Function at 0x419990
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.SetupWhitelist_started
push 1
push dword [0x50a534]
xor eax, eax
mov edi, ecx
mov dword [ebp - 0xa0c], eax
call fcn.004429d0
push dword [0x50a534]
call fcn.004426d0
lea ebx, [edi + 0x55f0]
add esp, 0x10
mov dword [ebp - 0xa14], ebx
test ebx, ebx
je 0x4199ff
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4199e5
sub ecx, edx
je 0x4199ff
mov dword [ebp - 0xa0c], ebx
mov byte [ebp - 0xa01], 0x7c
jmp 0x419a34
cmp dword [edi + 0x454], 0
je 0x419a28
push str.SAFE
push 0x67
mov ecx, 0x51cdb8
call fcn.00410cc0
mov dword [ebp - 0xa0c], eax
mov byte [ebp - 0xa01], 0xa
jmp 0x419a34
mov al, byte [ebp - 0xa01]
mov byte [ebp - 0xa01], al
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
call esi
push eax
push dword [0x50a534]
call fcn.00441be0
add esp, 0xc
mov dword [ebp - 0xa08], 0
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
call esi
mov ecx, dword [ebp - 0xa08]
mov dword [edi + ecx*4 + 0xdd54], eax
inc dword [ebp - 0xa08]
cmp ebx, 0xffffffff
je 0x419b52
lea eax, [ebp - 0xa00]
mov dword [ebp - 0xa00], pe_nt_image_headers32
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x419b4b
cmp dword [ebp - 0x9e8], 0
je 0x419b36
push 0x41b090
push 4
lea eax, [ebp - 0xa08]
push eax
lea esi, [edi + 0xdd54]
lea eax, [ebp - 0x9e8]
push esi
push eax
call fcn.00455194
add esp, 0x14
test eax, eax
je 0x419b36
push 0x41b090
push 4
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0x9f8]
push esi
push eax
call fcn.00455194
add esp, 0x14
test eax, eax
jne 0x419b36
mov ecx, dword [ebp - 0xa08]
mov eax, dword [ebp - 0x9f8]
push 0
mov dword [edi + ecx*4 + 0xdd54], eax
push dword [ebp - 0x9f8]
inc dword [ebp - 0xa08]
push dword [0x50a534]
call fcn.00441be0
add esp, 0xc
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0xa00]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x419aa2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.after_AddSafeProcess
push 1
push dword [0x50a534]
call fcn.004429d0
mov esi, dword [ebp - 0xa0c]
add esp, 0xc
test esi, esi
je 0x419ca4
push str.safeList_not_equal_to_null
push 1
push dword [0x50a534]
call fcn.004429d0
movsx eax, byte [ebp - 0xa01]
mov ebx, esi
push eax
push esi
mov dword [ebp - 0xa10], eax
call fcn.00457087
add esp, 0x14
mov dword [ebp - 0xa08], eax
test eax, eax
je 0x419c00
mov ecx, eax
sub ecx, ebx
cmp byte [eax - 1], 0xd
lea eax, [ebp - 0x108]
lea esi, [ecx - 1]
cmovne esi, ecx
push esi
push ebx
push 0x104
push eax
call fcn.004565d1
add esp, 0x10
cmp esi, 0x104
jae 0x419cb5
mov ebx, dword [ebp - 0xa08]
push dword [ebp - 0xa10]
inc ebx
mov byte [ebp + esi - 0x108], 0
push ebx
call fcn.00457087
add esp, 8
mov dword [ebp - 0xa08], eax
jmp 0x419c17
push ebx
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0044c498
add esp, 0xc
xor ebx, ebx
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419c20
sub ecx, edx
je 0x419c42
lea eax, [ebp - 0x108]
push eax
push 0
push dword [0x50a534]
call fcn.00441be0
add esp, 0xc
lea eax, [ebp - 0x8d8]
mov ecx, edi
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004154a0
mov esi, eax
xor edx, edx
test esi, esi
jle 0x419c7f
nop
mov ecx, dword [edi + 0xdc34]
mov eax, dword [ebp + edx*4 - 0x8d8]
inc edx
mov dword [edi + ecx*4 + 0xd464], eax
inc dword [edi + 0xdc34]
cmp edx, esi
jl 0x419c60
test ebx, ebx
je 0x419c8e
mov eax, dword [ebp - 0xa08]
jmp 0x419ba6
cmp dword [ebp - 0xa14], 0
jne 0x419ca4
mov eax, dword [ebp - 0xa0c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004465ed
mov esp, ebp
pop ebp
ret
call fcn.00446a02
int3