Function at 0x406780
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff724
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x4bc4fc
call fcn.00479eb8
cmp dword [ebx + 0x31c], 0
je 0x406815
jmp 0x4067c8
xor edx, edx
mov eax, dword [ebx + 0x31c]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
je 0x4067bb
push eax
call fcn.00477a54
pop ecx
xor edx, edx
mov eax, dword [ebx + 0x31c]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebx + 0x31c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x4067a3
mov eax, dword [ebx + 0x31c]
mov edx, dword [eax]
call dword [edx + 0x44]
mov esi, dword [ebx + 0x31c]
mov dword [ebp - 8], esi
test esi, esi
je 0x40680d
mov eax, dword [esi]
mov dword [ebp - 4], eax
mov word [ebp - 0x48], 0x14
mov edx, 3
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x48], 8
xor edx, edx
mov dword [ebx + 0x31c], edx
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x406836
xor eax, eax
mov edx, dword [ebp - 0x58]
mov dword fs:[0], edx
jmp 0x406e44
push 0x128
push 0
lea ecx, [ebp - 0x198]
push ecx
call fcn.004798f8
add esp, 0xc
lea eax, [ebp - 0x198]
mov dword [ebp - 0x198], 0x128
push eax
push esi
call sub.KERNEL32.DLL_Process32First
test eax, eax
jne 0x40687e
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
mov edx, dword [ebp - 0x58]
mov dword fs:[0], edx
jmp 0x406e44
mov dl, 1
mov eax, dword [0x4305b4]
call fcn.00405594
mov edi, eax
mov dword [ebx + 0x31c], edi
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x44]
mov word [ebp - 0x48], 0x2c
lea edx, [ebp - 0x174]
lea eax, [ebp - 0xc]
call fcn.00488be4
inc dword [ebp - 0x3c]
mov word [ebp - 0x48], 0x20
cmp dword [ebp - 0xc], 0
je 0x406a0c
push 0xa18
call fcn.00477a88
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40696f
mov word [ebp - 0x48], 0x44
push 0x100
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.004798f8
add esp, 0xc
push 0x400
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x100
push ecx
call fcn.004798f8
add esp, 0xc
push 0x100
push 0
mov eax, dword [ebp - 0x10]
add eax, 0x518
push eax
call fcn.004798f8
add esp, 0xc
push 0x400
push 0
mov edx, dword [ebp - 0x10]
add edx, 0x618
push edx
call fcn.004798f8
add esp, 0xc
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov dword [ecx + 0x500], eax
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov dword [edx + 0x504], ecx
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x50c], edx
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x508], 0
mov word [ebp - 0x48], 0x38
mov edi, dword [ebp - 0x10]
jmp 0x406972
mov edi, dword [ebp - 0x10]
mov word [ebp - 0x48], 0x20
mov word [ebp - 0x48], 0x50
xor eax, eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
inc dword [ebp - 0x3c]
call fcn.0048901c
cmp dword [ebp - 0x14], 0
je 0x40699c
mov edx, dword [ebp - 0x14]
jmp 0x4069a1
mov edx, 0x4ba37c
push esi
push edi
mov esi, edi
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 2
and ecx, 3
lea eax, [ebp - 0x14]
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
dec dword [ebp - 0x3c]
call fcn.00488dd0
mov word [ebp - 0x48], 0x5c
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x190]
call fcn.00488d44
inc dword [ebp - 0x3c]
mov ecx, edi
mov edx, dword [eax]
mov eax, dword [ebx + 0x31c]
mov edi, dword [eax]
call dword [edi + 0x3c]
dec dword [ebp - 0x3c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00488dd0
dec dword [ebp - 0x3c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00488dd0
mov word [ebp - 0x48], 0
lea ecx, [ebp - 0x198]
push ecx
push esi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x406899
push esi
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
mov edx, dword [ebp - 0x58]
mov dword fs:[0], edx
jmp 0x406e44
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret