Function at 0x596820
Capabilities:
Enumerate processes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0
push 2
mov dword [ebp - 0x304], edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov eax, dword [edi + 0xbc]
cmp eax, 0xffffffff
je 0x59686e
test eax, eax
je 0x59686e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0xbc], esi
test esi, esi
jne 0x596897
mov dword [edi + 0xbc], 0xffffffff
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
cmp esi, 0xffffffff
je 0x596882
push 0x228
lea eax, [ebp - 0x2a4]
push 0
push eax
call fcn.00420090
add esp, 0xc
mov dword [ebp - 0x2a8], 0x22c
lea eax, [ebp - 0x2a8]
xor ebx, ebx
mov dword [ebp - 0x2f4], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x596a62
nop word [eax + eax]
mov eax, dword [ebp - 0x2a0]
cmp eax, 4
jb 0x596a41
push eax
push 0
mov ecx, edi
call fcn.00596680
inc dword [edi + 0x14]
mov esi, eax
test esi, esi
js 0x596966
lea eax, [esi + 1]
cmp dword [edi + 0xb0], esi
ja 0x596913
mov dword [edi + 0xb0], eax
mov ecx, dword [edi + 0xb8]
lea eax, [esi*8]
sub eax, esi
shl eax, 3
add ecx, eax
mov dword [ebp - 0x300], eax
lea eax, [ebp - 0x284]
add ecx, 0x28
push eax
call fcn.005dc4c0
test al, al
je 0x596966
cmp dword [edi + 0xb0], esi
ja 0x596951
lea eax, [esi + 1]
mov dword [edi + 0xb0], eax
mov eax, dword [edi + 0xb8]
mov ecx, dword [ebp - 0x300]
mov byte [ecx + eax], 1
jmp 0x596a41
push 0
push ebx
mov ecx, edi
call fcn.00596680
mov ebx, eax
lea esi, [edi + 0xb0]
lea ecx, [ebx + 1]
mov dword [ebp - 0x2f4], ecx
cmp dword [esi], ebx
ja 0x5969b9
mov eax, dword [esi + 4]
cmp ecx, eax
jb 0x5969a8
test eax, eax
je 0x5969a3
add eax, eax
push eax
push ecx
mov ecx, esi
call fcn.004037f0
mov ecx, dword [ebp - 0x2f4]
jmp 0x5969bf
mov eax, 1
push eax
push ecx
mov ecx, esi
call fcn.004037f0
mov ecx, dword [ebp - 0x2f4]
jmp 0x5969bf
mov dword [ebp - 0x2f4], ecx
cmp dword [esi], ebx
ja 0x5969c5
mov dword [esi], ecx
mov eax, dword [esi + 8]
lea edx, [ebx*8]
sub edx, ebx
shl edx, 3
mov byte [edx + eax], 1
cmp dword [edi + 0xb0], ebx
ja 0x5969e6
mov dword [edi + 0xb0], ecx
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x2a0]
mov dword [edx + ecx + 4], eax
cmp dword [edi + 0xb0], ebx
ja 0x596a07
mov eax, dword [ebp - 0x2f4]
mov dword [edi + 0xb0], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x290]
mov dword [edx + ecx + 8], eax
cmp dword [edi + 0xb0], ebx
ja 0x596a25
lea eax, [ebx + 1]
mov dword [edi + 0xb0], eax
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x284]
add ecx, 0x28
push eax
add ecx, edx
call fcn.005dc510
push ebx
mov ecx, edi
call fcn.005978f0
lea eax, [ebp - 0x2a8]
push eax
push dword [edi + 0xbc]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x5968e0
mov dword [ebp - 0x2f4], ebx
mov eax, dword [edi + 0xb0]
mov dword [ebp - 0x300], eax
lea esi, [eax - 1]
test esi, esi
js 0x596ac0
lea ecx, [esi*8]
sub ecx, esi
shl ecx, 3
mov dword [ebp - 0x2f8], ecx
cmp dword [edi + 0xb0], esi
ja 0x596a98
lea eax, [esi + 1]
mov dword [edi + 0xb0], eax
