Function at 0x47edbf
Capabilities:
Enumerate processes

Disassembly:
push 0x234
mov eax, 0x5cf49b
call fcn.00506dfb
mov esi, 0x22c
lea eax, [ebp - 0x23c]
push esi
xor edi, edi
push edi
push eax
call fcn.0056b050
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x23c], esi
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x47f472
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.00413f09
and dword [ebp - 4], 0
lea ecx, [ebp - 0x240]
push 0x606228
call fcn.0042e69b
test eax, eax
je 0x47f446
push 0x606244
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f446
push 0x6062e8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f441
push 0x606304
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f441
push 0x606370
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f43c
push 0x606394
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f43c
push 0x606404
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f437
push 0x606460
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f437
push 0x6064ec
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f432
push 0x606510
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f432
push 0x606584
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f432
push 0x606600
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f42d
push 0x606644
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f42d
push 0x60675c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f428
push 0x606780
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f428
push 0x6067fc
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f420
push 0x606818
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f420
push 0x60685c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x47efd8
or edi, 0x100
jmp 0x47f449
push 0x606904
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x47eff7
or edi, 0x200
jmp 0x47f449
push 0x6069b0
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x47f016
or edi, 0x400
jmp 0x47f449
push 0x606a60
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x47f035
or edi, 0x800
jmp 0x47f449
push 0x606b84
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f418
push 0x606c00
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f418
push 0x606d28
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f410
push 0x606d98
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f410
push 0x606e34
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f410
push 0x606e84
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f410
push 0x606ed8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x47f0e4
or edi, 0x4000
jmp 0x47f449
push 0x606fbc
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x47f103
or edi, 0x8000
jmp 0x47f449
push 0x60710c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f408
push 0x60712c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f408
push 0x60714c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f408
push 0x60717c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f400
push 0x6071a8
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f400
push 0x6071c0
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f400
push 0x6071f4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3f8
push str.avastui.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3f8
push str.avgui.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3f0
push str.avgwdsvc.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3f0
push str.avgidsagent.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3f0
push str.mpmon.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3e8
push str.mpsvc.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3e8
push 0x5ff6e4
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3e0
push str.dwengine.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3e0
push str.dwservice.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3e0
push str.clamtray.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3d8
push 0x5ff788
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3d8
push str.avkservice.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3d0
push str.avktray.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3d0
push 0x5ff81c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3c8
push 0x5ff838
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3c8
push str.fsorsp.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3c8
push str.twssrv.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3bd
push 0x5ff89c
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3bd
push str.dgservice.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3b2
push str.drivergenius.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3b2
push 0x5ff918
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
je 0x47f3a7
push str.drivethelife.exe
lea ecx, [ebp - 0x240]
call fcn.0042e69b
test eax, eax
jne 0x47f449
or edi, 0x8000000
jmp 0x47f449
or edi, 0x4000000
jmp 0x47f449
or edi, 0x2000000
jmp 0x47f449
or edi, 0x1000000
jmp 0x47f449
or edi, 0x800000
jmp 0x47f449
or edi, 0x400000
jmp 0x47f449
or edi, 0x200000
jmp 0x47f449
or edi, 0x100000
jmp 0x47f449
or edi, 0x80000
jmp 0x47f449
or edi, 0x40000
jmp 0x47f449
or edi, 0x20000
jmp 0x47f449
or edi, 0x10000
jmp 0x47f449
or edi, 0x2000
jmp 0x47f449
or edi, 0x1000
jmp 0x47f449
or edi, 0x80
jmp 0x47f449
or edi, 0x40
jmp 0x47f449
or edi, 0x20
jmp 0x47f449
or edi, 0x10
jmp 0x47f449
or edi, 8
jmp 0x47f449
or edi, 4
jmp 0x47f449
or edi, 2
jmp 0x47f449
or edi, 1
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
mov ecx, dword [ebp - 0x240]
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test esi, esi
jne 0x47ee0b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.00506da5
ret