Function at 0x481f00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2af1
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x4e3ec8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4b0b18
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4822ad
lea ecx, [ebp - 0x148]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov byte [ebp - 4], 1
call fcn.0047d6b0
mov byte [ebp - 0x149], al
movzx eax, al
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x13c], esp
push 0x4ae8b4
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov ecx, esp
mov dword [ebp - 0x144], esp
push str.Is_Window_7_machine
mov byte [ebp - 4], 2
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 1
call fcn.0047c140
add esp, 0xc
lea ecx, [ebp - 0x140]
call dword [sym.imp.mfc100.dll_Ordinal_316]
cmp byte [ebp - 0x149], 0
push 0
push ecx
mov bl, 3
mov byte [ebp - 4], bl
mov ecx, esp
mov dword [ebp - 0x144], esp
jne 0x482167
push str.netsh_interface_ipv4_show_interfacesfind__Ethernet_
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x13c]
push ecx
call fcn.0047d270
add esp, 0xc
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x144], esp
push str.netsh_interface_set_interface_ethernet_enable
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea edx, [ebp - 0x13c]
push edx
call fcn.0047d270
add esp, 0xc
push eax
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 5
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
push str.Ethernet
lea ecx, [ebp - 0x148]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
jns 0x4820ef
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x144], esp
push str.netsh_interface_ipv4_show_interfacesfind__Local_Area_Connection_
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [ebp - 0x13c]
push eax
call fcn.0047d270
add esp, 0xc
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x144], esp
push str.netsh_interface_set_interface__Local_Area_Connection__enable
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x13c]
push ecx
call fcn.0047d270
add esp, 0xc
push eax
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xffffffffffffffff
push ecx
lea edx, [ebp - 0x148]
mov ecx, esp
mov dword [ebp - 0x144], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x13c], esp
push str.Command_result_1
mov byte [ebp - 4], 8
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
push 0xffffffffffffffff
push ecx
lea eax, [ebp - 0x140]
mov ecx, esp
mov dword [ebp - 0x144], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x13c], esp
push str.Command_result_2
mov byte [ebp - 4], 9
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
jmp 0x4821e6
push str.netsh_interface_ipv4_show_interfacesfind__Local_Area_Connection_
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x13c]
push ecx
call fcn.0047d270
add esp, 0xc
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0xa
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x144], esp
push str.netsh_interface_set_interface__Local_Area_Connection__enable
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea edx, [ebp - 0x13c]
push edx
call fcn.0047d270
add esp, 0xc
push eax
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 0xb
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
push str._connected
lea ecx, [ebp - 0x148]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x144], esp
test eax, eax
js 0x482255
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x13c], esp
push str.Command_result_connected
mov byte [ebp - 4], 0xc
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
lea ecx, [ebp - 0x140]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x148]
call dword [sym.imp.mfc100.dll_Ordinal_901]
jmp 0x482370
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x13c], esp
push str.Command_result_disconnected
mov byte [ebp - 4], 0xd
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
lea ecx, [ebp - 0x140]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x148]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov al, 1
jmp 0x48237b
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x128
mov esi, eax
lea eax, [ebp - 0x138]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x138]
push ecx
push esi
mov dword [ebp - 0x138], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x482361
mov edi, dword [ebp + 0xc]
lea esp, [esp]
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x140]
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xe
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x140]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
mov eax, dword [ebp - 0x130]
je 0x482353
cmp edi, 0xffffffff
je 0x482330
cmp edi, eax
je 0x482353
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea eax, [ebp - 0x138]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4822f0
jmp 0x482361
lea ecx, [ebp - 0x140]
mov ebx, eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x48229d
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e770
mov esp, ebp
pop ebp
ret