mov eax, dword [edi + 0xb8]
cmp byte [ecx + eax], 1
jbe 0x596ab2
push esi
mov ecx, edi
call fcn.00596700
mov ecx, dword [ebp - 0x2f8]
sub ecx, 0x38
sub esi, 1
mov dword [ebp - 0x2f8], ecx
jns 0x596a87
push 0
push 0
push 0x1004
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [edi + 0x74]
mov dword [edi + 0x10], eax
call fcn.005dc190
xorps xmm0, xmm0
mov dword [ebp - 0x2fc], eax
push 0
push 0
lea ecx, [edi + 0x5c]
mov byte [ebp - 0x2e9], 1
push 0x1e
mov dword [ebp - 0x2e0], 0
movlpd qword [ebp - 0x2d8], xmm0
movlpd qword [ebp - 0x2cc], xmm0
movlpd qword [ebp - 0x2c4], xmm0
movlpd qword [ebp - 0x2bc], xmm0
movlpd qword [ebp - 0x2b4], xmm0
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2dc], 5
mov dword [ebp - 0x2e4], 1
call fcn.005db9a0
cmp dword [edi + 0xc], 4
mov dword [ebp - 0x2d0], eax
jne 0x596b82
xorps xmm1, xmm1
lea ecx, [edi + 0x1090]
call fcn.005d05a0
comisd xmm0, xmmword [0x6edbf0]
jbe 0x596b82
lea ecx, [edi + 0x1090]
mov byte [ebp - 0x2ea], 1
call fcn.005d05f0
jmp 0x596b89
mov byte [ebp - 0x2ea], 0
mov eax, dword [edi + 0x10]
test eax, eax
je 0x596c7b
add eax, 0xffffffff
mov dword [ebp - 0x2e8], eax
js 0x596c7b
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x308], eax
lea ecx, [edi + 0x5c]
call fcn.005dc380
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2e0], eax
lea eax, [ebp - 0x2e4]
push eax
push 0
push 0x104b
push dword [edi]
mov dword [ebp - 0x2cc], 0x1e
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [edi + 0x5c]
call fcn.005dafe0
cmp dword [ebp - 0x300], 0
mov dword [ebp - 0x2f0], eax
je 0x596c59
mov esi, dword [ebp - 0x308]
test esi, esi
js 0x596c59
mov ecx, dword [edi + 0xb8]
lea eax, [esi*8]
sub eax, esi
mov dword [ebp - 0x2f8], ecx
shl eax, 3
nop dword [eax]
mov ecx, dword [edi + 0xb0]
lea edx, [esi + 1]
cmp ecx, esi
ja 0x596c35
mov ecx, edx
mov dword [edi + 0xb0], edx
mov edi, dword [ebp - 0x2f8]
mov ebx, dword [ebp - 0x2f0]
cmp ebx, dword [eax + edi + 4]
mov edi, dword [ebp - 0x304]
je 0x596f8a
sub eax, 0x38
sub esi, 1
jns 0x596c20
push 0
push dword [ebp - 0x2e8]
push 0x1008
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
sub dword [ebp - 0x2e8], 1
jns 0x596bb0
mov ebx, dword [ebp - 0x300]
sub ebx, 1
js 0x5972d8
lea eax, [ebx*8]
sub eax, ebx
lea esi, [ebx + 1]
shl eax, 3
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x2f4], esi
mov edx, dword [edi + 0xb0]
cmp edx, ebx
ja 0x596cb7
mov dword [edi + 0xb0], esi
mov edx, esi
mov eax, dword [edi + 0xb8]
mov ecx, dword [ebp - 0x2e8]
cmp dword [ecx + eax + 4], 4
jb 0x5972c1
cmp edx, ebx
ja 0x596cd8
mov dword [edi + 0xb0], esi
mov eax, dword [edi + 0xb8]
cmp byte [ecx + eax], 1
ja 0x5972c1
push ebx
mov ecx, edi
call fcn.005976c0
test al, al
jne 0x596d1e
cmp dword [edi + 0xb0], ebx
ja 0x596d02
mov dword [edi + 0xb0], esi
mov ecx, dword [ebp - 0x2e8]
push 0
push dword [ebp - 0x2fc]
add ecx, 0x28
add ecx, dword [edi + 0xb8]
call fcn.005d8a30
cmp byte [ebp + 8], 0
je 0x596d42
push 0
push 1
push 1
push 0
push dword [ebp - 0x2fc]
