Function at 0x4b2200
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d079a
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x806f14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], 0
mov dword [ebp - 4], 0
call fcn.004bf7f0
push 0
push 2
mov dword [ebp - 0x294], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, eax
mov dword [ebp - 0x2c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x28c], ecx
xor eax, eax
movq qword [ebp - 0x34], xmm0
xor esi, esi
mov dword [ebp - 0x290], eax
xor edi, edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
cmp ecx, 0xffffffff
jne 0x4b2298
xor bl, bl
jmp 0x4b27b3
lea eax, [ebp - 0x280]
mov dword [ebp - 0x280], 0x22c
push eax
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4b27a5
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b22e0
sub ecx, edx
lea eax, [ebp - 0x25c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0049f660
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edx, 8
mov eax, dword [ebp - 0x18]
cmovae ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebp - 0x288], ecx
cmp eax, 0xb
jb 0x4b2355
add eax, 0xfffffff6
lea edx, [ecx + eax*2]
mov eax, ecx
mov dword [ebp - 0x284], edx
nop
mov ecx, edx
sub ecx, eax
sar ecx, 1
je 0x4b2352
nop dword [eax + eax]
cmp word [eax], 0x41
je 0x4b24d2
add eax, 2
sub ecx, 1
jne 0x4b2340
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x4b238d
lea edx, [edx*2 + 2]
mov eax, ebx
cmp edx, 0x1000
jb 0x4b2383
mov ebx, dword [ebx - 4]
add edx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b2834
push edx
push ebx
call fcn.0066c54d
add esp, 8
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 0x28c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4b22c0
mov ebx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x288], ebx
cmp ebx, edi
je 0x4b27a3
push dword [ebp - 0x2a0]
mov eax, edi
sub eax, ebx
sar eax, 2
push eax
push edi
push ebx
call fcn.004b0450
add esp, 0x10
mov dword [ebp - 0x284], ebx
mov esi, ebx
nop dword [eax + eax]
push dword [esi]
call fcn.004c0230
add esp, 4
cmp eax, dword [ebp - 0x294]
jne 0x4b260a
push dword [esi]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x29c], ebx
test ebx, ebx
je 0x4b2606
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
xorps xmm0, xmm0
push ebx
movlpd qword [ebp - 0x3c], xmm0
call fcn.004b1b00
mov esi, dword [ebp - 0x28]
add esp, 8
test al, al
je 0x4b25aa
mov ecx, dword [ebp + 0x20]
mov edx, ecx
cmp dword [ecx + 0x14], 0x10
jb 0x4b2458
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push edx
push dword [ebp - 0x18]
cmovae eax, esi
push eax
call fcn.0049e980
add esp, 0x10
test eax, eax
jne 0x4b25aa
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x4b2634
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp edx, 0x10
jb 0x4b25e1
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4b24cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b2834
push edx
push ecx
jmp 0x4b25d9
mov edx, 0x72c274
mov edi, eax
mov esi, 0xb
sub edi, edx
mov cx, word [edx + edi]
cmp cx, word [edx]
jne 0x4b2550
add edx, 2
sub esi, 1
jne 0x4b24e0
sub eax, dword [ebp - 0x288]
sar eax, 1
cmp eax, 0xffffffff
je 0x4b2352
lea eax, [ebp - 0x278]
push eax
call fcn.004acb80
add esp, 4
test al, al
je 0x4b255e
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp eax, 8
jb 0x4b238d
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4b254a
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b2834
push ecx
jmp 0x4b2384
mov edx, dword [ebp - 0x284]
add eax, 2
jmp 0x4b2330
lea eax, [ebp - 0x278]
push eax
call fcn.004acb90
add esp, 4
test al, al
jne 0x4b2515
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x290]
je 0x4b258c
mov eax, dword [ebp - 0x278]
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x30], ecx
jmp 0x4b2515
lea eax, [ebp - 0x278]
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.004af3c0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x290], eax
jmp 0x4b2515
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp eax, 0x10
jb 0x4b25e1
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x4b25d7
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b2834
push ecx
push esi
call fcn.0066c54d
add esp, 8
push ebx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x284]
jmp 0x4b260a
mov byte [ebp - 4], 1
add esi, 4
mov dword [ebp - 0x284], esi
cmp esi, edi
jne 0x4b23e0
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x288]
xor bl, bl
jmp 0x4b27b3
mov eax, dword [ebp - 0x3c]
mov ebx, 0xe57a42bd
mul ebx
mov edi, 0xd6bf94d5
mov dword [ebp - 0x298], eax
mov esi, edx
mov eax, dword [ebp - 0x3c]
mul edi
mov edi, eax
mov dword [ebp - 0x294], edx
mov eax, dword [ebp - 0x38]
mul ebx
mov ebx, edx
mov ecx, eax
mov eax, dword [ebp - 0x38]
mov edx, 0xd6bf94d5
mul edx
add ecx, esi
mov dword [ebp - 0x284], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [ebp - 0x294]
adc ecx, 0
mov dword [ebp - 0x2a8], edi
xor eax, eax
add ebx, ecx
mov ecx, dword [ebp - 0x284]
adc eax, eax
add ecx, ebx
adc edx, eax
shrd ecx, edx, 0x17
shr edx, 0x17
sub ecx, 0xb6109100
mov dword [ebp - 0x298], ecx
lea ecx, [ebp - 0x28]
sbb edx, 2
mov dword [ebp - 0x294], edx
call fcn.00489140
push dword [ebp - 0x29c]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x2a0]
mov eax, dword [ebx + 0x10]
lea esi, [ebx + 0x10]
test eax, eax
je 0x4b2786
inc eax
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x29c], 1
call fcn.004aed20
push 1
push 0x72c1a8
lea ecx, [ebp - 0x28]
call fcn.0049bb50
cmp dword [ebx + 0x14], 0x10
jb 0x4b272c
mov ebx, dword [ebx]
push dword [esi]
lea ecx, [ebp - 0x28]
push ebx
call fcn.0049bb50
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp + 8]
push eax
call fcn.0049bb50
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp edx, 0x10
jb 0x4b2786
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4b277c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b2834
push edx
push ecx
call fcn.0066c54d
add esp, 8
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x298]
push eax
call fcn.004b2840
mov esi, dword [ebp - 0x288]
add esp, 8
mov bl, al
jmp 0x4b27b3
mov esi, ebx
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
test esi, esi
je 0x4b27e6
mov ecx, dword [ebp - 0x290]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4b27dc
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b2834
push ecx
push esi
call fcn.0066c54d
add esp, 8
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x4b2816
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4b280c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b2834
push edx
push ecx
call fcn.0066c54d
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c50c
mov esp, ebp
pop ebp
ret
call fcn.0068bce4
int3