Function at 0x402cf0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x573c28]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
mov edi, ecx
push 2
mov dword [ebp - 0x138], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x134], ebx
cmp ebx, 0xffffffff
jne 0x402d49
push 0
push 0x52c090
push str.CreateToolhelp32Snapshot_fail___
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00504604
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12c]
push eax
push ebx
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x402d8f
push eax
push 0x52c090
push str.Process32First_fail___
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00504604
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.00402700
push esi
push 0xc
call fcn.00405461
mov esi, eax
add esp, 4
test esi, esi
je 0x402dc4
call fcn.0040809e
test eax, eax
je 0x402ef4
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
jmp 0x402dc6
xor esi, esi
lea eax, [ebp - 0x108]
mov dword [ebp - 0x130], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402dd5
sub eax, edx
push eax
lea ecx, [ebp - 0x108]
push ecx
mov ecx, esi
call fcn.00401fb0
mov edx, dword [ebp - 0x124]
mov dword [esi + 4], edx
mov dword [esi + 8], ebx
mov eax, dword [edi + 0xc4]
lea esi, [edi + 0xc0]
lea ecx, [ebp - 0x130]
cmp ecx, eax
jae 0x402e7b
mov edx, dword [esi]
cmp edx, ecx
ja 0x402e7b
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x402e66
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x402efe
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x402e66
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x402e50
xor ecx, ecx
jmp 0x402e52
add ecx, edx
cmp ecx, eax
jae 0x402e58
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00401dd0
mov ebx, dword [ebp - 0x134]
mov edx, dword [esi]
mov ecx, dword [esi + 4]
lea eax, [edx + edi*4]
push eax
push ecx
lea edx, [esi + 0xc]
push edx
call fcn.00401ac0
jmp 0x402ed1
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x402ebd
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x402efe
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x402ebd
mov edx, ecx
shr edx, 1
mov edi, 0x3fffffff
sub edi, edx
cmp edi, ecx
jae 0x402ead
xor ecx, ecx
jmp 0x402eaf
add ecx, edx
cmp ecx, eax
jae 0x402eb5
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00401dd0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x130]
push eax
push ecx
lea edx, [esi + 0xc]
push edx
call fcn.00401ac0
add dword [esi + 4], 4
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x402f08
mov edi, dword [ebp - 0x138]
jmp 0x402d97
push 0x80004005
call fcn.004010e0
push str.vector_T__too_long
call fcn.0051c744
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00504604
mov esp, ebp
pop ebp
ret