Function at 0x4219a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x264
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x452470
mov edi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0
push 2
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
je 0x421adc
mov esi, eax
lea eax, [ebp - 0x26c]
push 0x228
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x270]
mov dword [ebp - 0x270], 0x22c
push eax
push esi
call dword [sym.imp.kernel32.dll_Process32FirstW]
test eax, eax
je 0x421bbc
xor ebx, ebx
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x34], esi
jmp 0x421aa1
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], edx
lea ecx, [ebp - 0x2c]
mov edx, ebx
call fcn.00414170
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x24]
shl ebx, 4
mov dword [ebp - 0x20], eax
mov dword [eax + ebx], edi
mov dword [eax + ebx + 8], esi
mov dword [eax + ebx + 4], ecx
mov dword [eax + ebx + 0xc], edx
lea eax, [ebp - 0x270]
mov ebx, dword [ebp - 0x24]
inc ebx
mov dword [ebp - 0x24], ebx
push eax
mov esi, dword [ebp - 0x34]
push esi
call dword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
je 0x421d33
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x24c]
push 0x104
call fcn.0041dc20
add esp, 4
mov edi, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
test edi, edi
je 0x421ccf
mov edx, dword [ebp - 0x268]
cmp ebx, dword [ebp - 0x28]
je 0x421a50
mov eax, dword [ebp - 0x20]
jmp 0x421a6c
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x421aff
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x421d71
mov dword [0x4634c8], eax
push 0x21
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x421d71
mov esi, eax
push 0x21
push str.Could_not_create_process_snapshotKill_process_if_found:__
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x421b47
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x421d60
mov dword [0x4634c8], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x421d60
mov dword [eax], esi
mov dword [eax + 4], 0x21
mov dword [eax + 8], 0x21
mov ebx, eax
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x421b8b
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x421b9e
mov dword [0x4634c8], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
jne 0x421cb0
mov ecx, 4
mov edx, 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0
call fcn.004537a0
jmp 0x421dac
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x421be6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x421d82
mov dword [0x4634c8], eax
push 0x20
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x421d82
mov dword [eax + 0x1c], 0x61746164
mov dword [eax + 0x18], 0x20737365
mov dword [eax + 0x14], 0x636f7270
mov dword [eax + 0x10], 0x20747372
mov dword [eax + 0xc], 0x69662074
mov dword [eax + 8], 0x65672074
mov dword [eax + 4], 0x6f6e2064
mov dword [eax], 0x6c756f43
mov esi, eax
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x421c55
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x421d60
mov dword [0x4634c8], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x421d60
mov dword [eax], esi
mov dword [eax + 4], 0x20
mov dword [eax + 8], 0x20
mov ebx, eax
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x421c9d
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x421d93
mov dword [0x4634c8], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x421d93
mov dword [eax], ebx
mov dword [eax + 4], 0x459a5c
mov byte [eax + 8], 0x27
mov dword [edi + 4], 3
mov dword [edi + 8], eax
mov dword [edi], 0
jmp 0x421d4c
push dword [ebp - 0x34]
mov edi, ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x30]
test ebx, ebx
mov dword [eax + 8], esi
mov dword [eax + 4], edi
mov dword [eax], 0
je 0x421d1a
mov esi, dword [ebp - 0x2c]
mov edi, dword [sym.imp.kernel32.dll_HeapFree]
add esi, 4
jmp 0x421d06
add esi, 0x10
dec ebx
je 0x421d1a
cmp dword [esi], 0
je 0x421d00
push dword [esi - 4]
push 0
push dword [0x4634c8]
call edi
jmp 0x421d00
cmp dword [ebp - 0x28], 0
je 0x421d4c
push dword [ebp - 0x2c]
push 0
push dword [0x4634c8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x421d4c
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
movsd xmm0, qword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
movsd qword [ecx], xmm0
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x264
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 0xc
call fcn.004537a0
ud2
mov ecx, 1
mov edx, 0x21
call fcn.004537a0
ud2
mov ecx, 1
mov edx, 0x20
call fcn.004537a0
ud2
mov ecx, 4
mov edx, 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 1
call fcn.004537a0
ud2