Function at 0x417fe0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cda1
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x43b1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x2ac], edi
xor ebx, ebx
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a0], edi
push 0x124
lea eax, [ebp - 0x290]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x294], edi
call fcn.0041a340
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x2b4], eax
cmp eax, 0xffffffff
jne 0x4180ad
lea ecx, [ebp - 0x2a8]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
cmp esi, ecx
je 0x41809d
mov ecx, esi
call fcn.004160f0
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a0], edi
lea ecx, [ebp - 0x2a8]
call fcn.004160f0
jmp 0x418398
lea edx, [ebp - 0x294]
push edx
push eax
mov dword [ebp - 0x294], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x418337
mov eax, dword [ebp - 0x298]
add eax, 8
mov dword [ebp - 0x2bc], eax
xor eax, eax
lea ecx, [ecx]
mov cl, byte [ebp + eax - 0x270]
mov byte [ebp + eax - 0x114], cl
inc eax
test cl, cl
jne 0x4180e0
lea ecx, [ebp - 0x114]
push ecx
call fcn.0042824a
mov ebx, dword [ebp - 0x2bc]
add esp, 4
mov dword [ebp - 0x298], 0
lea eax, [ebp - 0x114]
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418136
sub eax, edx
push eax
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x130]
call fcn.00402640
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebx - 4]
mov byte [ebp - 4], 1
call fcn.00415ae0
mov dword [ebp - 0x2b8], eax
cmp eax, dword [ebx]
je 0x4181d0
mov esi, dword [eax + 0x1c]
add eax, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x41817d
mov eax, dword [eax]
mov edi, dword [ebp - 0x120]
mov edx, edi
cmp edi, esi
jb 0x41818b
mov edx, esi
cmp dword [ebp - 0x11c], 0x10
mov ecx, dword [ebp - 0x130]
jae 0x4181a0
lea ecx, [ebp - 0x130]
push edx
push eax
push ecx
call fcn.00401c70
add esp, 0xc
test eax, eax
jne 0x4181c1
cmp edi, esi
jae 0x4181b8
or eax, 0xffffffff
jmp 0x4181bf
xor eax, eax
cmp edi, esi
setne al
test eax, eax
sets al
test al, al
jne 0x4181d0
lea eax, [ebp - 0x2b8]
jmp 0x4181de
mov eax, dword [ebx]
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x2ac]
cmp dword [ebp - 0x11c], 0x10
mov esi, dword [eax]
mov byte [ebp - 4], 0
jb 0x4181fc
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.00418f39
add esp, 4
xor edi, edi
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], edi
mov byte [ebp - 0x130], 0
cmp esi, dword [ebx]
jne 0x418237
mov eax, dword [ebp - 0x298]
inc eax
add ebx, 0x10
mov dword [ebp - 0x298], eax
cmp eax, 3
jl 0x418112
jmp 0x41830a
mov ebx, 0xf
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x15c], edi
mov byte [ebp - 0x16c], 0
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], edi
mov byte [ebp - 0x150], 0
mov edx, dword [ebp - 0x298]
lea eax, [ebp - 0x114]
mov dword [ebp - 0x134], edx
mov byte [ebp - 4], 2
lea edx, [eax + 1]
jmp 0x418280
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418280
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x150]
call fcn.00402640
push 0xffffffffffffffff
lea eax, [esi + 0x28]
push edi
push eax
lea ecx, [ebp - 0x16c]
call fcn.00402400
lea ecx, [ebp - 0x16c]
push ecx
lea ecx, [ebp - 0x2a8]
call fcn.00416420
mov esi, 0x10
mov byte [ebp - 4], 0
cmp dword [ebp - 0x13c], esi
jb 0x4182e0
mov edx, dword [ebp - 0x150]
push edx
call fcn.00418f39
add esp, 4
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], edi
mov byte [ebp - 0x150], 0
cmp dword [ebp - 0x158], esi
jb 0x41830a
mov eax, dword [ebp - 0x16c]
push eax
call fcn.00418f39
add esp, 4
mov edx, dword [ebp - 0x2b4]
lea ecx, [ebp - 0x294]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4180db
mov edi, dword [ebp - 0x2a4]
mov ebx, dword [ebp - 0x2a8]
mov esi, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea ecx, [ebp - 0x2a8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
cmp esi, ecx
je 0x418368
mov edx, dword [ebp - 0x2a0]
mov dword [esi], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edx
jmp 0x418398
cmp ebx, eax
je 0x418398
mov esi, ebx
cmp ebx, edi
je 0x418389
lea eax, [ebp - 0x29c]
push esi
push eax
call fcn.00415e10
add esi, 0x3c
add esp, 8
cmp esi, edi
jne 0x418372
push ebx
call fcn.00418f39
mov esi, dword [ebp - 0x2b0]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419ad1
mov esp, ebp
pop ebp
ret 4