Function at 0x4633c0
Capabilities:
Enumerate processes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e057d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x388
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x38
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.004c13c0
lea ecx, [ebp - 0x90]
call fcn.0046e3c0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov esi, dword [ebp - 0x80]
mov eax, 4
push 0
movdqa xmmword [ebp - 0x90], xmm0
push 0xf
mov word [ebp - 0x82], ax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x328], edi
cmp edi, 0xffffffff
jne 0x463465
mov ecx, 0x5243e8
call fcn.00458190
xor edi, edi
jmp 0x463ce2
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x2f0], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x463499
mov ecx, str.acquireProcessListing:_Process32First_failed_n
call fcn.00458190
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x463ce2
mov edx, 3
lea ecx, [edx + 0x10]
mov eax, dword [ebp - 0x2e8]
xorps xmm0, xmm0
movdqa xmmword [ebp - 0x30], xmm0
mov word [ebp - 0x22], dx
mov word [ebp - 0x360], cx
mov dword [ebp - 0x358], eax
lea eax, [ebp - 0x360]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x320]
call fcn.00454f70
mov byte [ebp - 4], 5
mov edi, dword [eax]
test edi, edi
je 0x4634f5
cmp dword [edi + 4], 0
jne 0x4634f0
push dword [edi]
call fcn.004baaf0
mov dword [edi + 4], eax
mov ecx, dword [edi + 4]
jmp 0x4634f7
xor ecx, ecx
push esi
sub esp, 8
xorps xmm0, xmm0
cmp byte [ecx], 0
mov edx, esp
movdqa xmmword [ebp - 0x310], xmm0
mov eax, ecx
je 0x463516
nop
inc eax
cmp byte [eax], 0
jne 0x463510
sub eax, ecx
mov dword [edx], ecx
lea ecx, [ebp - 0x310]
mov dword [edx + 4], eax
call fcn.0046fbb0
xorps xmm0, xmm0
mov eax, 0x405
movdqa xmmword [ebp - 0x300], xmm0
mov word [ebp - 0x2f2], ax
mov dword [ebp - 0x2f8], 0x5244c4
mov dword [ebp - 0x300], 3
push esi
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0x30]
call fcn.0046e5e0
mov edi, dword [ebp - 0x320]
test edi, edi
je 0x4635c7
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4635bd
test edi, edi
je 0x4635bd
mov eax, dword [edi]
test eax, eax
je 0x46359d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x4635b4
push eax
call fcn.004bb0e1
add esp, 4
mov dword [edi + 4], 0
push edi
call fcn.004bae6f
add esp, 4
mov dword [ebp - 0x320], 0
lea eax, [ebp - 0x360]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, 0x13
mov word [ebp - 0x340], ax
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x340]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x314]
call fcn.00454f70
mov byte [ebp - 4], 0xb
mov edi, dword [eax]
test edi, edi
je 0x463621
cmp dword [edi + 4], 0
jne 0x46361c
push dword [edi]
call fcn.004baaf0
mov dword [edi + 4], eax
mov ecx, dword [edi + 4]
jmp 0x463623
xor ecx, ecx
push esi
sub esp, 8
xorps xmm0, xmm0
cmp byte [ecx], 0
mov edx, esp
movdqa xmmword [ebp - 0x310], xmm0
mov eax, ecx
je 0x463646
jmp 0x463640
inc eax
cmp byte [eax], 0
jne 0x463640
sub eax, ecx
mov dword [edx], ecx
lea ecx, [ebp - 0x310]
mov dword [edx + 4], eax
call fcn.0046fbb0
xorps xmm0, xmm0
mov eax, 0x405
movdqa xmmword [ebp - 0x300], xmm0
mov word [ebp - 0x2f2], ax
mov dword [ebp - 0x2f8], str.Threads
mov dword [ebp - 0x300], 7
push esi
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0x30]
call fcn.0046e5e0
mov edi, dword [ebp - 0x314]
test edi, edi
je 0x4636f7
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4636ed
test edi, edi
je 0x4636ed
mov eax, dword [edi]
test eax, eax
je 0x4636cd
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x4636e4
push eax
call fcn.004bb0e1
add esp, 4
mov dword [edi + 4], 0
push edi
call fcn.004bae6f
add esp, 4
mov dword [ebp - 0x314], 0
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, 0x13
