Function at 0x442c03
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c8
push 0x400
call fcn.0045d564
add esp, 4
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], 0xef59d06f
mov esi, dword [ebp - 0x74]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xc778b7
jg 0x442cb0
cmp eax, 0xb6d6d64b
jle 0x442d30
cmp eax, 0xc4d090b8
jle 0x442dde
cmp eax, 0xe8e81bb4
jg 0x442f2e
cmp eax, 0xd6222b19
jg 0x4431bc
cmp eax, 0xc4d090b9
je 0x44343c
cmp eax, 0xcd43b188
jne 0x442c5f
mov dword [ebp - 0x10], 0x7e9f9ac
jmp 0x442c5f
cmp eax, 0x34bd1267
jle 0x442d9b
cmp eax, 0x5e8005ca
jle 0x442e34
cmp eax, 0x7797d0ff
jg 0x442f75
cmp eax, 0x6c27be99
jg 0x443207
cmp eax, 0x5e8005cb
je 0x443481
cmp eax, 0x689ef95a
jne 0x442c5f
mov eax, dword [ebp - 0x18]
imul ecx, eax, 0xb5
imul eax, eax, 0x9e6
imul ecx, ecx
imul edx, ecx, 0x2c5
dec edx
mov dword [ebp - 0x18], eax
mov eax, 0xa657ae38
cmp ecx, edx
je 0x442d1c
mov eax, 0x99e1112f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x24], eax
jmp 0x442c5f
cmp eax, 0xa024d5ec
jg 0x442e65
cmp eax, 0x8cdc0694
jle 0x442fa2
cmp eax, 0x97d983c8
jg 0x44325a
cmp eax, 0x8cdc0695
je 0x443496
cmp eax, 0x8e86d708
jne 0x442c5f
mov eax, dword [ebp - 0x14]
mov ecx, 0xffffff12
add eax, ecx
shr eax, 4
imul ecx, eax, 0xeb
add ecx, 0xffff633d
mov dword [ebp - 0x14], ecx
mov eax, 0x7e9f9ac
cmp ecx, 0x27
jge 0x4437da
mov eax, 0xb6d6d64c
jmp 0x4437da
cmp eax, 0x156253e8
jg 0x442ed0
cmp eax, 0xa4f48d0
jle 0x443009
cmp eax, 0xe8c1cdc
jg 0x44328b
cmp eax, 0xa4f48d1
je 0x4434b4
cmp eax, 0xdb71b0c
jne 0x442c5f
mov dword [ebp - 0x10], 0x34461859
jmp 0x442c5f
cmp eax, 0xbdd66764
jle 0x44305c
cmp eax, 0xc281df7d
jg 0x4432e4
cmp eax, 0xbdd66765
je 0x4434cf
cmp eax, 0xc2169140
jne 0x442c5f
mov ecx, dword [ebp - 0x14]
shl ecx, 5
add ecx, 0xffffff2f
mov dword [ebp - 0x14], ecx
mov eax, 0xc778b8
cmp ecx, 0xa6
jae 0x4437da
mov eax, 0x8e86d708
jmp 0x4437da
cmp eax, 0x3c61ed52
jle 0x4430d3
cmp eax, 0x49764bbd
jg 0x44330c
cmp eax, 0x3c61ed53
je 0x4434db
cmp eax, 0x3e87969b
je 0x443641
jmp 0x442c5f
cmp eax, 0xa7fd4b9f
jle 0x44313e
cmp eax, 0xaf375a7c
jg 0x443361
cmp eax, 0xa7fd4ba0
je 0x4434f2
cmp eax, 0xa8f6b7d7
jne 0x442c5f
mov eax, dword [ebp - 0xa0]
add eax, eax
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push dword [ebp - 0x9c]
call fcn.0045d8c1
add esp, 8
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x64]
mov eax, 0x7cf7d653
cmp edx, ecx
ja 0x4437da
mov eax, 0x689ef95a
jmp 0x4437da
cmp eax, 0x26b24f9f
jle 0x443186
cmp eax, 0x2fcad01e
jg 0x4433a2
cmp eax, 0x26b24fa0
je 0x44350c
cmp eax, 0x26bf628f
jne 0x442c5f
push 0x1a
push 0x473130
push dword [ebp - 0x44]
call fcn.0044ce50
add esp, 0xc
push 6
push 0x47314a
push 0xd
push dword [ebp - 0x44]
call fcn.00443b20
add esp, 0x10
mov dword [ebp - 0x10], 0xa4f48d1
jmp 0x442c5f
cmp eax, 0xef59d06e
jg 0x4433cd
cmp eax, 0xe8e81bb5
je 0x443572
cmp eax, 0xed16efec
jne 0x442c5f
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_Process32NextW
mov ecx, 0xbdd66765
test eax, eax
je 0x443815
mov ecx, 0x156253e9
jmp 0x443815
cmp eax, 0x7cf7d652
jg 0x443405
cmp eax, 0x7797d100
je 0x443518
cmp eax, 0x78f4dec8
jne 0x442c5f
mov dword [ebp - 0x10], 0xff542261
