Function at 0x4c0660
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x248]
call fcn.00413400
push 0x697270
lea ecx, [ebp - 0x24c]
call fcn.004131e0
push 0x697294
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x248]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x24c]
call fcn.00413870
push 0x6972a8
lea ecx, [ebp - 0x250]
call fcn.004131e0
push 0x6972c8
lea ecx, [ebp - 0x250]
push ecx
lea ecx, [ebp - 0x248]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x250]
call fcn.00413870
push 0x6972dc
lea ecx, [ebp - 0x254]
call fcn.004131e0
push 0x6972f8
lea edx, [ebp - 0x254]
push edx
lea ecx, [ebp - 0x248]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x254]
call fcn.00413870
push 0x697304
lea ecx, [ebp - 0x258]
call fcn.004131e0
push 0x697328
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x248]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x258]
call fcn.00413870
push 0x697334
lea ecx, [ebp - 0x25c]
call fcn.004131e0
push 0x697358
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x248]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x25c]
call fcn.00413870
lea ecx, [ebp - 0x238]
call fcn.00413400
push str.DesktopMgr64.exe
lea ecx, [ebp - 0x260]
call fcn.004131e0
push 0x697388
lea edx, [ebp - 0x260]
push edx
lea ecx, [ebp - 0x238]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x260]
call fcn.00413870
push str.DesktopMgr.exe
lea ecx, [ebp - 0x264]
call fcn.004131e0
push 0x6973bc
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x238]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x264]
call fcn.00413870
push str.kdesk64.exe
lea ecx, [ebp - 0x268]
call fcn.004131e0
push 0x6973e8
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x238]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x268]
call fcn.00413870
push str.kdesk.exe
lea ecx, [ebp - 0x26c]
call fcn.004131e0
push 0x69740c
lea edx, [ebp - 0x26c]
push edx
lea ecx, [ebp - 0x238]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x26c]
call fcn.00413870
push str.PDDesktop.exe
lea ecx, [ebp - 0x270]
call fcn.004131e0
push 0x697438
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x238]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x270]
call fcn.00413870
push str.SmartDesktop.exe
lea ecx, [ebp - 0x274]
call fcn.004131e0
push 0x697468
lea ecx, [ebp - 0x274]
push ecx
lea ecx, [ebp - 0x238]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x274]
call fcn.00413870
push str.QPlusDesktop.exe
lea ecx, [ebp - 0x278]
call fcn.004131e0
push 0x697498
lea edx, [ebp - 0x278]
push edx
lea ecx, [ebp - 0x238]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x278]
call fcn.00413870
push str.360DesktopLite.exe
lea ecx, [ebp - 0x27c]
call fcn.004131e0
push 0x6974cc
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x238]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x27c]
call fcn.00413870
push str.360DesktopLite64.exe
lea ecx, [ebp - 0x280]
call fcn.004131e0
push 0x697508
lea ecx, [ebp - 0x280]
push ecx
lea ecx, [ebp - 0x238]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x280]
call fcn.00413870
push str.HaloDesktop64.exe
lea ecx, [ebp - 0x284]
call fcn.004131e0
push 0x69753c
lea edx, [ebp - 0x284]
push edx
lea ecx, [ebp - 0x238]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x284]
call fcn.00413870
push str.HaloDesktop.exe
lea ecx, [ebp - 0x288]
call fcn.004131e0
push 0x697568
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x238]
call fcn.004c6710
mov ecx, eax
call fcn.00413a70
lea ecx, [ebp - 0x288]
call fcn.00413870
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xffffffff
jne 0x4c0a5c
mov dword [ebp - 0x298], 0
lea ecx, [ebp - 0x238]
call fcn.0044b120
lea ecx, [ebp - 0x248]
call fcn.0044b120
mov eax, dword [ebp - 0x298]
jmp 0x4c0bae
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x2a4], 0xffffffff
cmp dword [ebp + 0xc], 0
jne 0x4c0aa1
lea eax, [ebp - 0x248]
mov dword [ebp - 0x28c], eax
jmp 0x4c0aad
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x28c], ecx
mov edx, dword [ebp - 0x28c]
mov dword [ebp - 0x29c], edx
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x290], eax
lea ecx, [ebp - 0x23c]
push ecx
mov ecx, dword [ebp - 0x290]
call fcn.00418b90
jmp 0x4c0aed
push 0
lea edx, [ebp - 0x2a8]
push edx
lea ecx, [ebp - 0x23c]
call fcn.0042ed80
lea eax, [ebp - 0x2ac]
push eax
mov ecx, dword [ebp - 0x290]
call fcn.00418cd0
push eax
lea ecx, [ebp - 0x23c]
call fcn.00413ae0
movzx ecx, al
test ecx, ecx
je 0x4c0b5e
lea ecx, [ebp - 0x23c]
call fcn.00413b70
mov ecx, eax
call fcn.0040d3c0
push eax
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4c0b59
lea ecx, [ebp - 0x23c]
call fcn.00413b70
add eax, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d360
mov dword [ebp - 0x294], 1
jmp 0x4c0b5e
jmp 0x4c0ad9
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4c0ac5
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x2a0], eax
lea ecx, [ebp - 0x238]
call fcn.0044b120
lea ecx, [ebp - 0x248]
call fcn.0044b120
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret