Function at 0x41ecb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x680
mov eax, dword [0x52e474]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x41ecd0
xor eax, eax
jmp 0x41ef62
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004938a0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x414], dx
push 0x206
push 0
lea eax, [ebp - 0x412]
push eax
call fcn.004938a0
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x660], ecx
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x64c], edx
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x678], eax
mov ecx, dword [ebp - 0x660]
mov dx, word [ecx]
mov word [ebp - 0x646], dx
mov eax, dword [ebp - 0x64c]
mov cx, word [ebp - 0x646]
mov word [eax], cx
mov edx, dword [ebp - 0x660]
add edx, 2
mov dword [ebp - 0x660], edx
mov eax, dword [ebp - 0x64c]
add eax, 2
mov dword [ebp - 0x64c], eax
cmp word [ebp - 0x646], 0
jne 0x41ed2f
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0049d0b3
add esp, 4
mov dword [ebp - 0x66c], eax
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x640], 0
push 0x228
push 0
lea edx, [ebp - 0x63c]
push edx
call fcn.004938a0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0xffffffff
jne 0x41eddf
xor eax, eax
jmp 0x41ef62
mov dword [ebp - 0x640], 0x22c
lea eax, [ebp - 0x640]
push eax
mov ecx, dword [ebp - 0x644]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41ef53
lea edx, [ebp - 0x61c]
mov dword [ebp - 0x664], edx
lea eax, [ebp - 0x414]
mov dword [ebp - 0x650], eax
mov ecx, dword [ebp - 0x650]
mov dword [ebp - 0x680], ecx
mov edx, dword [ebp - 0x664]
mov ax, word [edx]
mov word [ebp - 0x648], ax
mov ecx, dword [ebp - 0x650]
mov dx, word [ebp - 0x648]
mov word [ecx], dx
mov eax, dword [ebp - 0x664]
add eax, 2
mov dword [ebp - 0x664], eax
mov ecx, dword [ebp - 0x650]
add ecx, 2
mov dword [ebp - 0x650], ecx
cmp word [ebp - 0x648], 0
jne 0x41ee28
lea edx, [ebp - 0x414]
push edx
call fcn.0049d0b3
add esp, 4
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x658], eax
mov ecx, dword [ebp - 0x670]
mov dword [ebp - 0x654], ecx
mov edx, dword [ebp - 0x654]
mov ax, word [edx]
mov word [ebp - 0x65a], ax
mov ecx, dword [ebp - 0x658]
cmp ax, word [ecx]
jne 0x41ef03
cmp word [ebp - 0x65a], 0
je 0x41eef7
mov edx, dword [ebp - 0x654]
mov ax, word [edx + 2]
mov word [ebp - 0x65c], ax
mov ecx, dword [ebp - 0x658]
cmp ax, word [ecx + 2]
jne 0x41ef03
add dword [ebp - 0x654], 4
add dword [ebp - 0x658], 4
cmp word [ebp - 0x65c], 0
jne 0x41ee9d
mov dword [ebp - 0x668], 0
jmp 0x41ef0e
sbb edx, edx
or edx, 1
mov dword [ebp - 0x668], edx
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jne 0x41ef38
mov ecx, dword [ebp - 0x644]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x638]
jmp 0x41ef62
lea edx, [ebp - 0x640]
push edx
mov eax, dword [ebp - 0x644]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41ee04
mov ecx, dword [ebp - 0x644]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491b3a
mov esp, ebp
pop ebp
ret