Function at 0x43b4a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab140
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x622330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
mov ebx, dword [ebp + 0x1c]
mov edx, 0x5f698f
mov eax, dword [edi]
cmp ebx, 0x10
mov esi, dword [ebp + 8]
cmovae ecx, esi
mov dword [edi + 4], eax
push 0
call fcn.00405e40
add esp, 4
test eax, eax
jne 0x43b506
cmp dword [ebp + 0x18], eax
setne al
test eax, eax
sete al
test al, al
jne 0x43b6f1
lea edx, [ebp + 8]
lea ecx, [ebp - 0x40]
call fcn.004209a0
push 0
push 2
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x28c], eax
push ecx
push eax
mov dword [ebp - 0x288], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x43b6bc
lea edx, [ebp - 0x264]
lea ecx, [ebp - 0x58]
call fcn.004208f0
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.004209a0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x30]
mov esi, ebx
cmovae edx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
cmp ecx, ebx
cmovb esi, ecx
test esi, esi
je 0x43b5f3
sub esi, 4
jb 0x43b5b1
lea ecx, [ecx]
mov ecx, dword [eax]
cmp ecx, dword [edx]
jne 0x43b5b6
add eax, 4
add edx, 4
sub esi, 4
jae 0x43b5a0
cmp esi, 0xfffffffc
je 0x43b5ea
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x43b5e3
cmp esi, 0xfffffffd
je 0x43b5ea
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x43b5e3
cmp esi, 0xfffffffe
je 0x43b5ea
mov cl, byte [eax + 2]
cmp cl, byte [edx + 2]
jne 0x43b5e3
cmp esi, 0xffffffff
je 0x43b5ea
mov al, byte [eax + 3]
cmp al, byte [edx + 3]
je 0x43b5ea
sbb eax, eax
or eax, 1
jmp 0x43b5ec
xor eax, eax
test eax, eax
jne 0x43b605
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
jae 0x43b5fc
or eax, 0xffffffff
jmp 0x43b603
xor eax, eax
cmp ecx, ebx
setne al
test eax, eax
sete al
test al, al
je 0x43b667
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x280]
cmp ecx, eax
jae 0x43b647
mov ecx, dword [edi]
lea edx, [ebp - 0x280]
cmp ecx, edx
ja 0x43b647
mov esi, edx
sub esi, ecx
sar esi, 2
cmp eax, dword [edi + 8]
jne 0x43b639
push ecx
mov ecx, edi
call fcn.0040a7b0
mov ecx, dword [edi + 4]
mov eax, dword [edi]
test ecx, ecx
je 0x43b663
mov eax, dword [eax + esi*4]
jmp 0x43b661
cmp eax, dword [edi + 8]
jne 0x43b654
push ecx
mov ecx, edi
call fcn.0040a7b0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x43b663
mov eax, dword [ebp - 0x280]
mov dword [ecx], eax
add dword [edi + 4], 4
lea eax, [ebp - 0x288]
push eax
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp dword [ebp - 0x14], 0x10
mov esi, eax
jb 0x43b68d
push dword [ebp - 0x28]
call fcn.004462c1
add esp, 4
mov byte [ebp - 4], 1
cmp dword [ebp - 0x44], 0x10
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jb 0x43b6b4
push dword [ebp - 0x58]
call fcn.004462c1
add esp, 4
test esi, esi
jne 0x43b550
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c], 0x10
jb 0x43b6d9
push dword [ebp - 0x40]
call fcn.004462c1
add esp, 4
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
cmp ebx, 0x10
jb 0x43b6ff
push esi
call fcn.004462c1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056bc55
mov esp, ebp
pop ebp
ret