Function at 0x4c8f5a
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e75fa
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x54b0c4]
xor eax, esp
mov dword [esp + 0x280], eax
push ebx
push esi
push edi
mov eax, dword [0x54b0c4]
xor eax, esp
push eax
lea eax, [esp + 0x298]
mov dword fs:[0], eax
and dword [esp + 0x18], 0
mov edi, ecx
call fcn.0045c334
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x4c917d
lea ecx, [esp + 0x5c]
push ecx
push eax
mov dword [esp + 0x64], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4c9173
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x64]
je 0x4c9094
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.MSVCR80.dll__wcslwr]
pop ecx
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
and dword [esp + 0x2a0], 0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP80.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::begin_void_]
mov esi, eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP80.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::end_void_]
mov ebx, eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP80.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::begin_void_]
push dword [esi + 4]
push dword [esi]
push dword [ebx + 4]
push dword [ebx]
lea ebx, [esp + 0x38]
push dword [eax + 4]
push dword [eax]
push dword [sym.imp.MSVCR80.dll_tolower]
call fcn.00453e1f
add esp, 0x1c
lea eax, [esp + 0x40]
push eax
lea eax, [edi + 0x18]
call fcn.004c9305
test eax, eax
ja 0x4c90af
or dword [esp + 0x2a0], 0xffffffff
lea ecx, [esp + 0x40]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4c8fe1
jmp 0x4c9173
cmp dword [0x550bdc], 0
je 0x4c9127
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], 0x212
jae 0x4c90cf
lea eax, [esp + 0x44]
push str._running
push eax
push str.not_showpop_while_process
push 0x509228
push str.KPreventScreenshots::_IsProcessExist
push 0x5091f4
lea eax, [esp + 0x2c]
push eax
push 0x5091f0
call fcn.004022f5
call fcn.0040233d
call fcn.00423894
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
mov esi, eax
call fcn.00402366
cmp dword [edi + 0x40], 0
je 0x4c913a
mov ecx, dword [edi + 0x38]
mov eax, dword [ecx]
push str.monitor_process
call dword [eax + 0x34]
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x4c9149
lea eax, [esp + 0x44]
mov edi, dword [edi + 0x38]
mov edx, dword [edi]
push eax
push str.monitor_process_close
mov ecx, edi
call dword [edx + 0x30]
or dword [esp + 0x2a0], 0xffffffff
lea ecx, [esp + 0x40]
mov dword [esp + 0x18], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x298]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x280]
xor ecx, esp
call fcn.004d0736
mov esp, ebp
pop ebp
ret