lea ecx, [edi + 0x50]
call fcn.005daa70
test eax, eax
jne 0x5972c1
mov ecx, dword [edi]
mov edx, 0x186a0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x2fc]
call fcn.005caa40
mov dword [ebp - 0x2f0], eax
cmp eax, 0xffffffff
je 0x5972c1
cmp dword [edi + 0xb0], ebx
ja 0x596d75
mov dword [edi + 0xb0], esi
mov eax, dword [edi + 0xb8]
mov ecx, dword [ebp - 0x2e8]
push dword [ebp - 0x2fc]
mov byte [ebp - 0x2e9], 0
mov byte [ecx + eax], 2
lea ecx, [edi + 0xc8]
call fcn.005e9660
push dword [edi + 0x20]
lea ecx, [edi + 0xc8]
push 0x624804
call fcn.005e98f0
mov edx, dword [ebp - 0x2f0]
mov ecx, dword [edi]
push eax
push 1
call fcn.005ca650
mov edx, dword [ebp - 0x2f0]
mov ecx, dword [edi]
push 0x62f10c
push 3
call fcn.005ca650
mov esi, dword [ebp - 0x2f4]
cmp dword [edi + 0xb0], ebx
ja 0x596de8
mov dword [edi + 0xb0], esi
mov eax, dword [edi + 0xb8]
mov ecx, dword [ebp - 0x2e8]
push dword [eax + ecx + 4]
lea ecx, [edi + 0x5c]
call fcn.005db290
lea ecx, [edi + 0x5c]
call fcn.005dc190
mov edx, dword [ebp - 0x2f0]
mov ecx, dword [edi]
push eax
push 5
call fcn.005ca650
cmp dword [edi + 0xb0], ebx
ja 0x596e26
mov dword [edi + 0xb0], esi
mov ecx, dword [edi + 0xb8]
add ecx, 0x28
add ecx, dword [ebp - 0x2e8]
call fcn.005dc190
mov edx, dword [ebp - 0x2f0]
mov ecx, dword [edi]
push eax
push 6
call fcn.005ca650
cmp dword [edi + 0xb0], ebx
ja 0x596e58
mov dword [edi + 0xb0], esi
mov eax, dword [edi + 0xb8]
mov ecx, dword [ebp - 0x2e8]
push dword [eax + ecx + 8]
lea ecx, [edi + 0x5c]
call fcn.005db290
lea ecx, [edi + 0x5c]
call fcn.005dc190
mov edx, dword [ebp - 0x2f0]
mov ecx, dword [edi]
push eax
push 7
call fcn.005ca650
mov edx, dword [ebp - 0x2f0]
mov ecx, dword [edi]
push 0
push dword [ebp - 0x2fc]
call fcn.005ca7a0
mov edx, dword [edi + 0xb0]
cmp edx, ebx
ja 0x596eaf
mov dword [edi + 0xb0], esi
mov edx, esi
mov eax, dword [edi + 0xb8]
mov ecx, dword [ebp - 0x2e8]
mov eax, dword [eax + ecx + 0x34]
cmp eax, 0xffffffff
je 0x597291
test eax, eax
je 0x597291
cmp edx, ebx
ja 0x596eda
mov dword [edi + 0xb0], esi
mov eax, dword [edi + 0xb8]
add eax, ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push dword [eax + 0x34]
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x596f6f
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [edi + 0xb0], ebx
ja 0x596f17
mov dword [edi + 0xb0], esi
mov esi, dword [ebp - 0x2e8]
mov eax, dword [edi + 0xb8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax + esi + 0x10], ecx
mov ecx, esi
mov esi, dword [ebp - 0x2f4]
mov dword [eax + ecx + 0x14], edx
cmp dword [edi + 0xb0], ebx
ja 0x596f47
mov dword [edi + 0xb0], esi
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2e8]
mov eax, dword [edi + 0xb8]
mov ecx, dword [ebp - 0x1c]
adc ecx, dword [ebp - 0x14]
mov dword [eax + esi + 0x18], edx
mov edx, esi
mov esi, dword [ebp - 0x2f4]
mov dword [eax + edx + 0x1c], ecx
push ebx
mov ecx, edi
call fcn.00597470
push dword [ebp - 0x2f0]
mov ecx, edi
push ebx
call fcn.005975d0
jmp 0x5972c1
