Function at 0x41cff0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x29c
mov dword [ebp - 0x244], 0x22c
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
cmp eax, 0xffffffff
mov dword [ebp - 0x280], eax
je 0x41d430
lea eax, [ebp - 0x244]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x280]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32FirstW
sub esp, 8
test eax, eax
je 0x41d2be
nop
lea eax, [ebp - 0x220]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], eax
lea eax, [ebp - 0x258]
mov dword [esp], eax
call dword [method.QString.fromUtf16_unsigned_short_const__int_]
mov eax, dword [ebp - 0x23c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0041c860
mov dword [esp + 4], 1
mov dword [esp], 0x469a35
call dword [method.QString.fromAscii_helper_char_const__int_]
mov dword [ebp - 0x248], eax
mov dword [esp + 4], 1
mov dword [esp], 0x469a8c
call dword [method.QString.fromAscii_helper_char_const__int_]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x248]
mov dword [esp + 8], 1
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x27c], eax
mov dword [esp + 4], eax
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x278], eax
mov dword [esp], eax
call dword [method.QString.replace_QString_const__QString_const__Qt::CaseSensitivity_]
mov dword [ebp - 0x274], eax
lea ecx, [ebp - 0x258]
lea eax, [ebp - 0x250]
sub esp, 0xc
mov dword [ebp - 0x26c], eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [method.QString.toLower_helper_QString_const_]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx], 1
jbe 0x41d130
mov ecx, eax
call fcn.00459ab0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov ebx, dword [ecx + 0xc]
test ebx, ebx
je 0x41d423
mov dword [ebp - 0x270], 0
mov edi, dword [sym.imp.Qt5Core.dll_operator__QString_const__QString_const_]
jmp 0x41d164
mov eax, dword [ebx + 4]
mov dword [ebp - 0x270], ebx
mov esi, 1
test eax, eax
je 0x41d183
mov ebx, eax
mov eax, dword [ebp - 0x26c]
mov dword [esp + 4], eax
lea eax, [ebx + 0xc]
mov dword [esp], eax
call edi
test al, al
je 0x41d150
mov eax, dword [ebx + 8]
xor esi, esi
test eax, eax
jne 0x41d162
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x41d2e0
mov eax, dword [ebp - 0x270]
add eax, 0xc
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x26c]
mov dword [esp], eax
call edi
test al, al
jne 0x41d2e0
mov ecx, dword [ebp - 0x270]
mov eax, dword [ebp - 0x274]
add ecx, 0x10
mov dword [esp], eax
call dword [method.QString.operator_QString_const_]
sub esp, 4
mov eax, dword [ebp - 0x250]
mov edx, dword [eax]
test edx, edx
jne 0x41d362
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x24c]
mov edx, dword [eax]
test edx, edx
jne 0x41d400
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x248]
mov edx, dword [eax]
test edx, edx
jne 0x41d3b0
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
lea eax, [ebp - 0x244]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x280]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32NextW
mov edx, dword [ebp - 0x254]
mov ebx, eax
sub esp, 8
mov eax, dword [edx]
test eax, eax
jne 0x41d385
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], edx
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov edx, dword [ebp - 0x258]
mov eax, dword [edx]
test eax, eax
jne 0x41d3d3
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], edx
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
test ebx, ebx
jne 0x41d050
mov eax, dword [ebp - 0x280]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, esi
movzx esi, al
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 4
mov dword [esp], 0x14
call dword [method.QMapDataBase.createNode_int__int__QMapNodeBase__bool_]
sub esp, 0x10
cmp eax, 0xfffffff4
je 0x41d329
mov edx, dword [ebp - 0x250]
mov esi, dword [edx]
mov dword [eax + 0xc], edx
lea ecx, [esi + 1]
cmp ecx, 1
jbe 0x41d329
lock add dword [edx], 1
setne cl
cmp eax, 0xfffffff0
je 0x41d1cc
mov edi, dword [ebp - 0x274]
mov edx, dword [edi]
mov dword [eax + 0x10], edx
mov eax, dword [edx]
add eax, 1
cmp eax, 1
jbe 0x41d1cc
lock add dword [edx], 1
setne al
mov eax, dword [ebp - 0x250]
