jmp 0x480b3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x480be1
mov ecx, 0x4c7d68
mov eax, ebx
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480b76
test dx, dx
je 0x480b72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480b76
add eax, 4
add ecx, 4
test dx, dx
jne 0x480b50
xor eax, eax
jmp 0x480b7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x480be1
mov ecx, dword [ebp - 0x2c]
mov edi, 8
cmp dword [ebp - 0x18], edi
jae 0x480b8f
lea ecx, [ebp - 0x2c]
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480bb7
test dx, dx
je 0x480bb3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480bb7
add eax, 4
add ecx, 4
test dx, dx
jne 0x480b91
xor eax, eax
jmp 0x480bbc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x480c3d
mov edx, dword [ebp - 0x250]
push edx
call fcn.004857a0
add esp, 4
test eax, eax
js 0x480c3d
cmp eax, 4
jle 0x480cbd
cmp eax, 0xd
jmp 0x480c37
mov ecx, dword [ebp - 0x2c]
mov edi, 8
cmp dword [ebp - 0x18], edi
jae 0x480bf1
lea ecx, [ebp - 0x2c]
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480c19
test dx, dx
je 0x480c15
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480c19
add eax, 4
add ecx, 4
test dx, dx
jne 0x480bf3
xor eax, eax
jmp 0x480c1e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x480cbd
mov eax, dword [ebp - 0x250]
push eax
call fcn.00485f50
add esp, 4
test eax, eax
je 0x480cbd
mov edx, dword [ebp - 0x260]
lea ecx, [ebp - 0x258]
push ecx
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x480a00
lea ecx, [ebp - 0x25c]
call fcn.00419630
mov esi, dword [ebp - 0x260]
cmp dword [ebp - 0x18], 8
jb 0x480c7b
mov eax, dword [ebp - 0x2c]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
test esi, esi
je 0x480c9f
cmp esi, 0xffffffff
je 0x480c9f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
lea eax, [ebx - 0xc]
cmp eax, dword [0x55c608]
je 0x480cdf
lea esi, [ebx - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x480cdf
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
cmp dword [ebp - 0x18], edi
jb 0x480cf0
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x260]
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
test eax, eax
je 0x480d15
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x480ca1