cmp ecx, esi
ja 0x596f94
mov dword [edi + 0xb0], edx
mov eax, dword [edi + 0xb8]
lea ecx, [esi*8]
sub ecx, esi
shl ecx, 3
cmp byte [ebp + 8], 0
mov dword [ebp - 0x2f8], ecx
mov byte [ecx + eax], 2
je 0x596ff8
mov edx, dword [ebp - 0x2e8]
mov ecx, dword [edi]
push 0x1000
push dword [ebp - 0x2fc]
push 0
call fcn.005ca570
test eax, eax
je 0x596ff2
push 0
push 1
push 1
push 0
push dword [ebp - 0x2fc]
lea ecx, [edi + 0x50]
call fcn.005daa70
test eax, eax
jne 0x596c59
mov ecx, dword [ebp - 0x2f8]
mov eax, dword [edi + 0xc]
cmp eax, 1
je 0x597009
cmp eax, 4
jne 0x596c6e
cmp dword [edi + 0xb0], esi
ja 0x59701a
lea eax, [esi + 1]
mov dword [edi + 0xb0], eax
mov eax, dword [edi + 0xb8]
add eax, ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push dword [eax + 0x34]
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x59724e
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [edi + 0xb0]
cmp edx, esi
ja 0x597060
lea edx, [esi + 1]
mov dword [edi + 0xb0], edx
mov eax, dword [edi + 0xb8]
lea ecx, [esi*8]
mov ebx, dword [ebp - 0x10]
sub ecx, esi
mov dword [ebp - 0x2f8], ebx
sub ebx, dword [eax + ecx*8 + 0x10]
mov dword [ebp - 0x318], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x2f0], ebx
sbb ebx, dword [eax + ecx*8 + 0x14]
mov dword [ebp - 0x314], ebx
mov ebx, dword [ebp - 0x2f4]
cmp edx, esi
ja 0x5970a8
lea eax, [esi + 1]
mov dword [edi + 0xb0], eax
mov eax, dword [edi + 0xb8]
lea ecx, [esi*8]
mov edx, dword [ebp - 0x2f8]
sub ecx, esi
mov dword [eax + ecx*8 + 0x10], edx
mov edx, dword [ebp - 0x2f0]
mov dword [eax + ecx*8 + 0x14], edx
mov edx, dword [edi + 0xb0]
cmp edx, esi
ja 0x5970de
lea edx, [esi + 1]
mov dword [edi + 0xb0], edx
mov eax, dword [edi + 0xb8]
lea ecx, [esi*8]
mov edi, dword [ebp - 0x20]
sub ecx, esi
mov dword [ebp - 0x30c], edi
sub edi, dword [eax + ecx*8 + 0x18]
mov dword [ebp - 0x2f8], edi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x2f0], edi
sbb edi, dword [eax + ecx*8 + 0x1c]
mov ecx, dword [ebp - 0x18]
add dword [ebp - 0x2f8], ecx
adc edi, dword [ebp - 0x14]
mov dword [ebp - 0x310], edi
mov edi, dword [ebp - 0x304]
cmp edx, esi
ja 0x597132
lea eax, [esi + 1]
mov dword [edi + 0xb0], eax
mov eax, dword [ebp - 0x30c]
lea edx, [esi*8]
add eax, ecx
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x314]
adc dword [ebp - 0x2f0], ecx
sub edx, esi
mov ecx, dword [edi + 0xb8]
push dword [ebp - 0x318]
mov dword [ecx + edx*8 + 0x18], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ecx + edx*8 + 0x1c], eax
mov ecx, 0x2710
mov eax, dword [ebp - 0x310]
mul ecx
mov edx, 0x2710
mov ecx, eax
mov eax, dword [ebp - 0x2f8]
mul edx
add ecx, edx
push ecx
push eax
call fcn.0042fc60
mov ecx, eax
call fcn.005e9cd0
imul eax, dword [edi + 0x1c], 0x64
movaps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x6ede90]
divsd xmm1, xmm0
comisd xmm1, xmmword [0x6edb88]
jbe 0x5971c4
xorps xmm1, xmm1
lea ecx, [edi + 0x68]
call fcn.005db690
push 4
push 1
push 1
push 1
push 0x624288
lea ecx, [edi + 0x68]