mov edx, dword [eax]
test edx, edx
je 0x41d1dc
cmp edx, 0xffffffff
je 0x41d1f5
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41d1f5
mov eax, dword [ebp - 0x250]
jmp 0x41d1dc
cmp eax, 0xffffffff
je 0x41d28d
lock sub dword [edx], 1
setne al
test al, al
jne 0x41d28d
mov edx, dword [ebp - 0x254]
jmp 0x41d274
cmp edx, 0xffffffff
je 0x41d247
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41d247
mov eax, dword [ebp - 0x248]
jmp 0x41d22e
cmp eax, 0xffffffff
je 0x41d2b6
lock sub dword [edx], 1
setne al
test al, al
jne 0x41d2b6
mov edx, dword [ebp - 0x258]
jmp 0x41d29d
cmp edx, 0xffffffff
je 0x41d21e
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41d21e
mov eax, dword [ebp - 0x24c]
jmp 0x41d205
lea ebx, [ecx + 8]
mov esi, 1
jmp 0x41d2ea
lea edi, [ebp - 0x260]
mov dword [esp + 4], 0xc
mov dword [esp], 0x469a4f
mov esi, dword [method.QString.fromAscii_helper_char_const__int_]
call esi
mov dword [esp], edi
mov dword [ebp - 0x24c], eax
call dword [method.QDir.currentPath__]
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax]
mov dword [ebp - 0x25c], eax
lea edx, [ecx + 1]
cmp edx, 1
jbe 0x41d479
lock add dword [eax], 1
setne dl
lea eax, [ebp - 0x248]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 0x469a5c
mov dword [ebp - 0x27c], eax
mov dword [esp], eax
call dword [method.QString.fromUtf8_helper_char_const__int_]
mov eax, dword [ebp - 0x27c]
lea ebx, [ebp - 0x25c]
mov ecx, ebx
mov dword [esp], eax
call dword [method.QString.append_QString_const_]
mov eax, dword [ebp - 0x248]
sub esp, 4
mov edx, dword [eax]
test edx, edx
jne 0x41d6aa
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
lea eax, [ebp - 0x24c]
mov dword [esp + 0x1c], 0x48c07c
mov dword [esp + 0x18], 0x48c080
mov dword [esp + 0x10], ebx
mov dword [ebp - 0x248], 4
mov dword [ebp - 0x278], eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x250], 0x5a
mov dword [ebp - 0x254], 0x300000
mov dword [ebp - 0x258], 2
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x250]
mov dword [ebp - 0x26c], eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x254]
mov dword [esp + 4], eax
lea eax, [ebp - 0x258]
mov dword [esp], eax
call fcn.00451950
mov eax, dword [ebp - 0x25c]
mov edx, dword [eax]
test edx, edx
jne 0x41d74e
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x260]
mov edx, dword [eax]
test edx, edx
jne 0x41d72b
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x24c]
mov edx, dword [eax]
test edx, edx
jne 0x41d708
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov dword [ebp - 0x248], 2
movzx ebx, byte [0x468004]
mov dword [esp + 4], 0x24
mov dword [esp], str.CreateToolhelp32Snapshot
call esi
mov dword [esp + 4], 0
mov dword [ebp - 0x24c], eax
mov dword [esp], 0x4699da
call esi
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x27c]
mov dword [esp + 0x18], 0x215
mov dword [esp + 0x14], str.PackagingZC_Common.cpp
mov dword [esp + 0xc], 4
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x278]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x26c]
mov dword [esp], eax
call fcn.004546e0
mov eax, dword [ebp - 0x250]
mov edx, dword [eax]
test edx, edx
jne 0x41d6ed
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x24c]
mov edx, dword [eax]
test edx, edx
jne 0x41d6cd
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x41d2d0
cmp edx, 0xffffffff
je 0x41d4e1
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41d4e1
mov eax, dword [ebp - 0x248]
jmp 0x41d4c8
cmp edx, 0xffffffff
je 0x41d2d0
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41d2d0
mov eax, dword [ebp - 0x24c]
jmp 0x41d68c
cmp edx, 0xffffffff
je 0x41d680
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41d680
mov eax, dword [ebp - 0x250]
jmp 0x41d667
cmp edx, 0xffffffff
je 0x41d5da
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41d5da
mov eax, dword [ebp - 0x24c]
jmp 0x41d5c1
cmp edx, 0xffffffff
je 0x41d5b1
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41d5b1
mov eax, dword [ebp - 0x260]
jmp 0x41d598
cmp edx, 0xffffffff
je 0x41d588
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x41d588
mov eax, dword [ebp - 0x25c]
jmp 0x41d56f