Function at 0x40ba70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44bc1e
mov eax, dword fs:[0]
push eax
sub esp, 0x314
mov eax, dword [0x461c88]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0x22c
push eax
lea eax, [ebp - 0x258]
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x254], 0x22c
call fcn.0040a410
add esp, 0xc
push 0
push 2
mov byte [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x254]
push eax
push ebx
mov dword [ebp - 0x25c], ebx
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x40bc2b
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x40bc2b
sub esp, 0x18
mov edx, esp
xor eax, eax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [ebp - 0x230], ax
je 0x40bb4f
lea eax, [ebp - 0x230]
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bb40
sub eax, esi
sar eax, 1
push eax
lea eax, [ebp - 0x230]
push eax
mov ecx, edx
call fcn.004026b0
lea eax, [ebp - 0x28]
push eax
call fcn.0040a340
add esp, 0x1c
cmp dword [ebp + 0x1c], 0x10
mov ecx, eax
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
mov ebx, dword [ecx + 0x10]
jb 0x40bb82
mov ecx, dword [ecx]
mov edi, dword [ebp + 0x18]
cmp ebx, edi
mov edx, edi
cmovb edx, ebx
test edx, edx
je 0x40bbe5
sub edx, 4
jb 0x40bba6
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x40bbab
add ecx, 4
add esi, 4
sub edx, 4
jae 0x40bb95
cmp edx, 0xfffffffc
je 0x40bbdf
mov al, byte [ecx]
cmp al, byte [esi]
jne 0x40bbd8
cmp edx, 0xfffffffd
je 0x40bbdf
mov al, byte [ecx + 1]
cmp al, byte [esi + 1]
jne 0x40bbd8
cmp edx, 0xfffffffe
je 0x40bbdf
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x40bbd8
cmp edx, 0xffffffff
je 0x40bbdf
mov al, byte [ecx + 3]
cmp al, byte [esi + 3]
je 0x40bbdf
sbb eax, eax
or eax, 1
jmp 0x40bbe1
xor eax, eax
test eax, eax
jne 0x40bbf7
cmp ebx, edi
jae 0x40bbee
or eax, 0xffffffff
jmp 0x40bbf5
xor eax, eax
cmp ebx, edi
setne al
test eax, eax
sete bl
cmp dword [ebp - 0x14], 0x10
jb 0x40bc0b
push dword [ebp - 0x28]
call fcn.00419e3e
add esp, 4
test bl, bl
jne 0x40bc71
mov ebx, dword [ebp - 0x25c]
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x40bb10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push dword [ebp - 0x258]
call fcn.0041a5c4
add esp, 4
cmp dword [ebp + 0x1c], 0x10
jb 0x40bc53
push dword [ebp + 8]
call fcn.00419e3e
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041a5c9
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x320]
call fcn.004066b0
lea ecx, [ebp + 8]
push ecx
push 0x44fb34
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00407fa0
push eax
call fcn.004038c0
add esp, 8
push eax
call fcn.004035d0
add esp, 8
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 1
call fcn.00406a00
push dword [ebp - 0x24c]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
jmp 0x40bc34