Function at 0x468359
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x4683c6
cmp dword [ebp + 8], 0
je 0x468399
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x238], eax
jmp 0x4683a0
and dword [ebp - 0x238], 0
push 0x486318
push str.Failed_to_CreateToolhelp32Snapshot
push dword [ebp - 0x238]
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
xor al, al
jmp 0x468677
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x468434
cmp dword [ebp + 8], 0
je 0x4683fb
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x23c], eax
jmp 0x468402
and dword [ebp - 0x23c], 0
push 0x486354
push str.Failed_to_Process32First
push dword [ebp - 0x23c]
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x468677
cmp dword [ebp + 8], 0
je 0x468448
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x240], eax
jmp 0x46844f
and dword [ebp - 0x240], 0
push 0x4863f4
push 0x486388
push dword [ebp - 0x240]
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
cmp dword [ebp + 8], 0
je 0x468482
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x244], eax
jmp 0x468489
and dword [ebp - 0x244], 0
push 0x48641c
lea eax, [ebp - 0x20c]
push eax
push str.PROCESS_NAME:_t
push dword [ebp - 0x244]
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
push dword [ebp - 0x228]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x468515
cmp dword [ebp + 8], 0
je 0x4684ed
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x248], eax
jmp 0x4684f4
and dword [ebp - 0x248], 0
push 0x486424
push str.Failed_to_OpenProcess
push dword [ebp - 0x248]
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
jmp 0x468521
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xe00
push 0x800
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 4]
call fcn.00407a25
push 8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 4]
call fcn.0042161d
cmp dword [ebp + 8], 0
je 0x468561
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x250], eax
jmp 0x468568
and dword [ebp - 0x250], 0
push 0x486448
push dword [ebp - 0x228]
push str.Process_ID_t
push dword [ebp - 0x250]
call fcn.0041e358
pop ecx
pop ecx
mov ecx, eax
call fcn.00419bc6
push eax
call fcn.0041e358
pop ecx
pop ecx
cmp dword [ebp + 8], 0
je 0x4685a8
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x254], eax
jmp 0x4685af
and dword [ebp - 0x254], 0
push 0x48647c
push dword [ebp - 0x218]
push str.Parent_process_ID_t
push dword [ebp - 0x254]
call fcn.0041e358
pop ecx
pop ecx
mov ecx, eax
call fcn.00419bc6
push eax
call fcn.0041e358
pop ecx
pop ecx
push 0xe00
push 0x200
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 4]
call fcn.00407a25
push 8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 4]
call fcn.004215ff
cmp dword [ebp + 8], 0
je 0x46861b
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x258], eax
jmp 0x468622
and dword [ebp - 0x258], 0
push 0x4864a4
push dword [ebp - 0x21c]
push str.Thread_count_t
push dword [ebp - 0x258]
call fcn.0041e358
pop ecx
pop ecx
mov ecx, eax
call fcn.00419bc6
push eax
call fcn.0041e358
pop ecx
pop ecx
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x468434
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a99c
mov esp, ebp
pop ebp
ret