jmp 0x442c5f
cmp eax, 0x817a5cc1
je 0x443550
cmp eax, 0x866a7d67
je 0x44357e
cmp eax, 0x88620ca7
jne 0x442c5f
mov eax, dword [ebp - 0x18]
mov ecx, 0xe4
add eax, ecx
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x3fb7
shl eax, 0xc
dec edx
mov dword [ebp - 0x18], eax
mov eax, 0xa024d5ed
cmp edx, ecx
je 0x442fed
mov eax, 0x8cdc0695
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x400
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
jmp 0x442c5f
cmp eax, 0xc778b8
je 0x4435b7
cmp eax, 0x7e9f9ac
je 0x4435de
cmp eax, 0x8a28675
jne 0x442c5f
mov eax, dword [ebp - 0x18]
lea ecx, [eax + 0x61]
imul ecx, ecx
imul edx, ecx, 0x57a3
dec edx
shl eax, 0xd
add eax, 0x26400a
mov dword [ebp - 0x18], eax
mov eax, 0x208df623
cmp edx, ecx
je 0x4437da
mov eax, 0x5e8005cb
jmp 0x4437da
cmp eax, 0xb6d6d64c
je 0x443613
cmp eax, 0xb8330b2f
je 0x443635
cmp eax, 0xb8477b3b
jne 0x442c5f
push dword [ebp - 0x5c]
call fcn.0045ddaa
add esp, 4
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
add eax, eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
add eax, 4
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x58]
sub ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x64]
mov eax, 0x2fcad01f
cmp edx, ecx
ja 0x4430b3
mov eax, 0x99e1112f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x28], eax
jmp 0x442c5f
cmp eax, 0x34bd1268
je 0x443650
cmp eax, 0x39e54118
je 0x443670
cmp eax, 0x3a3440c1
jne 0x442c5f
mov ebx, dword [ebp - 0x14]
add ebx, 0xffffff8d
mov edi, ebx
shr edi, 8
mov dword [ebp - 0x14], edi
push edi
call fcn.0043da88
add esp, 4
push edi
push 0x5c6a
push 0x1230
push 0x31fd
call fcn.00443a00
add esp, 0x10
mov eax, 0x1430721b
cmp ebx, 0xba00
jae 0x4437da
mov eax, 0xd6222b1a
jmp 0x4437da
cmp eax, 0xa024d5ed
je 0x4436b1
cmp eax, 0xa129cc60
je 0x4436dc
cmp eax, 0xa657ae38
jne 0x442c5f
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, 0xb8330b2f
cmp ecx, 0xffffffff
je 0x4437da
mov eax, 0xdbe08cdf
jmp 0x4437da
cmp eax, 0x156253e9
je 0x443853
cmp eax, 0x18aa780c
je 0x443711
cmp eax, 0x208df623
jne 0x442c5f
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0xcd43b188
jmp 0x442c5f
cmp eax, 0xd6222b1a
je 0x44371d
cmp eax, 0xdbe08cdf
jne 0x442c5f
mov eax, dword [ebp - 0x18]
shr eax, 6
lea ecx, [eax + eax]
add ecx, 0xffffff42
mov edx, eax
imul edx, eax
imul edi, edx, 0x7b3d
dec edi
mov dword [ebp - 0x18], ecx
mov eax, 0xa657ae38
cmp edx, edi
je 0x4437da
mov eax, 0x26b24fa0
jmp 0x4437da
cmp eax, 0x6c27be9a
je 0x443735
cmp eax, 0x6c962797
jne 0x442c5f
imul edi, dword [ebp - 0x14], 0x11ac
mov eax, edi
shr eax, 7
mov dword [ebp - 0x14], eax
push 0x5287
push eax
push 0x1bf0
push 0x24e4
call fcn.00443b20
add esp, 0x10
mov eax, 0xb6d6d64c
cmp edi, 0x4b80
jb 0x4432da
jmp 0x4437da
cmp eax, 0x97d983c9
je 0x44374a
cmp eax, 0x99e1112f
jne 0x442c5f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0x208df623
jmp 0x442c5f
cmp eax, 0xe8c1cdd
je 0x443766
cmp eax, 0x1430721b
jne 0x442c5f
imul edi, dword [ebp - 0x14], 0x1e8000
add edi, 0x13c70000
mov eax, edi
shr eax, 1
mov dword [ebp - 0x14], eax
push 0x1c16
push 0x5b07
push 0x16aa
push eax
call fcn.00443a00
add esp, 0x10
mov eax, 0x208df623
