Function at 0x401530
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9d4f
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x5383c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
push 0x228
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x250]
push ebx
push eax
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x264], ebx
call fcn.004c0a60
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x260], eax
cmp eax, 0xffffffff
jne 0x4015a7
xor al, al
jmp 0x401798
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x254], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40178a
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
push 0
or ebx, 1
mov dword [ebp - 0x28], 0
push 0x3a8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x264], ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x18]
lea edi, [eax - 1]
cmp edi, ecx
ja 0x401631
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], edi
cmovae ecx, dword [ebp - 0x28]
mov byte [ecx + edi], 0
jmp 0x401686
mov edx, dword [ebp - 0x14]
mov ebx, edi
mov eax, edx
sub ebx, ecx
sub eax, ecx
cmp ebx, eax
ja 0x401667
cmp edx, 0x10
mov dword [ebp - 0x18], edi
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push ebx
add esi, ecx
push 0
push esi
call fcn.004c0a60
mov byte [esi + ebx], 0
add esp, 0xc
mov esi, dword [ebp - 0x25c]
jmp 0x401680
push 0
push ebx
mov byte [ebp - 0x268], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x268]
push ebx
call fcn.00403c00
mov ebx, dword [ebp - 0x258]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0
push edi
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x230]
push eax
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x4016b7
mov ecx, dword [esi]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401736
mov edi, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x258], eax
cmp dword [edi + 4], 0x15555555
mov esi, dword [edi]
je 0x4017b9
mov dword [ebp - 0x274], edi
mov byte [ebp - 4], 1
push 0xc
mov dword [ebp - 0x270], 0
call fcn.004bec3b
mov ecx, dword [ebp - 0x258]
add esp, 4
mov dword [ebp - 0x270], 0
mov dword [eax + 8], ecx
inc dword [edi + 4]
mov ecx, dword [esi + 4]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [esi + 4], eax
mov esi, dword [ebp - 0x25c]
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
and ebx, 0xfffffffe
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x401770
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401766
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4017b4
push ecx
push edx
call fcn.004bec6b
add esp, 8
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4015c6
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bebdd
mov esp, ebp
pop ebp
ret
call fcn.004c8fd6
push str.list_too_long
call fcn.00423fb4
int3