call fcn.005daa70
test eax, eax
je 0x5971ef
inc eax
lea ecx, [edi + 0x68]
push eax
call fcn.005dae00
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x628f7c
lea ecx, [edi + 0x68]
call fcn.005da780
lea ecx, [edi + 0x68]
call fcn.005dc190
mov edx, dword [ebp - 0x2e8]
mov ecx, dword [edi]
push eax
push 3
call fcn.005ca650
cmp byte [ebp - 0x2ea], 0
je 0x59723b
push ebx
mov ecx, edi
call fcn.00597470
push dword [ebp - 0x2e8]
mov ecx, edi
push esi
call fcn.005975d0
jmp 0x596c6e
mov edx, dword [ebp - 0x2e8]
mov ecx, dword [edi]
push 0x62f10c
push 3
call fcn.005ca650
push ecx
push 0
push 0
push 0x186a0
lea ecx, [edi + 0x68]
call fcn.005daea0
lea ecx, [edi + 0x68]
call fcn.005dc190
mov edx, dword [ebp - 0x2e8]
mov ecx, dword [edi]
push eax
push 4
call fcn.005ca650
jmp 0x596c6e
push ecx
push 0
push 0
push 0x2710
lea ecx, [edi + 0x68]
call fcn.005daea0
lea ecx, [edi + 0x68]
call fcn.005dc190
mov edx, dword [ebp - 0x2f0]
mov ecx, dword [edi]
push eax
push 4
call fcn.005ca650
mov esi, dword [ebp - 0x2f4]
sub dword [ebp - 0x2e8], 0x38
dec esi
sub ebx, 1
mov dword [ebp - 0x2f4], esi
jns 0x596ca5
push 0
push 0
push 0x1004
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [ebp + 0xc]
mov dword [edi + 0x10], eax
test ebx, ebx
jns 0x5972fe
mov ecx, dword [edi]
xor edx, edx
call fcn.005c9840
mov ebx, eax
cmp byte [ebp - 0x2e9], 0
sete al
inc al
mov byte [ebp - 0x2ea], al
mov eax, dword [edi + 0xc]
cmp eax, 1
je 0x597321
cmp eax, 4
jne 0x5973c1
push dword [edi + 4]
call dword [sym.imp.pdh.dll_PdhCollectQueryData]
lea eax, [ebp - 0x38]
push eax
push 0
push 0x200
push dword [edi + 8]
call dword [sym.imp.pdh.dll_PdhGetFormattedCounterValue]
movsd xmm1, qword [ebp - 0x30]
lea ecx, [edi + 0x68]
call fcn.005db690
push 4
push 1
push 1
push 1
push 0x624288
lea ecx, [edi + 0x68]
call fcn.005daa70
test eax, eax
je 0x59736e
inc eax
lea ecx, [edi + 0x68]
push eax
call fcn.005dae00
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x628f7c
lea ecx, [edi + 0x68]
call fcn.005dc190
push eax
push str.CPU
lea ecx, [edi + 0x68]
call fcn.005dc200
lea ecx, [edi + 0x68]
call fcn.005dc190
mov ecx, dword [edi]
mov edx, 3
push eax
call fcn.005ca6a0
cmp ebx, 3
je 0x5973ba
cmp ebx, 4
jne 0x5973c1
mov byte [ebp - 0x2e9], 0
cmp dword [edi + 0xc], 0
jne 0x597425
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push dword [ebp - 0x74]
lea ecx, [edi + 0x68]
call fcn.005db290
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x628f7c
lea ecx, [edi + 0x68]
call fcn.005dc190
push eax
push str.RAM
lea ecx, [edi + 0x68]
call fcn.005dc200
lea ecx, [edi + 0x68]
call fcn.005dc190
mov ecx, dword [edi]
mov edx, 4
push eax
call fcn.005ca6a0
mov eax, dword [edi + 0xc]
inc eax
mov dword [edi + 0xc], eax
cmp eax, 5
jbe 0x597438
mov dword [edi + 0xc], 0
cmp byte [ebp - 0x2e9], 0
jne 0x59744c
mov ecx, dword [edi]
mov edx, ebx
push 0xfffffffffffffffe
call fcn.005c8de0
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x2ea]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8