Function at 0x402b00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b79df
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x4f9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea ecx, [ebp - 0xe8]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
sub esp, 0x34
lea edx, [ebx + 0x33]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x79
push 0x61
push 0x72
push 0x54
push 0x30
push 0x36
call fcn.00403530
add esp, 0x138
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 4], ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
sub esp, 0x34
lea edx, [ebx + 0x33]
lea ecx, [ebp - 0xd0]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x65
push 0x66
push 0x61
push 0x53
push 0x30
push 0x36
call fcn.00403530
add esp, 0x138
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 1
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
sub esp, 0x34
lea edx, [ebx + 0x5a]
lea ecx, [ebp - 0xb8]
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x75
push 0x59
push 0x67
push 0x6e
push 0x61
push 0x46
push 0x67
push 0x6e
push 0x6f
push 0x44
push 0x75
push 0x68
call fcn.00403530
add esp, 0x138
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 2
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
sub esp, 0x34
lea edx, [ebx + 0x33]
lea ecx, [ebp - 0xa0]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x64
push 0x73
push 0x30
push 0x36
call fcn.00403530
add esp, 0x138
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 3
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
sub esp, 0x34
lea edx, [ebx + 0x33]
lea ecx, [ebp - 0x88]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x70
push 0x72
push 0x30
push 0x36
call fcn.00403530
add esp, 0x138
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
sub esp, 0x34
lea edx, [ebx + 0x6b]
lea ecx, [ebp - 0x70]
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x65
push 0x72
push 0x6f
push 0x63
push 0x73
push 0x65
push 0x78
call fcn.00403530
add esp, 0x138
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
sub esp, 0x34
mov byte [ebp - 4], 5
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x79
push 0x61
push 0x72
push 0x74
push 0x65
push 0x78
lea edx, [ebx + 0x6b]
lea ecx, [ebp - 0x58]
call fcn.00403530
add esp, 0x138
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
sub esp, 0x34
mov byte [ebp - 4], 6
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x79
push 0x61
push 0x72
push 0x54
push 0x43
push 0x50
push 0x51
lea edx, [ebx + 0x51]
lea ecx, [ebp - 0x40]
call fcn.00403530
add esp, 0x138
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
sub esp, 0x34
mov byte [ebp - 4], 7
lea edx, [ebx + 0x51]
lea ecx, [ebp - 0x28]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x50
push 0x54
push 0x52
push 0x43
push 0x50
push 0x51
call fcn.00403530
mov dword [ebp - 4], 0xffffffff
push 0x22c
lea eax, [ebp - 0x314]
push ebx
push eax
call fcn.004773d0
add esp, 0x144
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x318], esi
cmp esi, 0xffffffff
je 0x402f97
mov dword [ebp - 0x314], 0x22c
xor edi, edi
lea eax, [ebp - 0x314]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x402f7c
lea eax, [edi + edi*2]
lea esi, [ebp - 0xe8]
lea esi, [esi + eax*8]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x402f20
mov eax, dword [esi]
lea ecx, [ebp - 0x2f0]
push ecx
push eax
call fcn.0047cdb1
add esp, 8
test eax, eax
je 0x402f4d
lea eax, [ebp - 0x314]
push eax
push dword [ebp - 0x318]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402f16
jmp 0x402f76
cmp edi, 4
jg 0x402f5a
inc ebx
mov edi, 4
jmp 0x402f76
cmp edi, 6
jg 0x402f69
add ebx, 2
mov edi, 6
jmp 0x402f76
cmp edi, 8
jg 0x402f76
add ebx, 4
mov edi, 8
mov esi, dword [ebp - 0x318]
inc edi
cmp edi, 9
jb 0x402ef8
test ebx, ebx
mov eax, 8
push esi
cmove ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push fcn.00403a30
push 9
push 0x18
lea eax, [ebp - 0xe8]
push eax
call fcn.004758cf
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475880
mov esp, ebp
pop ebp
ret