Function at 0x42af0e
Capabilities:
Enumerate processes

Disassembly:
push 0x47c
mov eax, 0x57eaf1
call fcn.0042c498
mov dword [ebp - 0x484], ecx
mov eax, dword [ebp + 8]
and dword [ebp - 0x488], 0
mov dword [ebp - 0x480], eax
call fcn.0043121f
test al, al
je 0x42af58
push eax
push eax
pop edi
push eax
pop ebp
pop ebx
pop ebx
pop edx
pop ecx
pop edi
pop edx
push eax
pop eax
push ecx
push esp
pop ebp
push ebp
pop esi
pop ecx
push esp
pop ebp
pop esp
push esi
push ebx
push edx
pop edi
push edx
push esi
and dword [ebp - 0x220], 0
lea ecx, [ebp - 0x230]
xor eax, eax
mov dword [ebp - 0x21c], 7
push eax
push 0x582524
mov word [ebp - 0x230], ax
call fcn.004202e4
and dword [ebp - 4], 0
call fcn.0043155b
test al, al
je 0x42afa0
push esi
push edi
push ebx
pop eax
push edi
pop ebp
push esp
push eax
pop ecx
pop edi
push ecx
pop edx
push esp
pop ebx
push esp
pop edx
push 0x22c
lea eax, [ebp - 0x474]
push 0
push eax
call fcn.0044ea80
add esp, 0xc
call fcn.004315e5
test al, al
je 0x42afd1
push esp
push esp
push ebp
push edi
push ecx
pop ebx
pop esi
pop esp
push eax
pop ebp
pop ebp
pop ecx
push ebp
push eax
pop edi
pop eax
pop ebp
push esp
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x47c], eax
cmp eax, 0xffffffff
jne 0x42affa
mov ecx, dword [ebp - 0x480]
push 0x582524
call fcn.0041fc8f
jmp 0x42b427
call fcn.00431378
test al, al
je 0x42b020
push ebp
push ecx
push edi
pop esi
pop ecx
pop eax
pop esp
push ebx
push edi
pop ecx
push ecx
pop esp
push ecx
push eax
push ebx
push edi
push ebp
push esp
push eax
push ebx
pop esp
push eax
pop ebx
pop esi
pop eax
push ebp
push esi
push ecx
push edx
call fcn.004315e5
test al, al
je 0x42b044
push esp
pop edx
push ebx
pop ebp
pop eax
pop ebp
push ecx
pop eax
push eax
push ecx
pop ebx
push edx
pop esi
push edx
pop esp
pop esp
push ebp
pop edx
pop ecx
push ebp
push eax
push edi
push esp
pop edi
push esi
push ecx
pop edi
mov dword [ebp - 0x474], 0x22c
call fcn.00431378
test al, al
je 0x42b06c
pop edx
pop ebp
pop eax
push ecx
pop edx
push edx
pop edi
push eax
pop ebx
push esp
pop esi
push ebp
pop eax
pop ebx
pop edi
pop eax
push ebx
push edx
push ebx
push edi
pop eax
call fcn.0043110b
test al, al
je 0x42b085
pop ecx
push ebp
pop ebp
push eax
pop ebp
pop ecx
push ebp
pop ecx
push edx
pop edi
pop edx
push eax
pop edx
pop edx
pop ecx
pop eax
call fcn.004316b4
test al, al
je 0x42b0a2
pop esi
push ecx
pop edx
pop edx
push ebx
pop ebx
pop ecx
push edx
pop esi
pop ebp
push esi
push esi
pop esi
push ebp
push edi
pop ebx
push ebx
pop edi
pop ebp
pop esi
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0x47c]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x42b1cc
call fcn.00431378
test al, al
je 0x42b0d7
pop edx
pop ebp
pop eax
push ecx
pop edx
push edx
pop edi
push eax
pop ebx
push esp
pop esi
push ebp
pop eax
pop ebx
pop edi
pop eax
push ebx
push edx
push ebx
push edi
pop eax
call fcn.0043110b
test al, al
je 0x42b0f0
pop ecx
push ebp
pop ebp
push eax
pop ebp
pop ecx
push ebp
pop ecx
push edx
pop edi
pop edx
push eax
pop edx
pop edx
pop ecx
pop eax
call fcn.004316b4
test al, al
je 0x42b10d
pop esi
push ecx
pop edx
pop edx
push ebx
pop ebx
pop ecx
push edx
pop esi
pop ebp
push esi
push esi
pop esi
push ebp
push edi
pop ebx
push ebx
pop edi
pop ebp
pop esi
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x450], ax
je 0x42b13d
lea eax, [ebp - 0x450]
push eax
call fcn.004525b1
pop ecx
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x248]
call fcn.004202e4
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x46c], eax
je 0x42b1d9
call fcn.004312ee
test al, al
je 0x42b182
push ebx
pop edx
push ebp
push ecx
push esp
push esp
pop esi
pop ebx
pop edx
pop edx
pop ebx
push esi
push eax
push esp
push esp
pop eax
pop ebx
pop eax
pop esi
pop eax
pop ebp
pop edi
push ebx
push edi
pop ebx
pop edx
call fcn.0043148c
test al, al
je 0x42b1a7
push esi
pop esp
push eax
push esi
push ebx
push esi
pop esp