mov word [ebp - 0x350], ax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x31c]
call fcn.00454f70
mov byte [ebp - 4], 0x11
mov edi, dword [eax]
test edi, edi
je 0x463751
cmp dword [edi + 4], 0
jne 0x46374c
push dword [edi]
call fcn.004baaf0
mov dword [edi + 4], eax
mov ecx, dword [edi + 4]
jmp 0x463753
xor ecx, ecx
push esi
sub esp, 8
xorps xmm0, xmm0
cmp byte [ecx], 0
mov edx, esp
movdqa xmmword [ebp - 0x310], xmm0
mov eax, ecx
je 0x463776
jmp 0x463770
inc eax
cmp byte [eax], 0
jne 0x463770
sub eax, ecx
mov dword [edx], ecx
lea ecx, [ebp - 0x310]
mov dword [edx + 4], eax
call fcn.0046fbb0
xorps xmm0, xmm0
mov eax, 0x405
movdqa xmmword [ebp - 0x300], xmm0
mov word [ebp - 0x2f2], ax
mov dword [ebp - 0x2f8], str.Parent
mov dword [ebp - 0x300], 6
push esi
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0x30]
call fcn.0046e5e0
mov edi, dword [ebp - 0x31c]
test edi, edi
je 0x463827
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x46381d
test edi, edi
je 0x46381d
mov eax, dword [edi]
test eax, eax
je 0x4637fd
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x463814
push eax
call fcn.004bb0e1
add esp, 4
mov dword [edi + 4], 0
push edi
call fcn.004bae6f
add esp, 4
mov dword [ebp - 0x31c], 0
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x324]
call fcn.00454d50
mov byte [ebp - 4], 0x16
mov edi, dword [eax]
test edi, edi
je 0x463869
cmp dword [edi + 4], 0
jne 0x463864
push dword [edi]
call fcn.004baaf0
mov dword [edi + 4], eax
mov ecx, dword [edi + 4]
jmp 0x46386b
xor ecx, ecx
push esi
sub esp, 8
xorps xmm0, xmm0
cmp byte [ecx], 0
mov edx, esp
movdqa xmmword [ebp - 0x310], xmm0
mov eax, ecx
je 0x463889
inc eax
cmp byte [eax], 0
jne 0x463883
sub eax, ecx
mov dword [edx], ecx
lea ecx, [ebp - 0x310]
mov dword [edx + 4], eax
call fcn.0046fbb0
xorps xmm0, xmm0
mov eax, 0x405
movdqa xmmword [ebp - 0x300], xmm0
mov word [ebp - 0x2f2], ax
mov dword [ebp - 0x2f8], 0x5244d8
mov dword [ebp - 0x300], 4
push esi
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0x30]
call fcn.0046e5e0
mov edi, dword [ebp - 0x324]
test edi, edi
je 0x46393a
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x463930
test edi, edi
je 0x463930
mov eax, dword [edi]
test eax, eax
je 0x463910
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x463927
push eax
call fcn.004bb0e1
add esp, 4
mov dword [edi + 4], 0
push edi
call fcn.004bae6f
add esp, 4
mov dword [ebp - 0x324], 0
xorps xmm0, xmm0
mov eax, 0x405
movdqa xmmword [ebp - 0x300], xmm0
mov word [ebp - 0x2f2], ax
mov dword [ebp - 0x2f8], 0x5244e0
mov dword [ebp - 0x300], 1
movdqa xmmword [ebp - 0x310], xmm0
mov word [ebp - 0x302], ax
mov dword [ebp - 0x308], str.MemorySize
mov dword [ebp - 0x310], 0xa
push esi
lea eax, [ebp - 0x300]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x30]
call fcn.0046e5e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x398]
mov edx, dword [ebp - 0x2e8]
push esi
call fcn.00462d10
add esp, 4
mov dword [ebp - 0x32c], eax
mov byte [ebp - 4], 0x1f
mov ecx, dword [eax]
mov edx, dword [eax + 8]
shl ecx, 5
add ecx, edx
cmp edx, ecx
setne al
test al, al
je 0x463b16
lea edi, [edx + 0x10]
mov dword [ebp - 0x318], edi
jmp 0x4639f0
mov edx, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], edx
jb 0x463abd
test edx, edx
jne 0x463a98
mov ecx, dword [esi]
mov dword [ebp - 0x2c], 0x10
test ecx, ecx
je 0x463a1d
mov eax, dword [ecx + 4]
add eax, 0x200
cmp eax, dword [ecx]
jbe 0x463a6e
mov edi, 0x200
cmp dword [esi + 4], edi
cmova edi, dword [esi + 4]
cmp dword [esi + 0xc], 0
jne 0x463a4a
push 1
call fcn.004bb090
add esp, 4
test eax, eax
je 0x463a42
mov byte [eax], 0
jmp 0x463a44
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea eax, [edi + 0xc]
test eax, eax
je 0x463a8b
push eax
call fcn.004bb5d5
add esp, 4
test eax, eax