test edi, edi
je 0x4437da
mov eax, 0x3c61ed53
jmp 0x4437da
cmp eax, 0xc281df7e
je 0x44377b
cmp eax, 0xc3e5584b
jne 0x442c5f
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0x10], 0x7f9054ae
jmp 0x442c5f
cmp eax, 0x49764bbe
je 0x4437b5
cmp eax, 0x59b395a8
jne 0x442c5f
mov edi, dword [ebp - 0x14]
shr edi, 0xf
add edi, 0xffffff7c
mov dword [ebp - 0x14], edi
push 0x53bb
push edi
push 0x3b2
push 0x5a9e
call fcn.00443b20
add esp, 0x10
call fcn.00408722
mov eax, 0xc2169140
cmp edi, 0x68
jae 0x4435d4
jmp 0x4437da
cmp eax, 0xaf375a7d
je 0x4437e2
cmp eax, 0xb19ba88c
jne 0x442c5f
mov ecx, dword [ebp - 0x14]
shl ecx, 8
and ecx, 0xfffe0000
or ecx, 0x82
mov dword [ebp - 0x14], ecx
mov eax, 0xd6222b1a
cmp ecx, 0xc5
jb 0x4435ad
jmp 0x4437da
cmp eax, 0x2fcad01f
je 0x44381d
cmp eax, 0x34461859
jne 0x442c5f
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0x3e87969b
jmp 0x442c5f
cmp eax, 0xef59d06f
je 0x44383b
cmp eax, 0xff542261
jne 0x442c5f
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x54], 0
mov eax, 0xa129cc60
je 0x4437da
mov eax, 0x8a28675
jmp 0x4437da
cmp eax, 0x7cf7d653
jne 0x443847
mov eax, dword [ebp - 0x18]
shl eax, 0x16
or eax, 0xc6
imul eax, eax, 0xe4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x2fcad01f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x2c], eax
jmp 0x442c5f
mov edi, dword [ebp - 0x14]
shl edi, 0x12
mov dword [ebp - 0x14], edi
push 0x1c3
push edi
push 0x169d
push 0x5d12
call fcn.00443a00
add esp, 0x10
push edi
push 0x202f
push 0x350c
push 0x636f
call fcn.00443a00
add esp, 0x10
mov dword [ebp - 0x10], 0x3c61ed53
jmp 0x442c5f
push eax
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], 0x6c27be9a
jmp 0x442c5f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0xe8e81bb5
jmp 0x442c5f
imul eax, dword [ebp - 0x18], 0xd200
add eax, 0xffb97400
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x34bd1268
jmp 0x442c5f
mov dword [ebp - 0x10], 0x78f4dec8
jmp 0x442c5f
cmp dword [ebp - 0x94], 0
mov eax, 0xdb71b0c
jne 0x4435d4
jmp 0x4437da
mov eax, dword [ebp - 0x18]
shl eax, 0xd
or eax, 0x16c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xd6222b1a
jmp 0x442c5f
mov dword [ebp - 0x10], 0xb6d6d64c
jmp 0x442c5f
imul edi, dword [ebp - 0x14], 0x8600
add edi, 0xffffe000
mov dword [ebp - 0x14], edi
push edi
push 0x613
push 0x181f
call fcn.0042bb48
add esp, 0xc
push edi
call fcn.0043da88
add esp, 4
mov dword [ebp - 0x10], 0x49764bbe
jmp 0x442c5f
mov eax, dword [ebp - 0x14]
shr eax, 2
and eax, 0x7ffff
imul eax, eax, 0xe0
add eax, 0x7d20
mov dword [ebp - 0x14], eax
push eax
call fcn.00442c03
add esp, 4
mov dword [ebp - 0x10], 0xb8477b3b
jmp 0x442c5f
mov edi, dword [ebp - 0x14]
shl edi, 0xb
and edi, 0x1ff800
lea eax, [edi*8]
lea eax, [eax + eax*4]
mov dword [ebp - 0x14], eax
push eax
call fcn.0043da88
add esp, 4
mov eax, 0x208df623
test edi, edi
je 0x4437da
mov eax, 0x7e9f9ac
jmp 0x4437da
mov ecx, dword [ebp - 0x14]
shr ecx, 5
and ecx, 0x3ffffff
mov dword [ebp - 0x14], ecx
mov eax, 0x3c61ed53
cmp ecx, 0x1e
jb 0x4437da
mov eax, 0xe8c1cdd
jmp 0x4437da
push dword [ebp - 0x50]
push dword [ebp - 0x5c]
push dword [ebp - 0x6c]
call fcn.0044ce50
add esp, 0xc