push edi
pop ebp
push edi
push edx
pop edi
pop esp
push ecx
push ecx
pop eax
push ecx
pop ebp
push ebp
push ebx
pop esi
pop edi
pop ebx
push eax
pop ebp
push esp
push esi
push ebx
push 0
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.0042019a
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0x47c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42b0b9
jmp 0x42b409
call fcn.00431378
test al, al
je 0x42b1ff
push ebp
push ecx
push edi
pop esi
pop ecx
pop eax
pop esp
push ebx
push edi
pop ecx
push ecx
pop esp
push ecx
push eax
push ebx
push edi
push ebp
push esp
push eax
push ebx
pop esp
push eax
pop ebx
pop esi
pop eax
push ebp
push esi
push ecx
push edx
call fcn.004315e5
test al, al
je 0x42b223
push esp
pop edx
push ebx
pop ebp
pop eax
pop ebp
push ecx
pop eax
push eax
push ecx
pop ebx
push edx
pop esi
push edx
pop esp
pop esp
push ebp
pop edx
pop ecx
push ebp
push eax
push edi
push esp
pop edi
push esi
push ecx
pop edi
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0044ea80
add esp, 0xc
push dword [ebp - 0x46c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x478], eax
test eax, eax
je 0x42b3fa
call fcn.004312ee
test al, al
je 0x42b27d
push ebx
pop edx
push ebp
push ecx
push esp
push esp
pop esi
pop ebx
pop edx
pop edx
pop ebx
push esi
push eax
push esp
push esp
pop eax
pop ebx
pop eax
pop esi
pop eax
pop ebp
pop edi
push ebx
push edi
pop ebx
pop edx
call fcn.0043148c
test al, al
je 0x42b2a2
push esi
pop esp
push eax
push esi
push ebx
push esi
pop esp
push edi
pop ebp
push edi
push edx
pop edi
pop esp
push ecx
push ecx
pop eax
push ecx
pop ebp
push ebp
push ebx
pop esi
pop edi
pop ebx
push eax
pop ebp
push esp
push esi
push ebx
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x478]
call sub.PSAPI.DLL_GetModuleFileNameExW
cmp word [ebp - 0x218], 0
jne 0x42b2c9
xor eax, eax
jmp 0x42b2d6
lea eax, [ebp - 0x218]
push eax
call fcn.004525b1
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.004202e4
call fcn.00431378
test al, al
je 0x42b307
pop edx
pop ebp
pop eax
push ecx
pop edx
push edx
pop edi
push eax
pop ebx
push esp
pop esi
push ebp
pop eax
pop ebx
pop edi
pop eax
push ebx
push edx
push ebx
push edi
pop eax
call fcn.0043110b
test al, al
je 0x42b320
pop ecx
push ebp
pop ebp
push eax
pop ebp
pop ecx
push ebp
pop ecx
push edx
pop edi
pop edx
push eax
pop edx
pop edx
pop ecx
pop eax
call fcn.004316b4
test al, al
je 0x42b33d
pop esi
push ecx
pop edx
pop edx
push ebx
pop ebx
pop ecx
push edx
pop esi
pop ebp
push esi
push esi
pop esi
push ebp
push edi
pop ebx
push ebx
pop edi
pop ebp
pop esi
mov esi, 0x582524
lea ecx, [ebp - 0x230]
push esi
call fcn.00423a31
test eax, eax
jne 0x42b3a3
mov ecx, dword [ebp - 0x484]
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x478]
call fcn.0042a73b
push esi
lea ecx, [ebp - 0x230]
call fcn.00423a31
test eax, eax
jne 0x42b3a3
cmp word [ebp - 0x450], ax
je 0x42b390
lea eax, [ebp - 0x450]
push eax
call fcn.004525b1
pop ecx
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x230]
call fcn.004202e4
call fcn.00431378
test al, al
je 0x42b3cc
push eax
pop esp
pop ecx
push ebx
pop eax
pop ecx
push ecx
pop ebx
pop edx
push edi
push ebx
pop esp
push ebx
push ebx
push edi
pop esp
push edx
pop edi
pop ecx
pop ebx
push ebp
pop edx
pop edi
push edi
push edx
pop esp
push esi
push ebp
push esi
push edi
push ebx
push ebp
call fcn.0043166f
test al, al
je 0x42b3ee
push esp
push edx
push edi
push edx
pop eax
pop ecx
push esp
push edx
pop ecx
pop edx
pop ecx
push esp
pop eax
push esp
pop edx
push esi
pop esp
push ebx
push edx
push esp
pop esi
push esp
push esi
push edi
pop edi
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.0042019a
push dword [ebp - 0x47c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x480]
lea eax, [ebp - 0x230]
push eax
call fcn.00423750
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.0042019a
mov eax, dword [ebp - 0x480]
call fcn.0042c453
ret 8