je 0x463a8b
mov dword [eax], edi
mov dword [eax + 4], 0
mov ecx, dword [esi]
mov dword [eax + 8], ecx
mov dword [esi], eax
mov ecx, dword [esi]
mov edi, dword [ebp - 0x318]
mov eax, dword [ecx + 4]
lea edx, [ecx + 0xc]
add edx, eax
add eax, 0x200
mov dword [ecx + 4], eax
mov dword [ebp - 0x28], edx
jmp 0x463ac0
mov edi, dword [ebp - 0x318]
xor edx, edx
mov dword [ebp - 0x28], edx
jmp 0x463ac0
lea eax, [edx + 1]
mov ecx, edx
shr eax, 1
add edx, eax
shl ecx, 5
mov dword [ebp - 0x2c], edx
shl edx, 5
push edx
push ecx
push dword [ebp - 0x28]
mov ecx, esi
call fcn.0046fd00
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x463ac0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
movdqu xmm0, xmmword [edi - 0x10]
mov ecx, dword [ebp - 0x32c]
shl eax, 5
movdqu xmmword [eax + edx], xmm0
xor eax, eax
mov word [edi - 2], ax
mov eax, dword [ebp - 0x30]
movdqu xmm0, xmmword [edi]
shl eax, 5
movdqu xmmword [eax + edx + 0x10], xmm0
xor eax, eax
mov word [edi + 0xe], ax
add edi, 0x20
inc dword [ebp - 0x30]
mov eax, dword [ecx]
shl eax, 5
add eax, dword [ecx + 8]
lea ecx, [edi - 0x10]
cmp ecx, eax
mov dword [ebp - 0x318], edi
setne al
test al, al
jne 0x4639f0
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x384]
test edi, edi
je 0x463b3f
mov ecx, edi
call fcn.0046fc50
push dword [edi + 0x10]
call fcn.004bae6f
add esp, 4
push edi
call fcn.004bae6f
add esp, 4
push dword [ebp - 0x378]
call fcn.004bae83
add esp, 4
push dword [ebp - 0x37c]
call fcn.004bae6f
mov edx, dword [ebp - 0x90]
add esp, 4
mov ecx, dword [ebp - 0x8c]
cmp edx, ecx
jb 0x463bac
test ecx, ecx
jne 0x463b74
lea edi, [ecx + 0x10]
jmp 0x463b7f
lea edi, [ecx + 1]
shr edi, 1
add edi, ecx
cmp edi, ecx
jbe 0x463bac
mov eax, edi
shl ecx, 4
shl eax, 4
push eax
push ecx
push dword [ebp - 0x88]
mov ecx, esi
call fcn.0046fd00
mov edx, dword [ebp - 0x90]
mov ecx, eax
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x8c], edi
jmp 0x463bb2
mov ecx, dword [ebp - 0x88]
movdqu xmm0, xmmword [ebp - 0x30]
mov edi, dword [ebp - 0x328]
mov eax, edx
add eax, eax
inc edx
mov dword [ebp - 0x90], edx
movdqu xmmword [ecx + eax*8], xmm0
xor eax, eax
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x2f0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov ecx, 0x13
lea edx, [ecx - 0x10]
test eax, eax
jne 0x4634a1
xorps xmm0, xmm0
movq qword [ebp - 0x40], xmm0
movdqa xmmword [ebp - 0x50], xmm0
movdqa xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0x100
push 0x30
lea eax, [ebp - 0xc0]
push 0
push eax
call fcn.004c13c0
add esp, 4
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0xc0]
push eax
call fcn.0046f370
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x90]
call fcn.00471b80
push 0x561208
push 0x561418
push str._S__s_processes.log.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [ebp - 0x44]
add esp, 0x14
mov esi, ecx
sub esi, dword [ebp - 0x48]
lea eax, [ecx + 1]
cmp eax, dword [ebp - 0x40]
jbe 0x463c87
push 1
lea ecx, [ebp - 0x50]
call fcn.00474eb0
mov ecx, dword [ebp - 0x44]
mov eax, ecx
inc ecx
mov dword [ebp - 0x44], ecx
mov ecx, 0x547d60
push esi
mov byte [eax], 0
mov edx, dword [ebp - 0x48]
dec dword [ebp - 0x44]
call fcn.00457d50
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xb4]
mov edi, 1
call fcn.004bae83
add esp, 4
push dword [ebp - 0xb8]
call fcn.004bae6f
add esp, 4
push dword [ebp - 0x48]
call fcn.004bae83
add esp, 4
push dword [ebp - 0x4c]
call fcn.004bae6f
add esp, 4
mov esi, dword [ebp - 0x7c]
test esi, esi
je 0x463d04
mov ecx, esi
call fcn.0046fc50
push dword [esi + 0x10]
call fcn.004bae6f
add esp, 4
push esi
call fcn.004bae6f
add esp, 4
push dword [ebp - 0x70]
call fcn.004bae83
add esp, 4
push dword [ebp - 0x74]
call fcn.004bae6f
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret