Function at 0x45dc75
Capabilities:
Enumerate processes

Disassembly:
push 0x798
mov eax, 0x479a5e
call fcn.0046e476
mov eax, dword [ebp + 8]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7a0], eax
lea eax, [ebp - 0x658]
push eax
call fcn.00461579
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x658]
cmp dword [ebp - 0x644], 8
lea edx, [ebp - 0x658]
mov eax, dword [ebp - 0x648]
cmovae ecx, dword [ebp - 0x658]
push dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmovae edx, dword [ebp - 0x658]
push edx
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x658]
cmovae ecx, dword [ebp - 0x658]
lea eax, [ebp - 0x7a4]
push ecx
push eax
call fcn.00456913
add esp, 0x18
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x45df27
lea eax, [ebp - 0x798]
mov dword [ebp - 0x798], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
push 0x410
mov esi, eax
lea eax, [ebp - 0x628]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
test esi, esi
je 0x45df24
push dword [ebp - 0x790]
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45df05
push 0x208
lea eax, [ebp - 0x628]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
xor eax, eax
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x630], eax
mov word [ebp - 0x640], ax
lea eax, [ebp - 0x628]
push eax
mov dword [ebp - 0x62c], 7
call fcn.0040bf40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x640]
cmp dword [ebp - 0x62c], 8
lea edx, [ebp - 0x640]
mov eax, dword [ebp - 0x630]
cmovae ecx, dword [ebp - 0x640]
push dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmovae edx, dword [ebp - 0x640]
push edx
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x640]
cmovae ecx, dword [ebp - 0x640]
lea eax, [ebp - 0x7a4]
push ecx
push eax
call fcn.00456913
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
lea ecx, [ebp - 0x218]
cmovae eax, dword [ebp - 0x640]
xor edx, edx
push edx
push edx
push 0x104
push ecx
push edx
push edx
push edx
push edx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
xor eax, eax
lea ecx, [ebp - 0x670]
add esp, 0x44
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x660], eax
mov word [ebp - 0x670], ax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x65c], 7
call fcn.0040bf40
mov byte [ebp - 4], 2
lea eax, [ebp - 0x658]
cmp dword [ebp - 0x644], 8
lea ecx, [ebp - 0x640]
push 0
cmovae eax, dword [ebp - 0x658]
push eax
call fcn.0040eec0
cmp eax, 0xffffffff
je 0x45dee4
mov eax, dword [ebp - 0x79c]
cmp dword [eax], 0
jne 0x45dec4
lea eax, [ebp - 0x670]
push eax
call fcn.00462373
pop ecx
mov ecx, dword [ebp - 0x79c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x7a0]
cmp dword [eax], 0
jne 0x45dee4
lea eax, [ebp - 0x670]
push eax
call fcn.00461c63
pop ecx
mov ecx, dword [ebp - 0x7a0]
mov dword [ecx], eax
push esi
call ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x670]
call fcn.0040bbd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x640]
call fcn.0040bbd0
lea eax, [ebp - 0x798]
mov dword [ebp - 0x798], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x45dd45
push edi
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x658]
call fcn.0040bbd0
call fcn.0046e420
ret