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x6c]
mov word [ecx + eax*2], 0xa
mov eax, dword [ebp - 0x48]
add eax, 2
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x10], 0xa7fd4ba0
jmp 0x442c5f
push 0x228
push 0
lea eax, [ebp - 0x2d0]
push eax
call fcn.0044d950
add esp, 0xc
mov dword [ebp - 0x10], 0xa024d5ed
jmp 0x442c5f
mov eax, dword [ebp - 0x18]
shl eax, 8
add eax, 0xfffffffe
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xc3e5584b
mov esi, dword [ebp - 0x4c]
jmp 0x442c5f
push dword [ebp - 0x54]
push dword [ebp - 0x20]
push dword [ebp - 0x44]
push dword [ebp + 8]
call fcn.004250fe
add esp, 0x10
mov dword [ebp - 0x10], 0x97d983c9
jmp 0x442c5f
imul edi, dword [ebp - 0x14], 0x2742
mov ebx, edi
shr ebx, 0xb
mov dword [ebp - 0x14], ebx
push 0x23e8
push 0xd0b
push ebx
call fcn.0042bb48
add esp, 0xc
push ebx
call fcn.00442c03
add esp, 4
mov eax, 0x3c61ed53
cmp edi, 0x57000
jae 0x4437ae
jmp 0x4437da
mov dword [ebp - 0x2d4], 0x22c
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x10], 0xaf375a7d
jmp 0x442c5f
mov eax, dword [ebp - 0x18]
shr eax, 9
imul ecx, eax, 0x110000
imul eax, eax
imul edx, eax, 0x6703
dec edx
shr ecx, 0xa
mov dword [ebp - 0x18], ecx
mov ecx, 0x817a5cc1
cmp edx, eax
je 0x443706
mov ecx, 0xc3e5584b
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp - 0x20]
jmp 0x442c5f
mov dword [ebp - 0x10], 0xa8f6b7d7
jmp 0x442c5f
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x98]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], 0xed16efec
jmp 0x442c5f
mov eax, dword [ebp - 0x44]
mov word [eax + 0x1a], 0
mov dword [ebp - 0x10], 0x26bf628f
jmp 0x442c5f
imul eax, dword [ebp - 0x18], 0x8a000
or eax, 0x74
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xc3e5584b
mov esi, dword [ebp - 0x20]
jmp 0x442c5f
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x10], 0x88620ca7
jmp 0x442c5f
imul eax, dword [ebp - 0x14], 0x3c0
shr eax, 7
imul edi, eax, 0x1f8
mov dword [ebp - 0x14], edi
push 0x3d6f
push 0x3a3a
push edi
call fcn.0042bb48
add esp, 0xc
mov eax, 0xa024d5ed
cmp edi, 0xfb
jae 0x4437da
mov eax, 0x208df623
jmp 0x4437da
imul edi, dword [ebp - 0x14], 0x6114
mov dword [ebp - 0x14], edi
push edi
call fcn.00442c03
add esp, 4
mov eax, 0xb19ba88c
cmp edi, 0xdd
jge 0x4437da
mov eax, 0x866a7d67
mov dword [ebp - 0x10], eax
jmp 0x442c5f
mov eax, dword [ebp - 0x18]
shr eax, 9
add eax, 0xfffffff8
shr eax, 7
imul ecx, eax, 0x4950
imul eax, eax
imul edx, eax, 0x7569
dec edx
add ecx, 0xffca71fc
mov dword [ebp - 0x18], ecx
mov ecx, 0xb6d6d64c
cmp edx, eax
je 0x443815
mov ecx, 0x3c61ed53
mov dword [ebp - 0x10], ecx
jmp 0x442c5f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x10], 0x18aa780c
jmp 0x442c5f
mov dword [ebp - 0x10], 0xa657ae38
jmp 0x442c5f
cmp eax, 0x7f9054ae
je 0x44387f
jmp 0x442c5f
mov eax, dword [ebp - 0x18]
shl eax, 0xc
and eax, 0xff000000
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x8cdc0695
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xa4]
jmp 0x442c5c
mov dword [ebp - 0x74], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x88], eax
push dword [ebp - 0xa8]
call fcn.0045d1bc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret