Function at 0x428784
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00428784
xor esi, esi
xor edi, edi
mov ecx, 0x53
push esi
dec ecx
jne 0x4287a0
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x4287d6
jmp 0x428b14
mov eax, 0x128
mov dword [ebp - 0x1c4], eax
lea ebx, [ebp - 0x1c4]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1d0], eax
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x1d0], 0
je 0x428b08
lea ebx, [ebp - 0x1a0]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
lea ebx, [ebp - 0x50]
call fcn.0045a8f0
mov edx, 0x186122c
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x428875
mov eax, dword [ebp - 0x50]
call fcn.00456355
mov edx, 0x1861238
call fcn.0045b687
mov eax, 0x80000020
call fcn.00452ee2
push dword [ebp - 0x1bc]
call fcn.00428b3c
call fcn.00456355
jmp 0x428aea
mov edx, 0x1861240
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x4288c3
mov eax, dword [ebp - 0x50]
call fcn.00456355
mov edx, 0x1861250
call fcn.0045b687
mov eax, 0x80000020
call fcn.00452ee2
push dword [ebp - 0x1bc]
call fcn.00428b3c
call fcn.00456355
jmp 0x428aea
mov edx, 0x186125c
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x428911
mov eax, dword [ebp - 0x50]
call fcn.00456355
mov edx, 0x1861250
call fcn.0045b687
mov eax, 0x80000020
call fcn.00452ee2
push dword [ebp - 0x1bc]
call fcn.00428b3c
call fcn.00456355
jmp 0x428aea
mov edx, 0x1861274
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x42895f
mov eax, dword [ebp - 0x50]
call fcn.00456355
mov edx, 0x1861288
call fcn.0045b687
mov eax, 0x80000020
call fcn.00452ee2
push dword [ebp - 0x1bc]
call fcn.00428b3c
call fcn.00456355
jmp 0x428aea
mov edx, 0x1861294
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x4289ad
mov eax, dword [ebp - 0x50]
call fcn.00456355
mov edx, 0x1861288
call fcn.0045b687
mov eax, 0x80000020
call fcn.00452ee2
push dword [ebp - 0x1bc]
call fcn.00428b3c
call fcn.00456355
jmp 0x428aea
mov edx, 0x18612a8
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x4289fb
mov eax, dword [ebp - 0x50]
call fcn.00456355
mov edx, 0x1861288
call fcn.0045b687
mov eax, 0x80000020
call fcn.00452ee2
push dword [ebp - 0x1bc]
call fcn.00428b3c
call fcn.00456355
jmp 0x428aea
mov edx, 0x18612bc
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x428a49
mov eax, dword [ebp - 0x50]
call fcn.00456355
mov edx, 0x18612d0
call fcn.0045b687
mov eax, 0x80000020
call fcn.00452ee2
push dword [ebp - 0x1bc]
call fcn.00428b3c
call fcn.00456355
jmp 0x428aea
mov edx, 0x18612e0
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x428a97
mov eax, dword [ebp - 0x50]
call fcn.00456355
mov edx, 0x18612d0
call fcn.0045b687
mov eax, 0x80000020
call fcn.00452ee2
push dword [ebp - 0x1bc]
call fcn.00428b3c
call fcn.00456355
jmp 0x428aea
mov edx, 0x18612f4
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x428ae2
mov eax, dword [ebp - 0x50]
call fcn.00456355
mov edx, 0x18612d0
call fcn.0045b687
mov eax, 0x80000020
call fcn.00452ee2
push dword [ebp - 0x1bc]
call fcn.00428b3c
call fcn.00456355
jmp 0x428aea
mov eax, dword [ebp - 0x50]
call fcn.00456355
lea ebx, [ebp - 0x1c4]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1d0], eax
jmp 0x428800
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
call fcn.0045b4f9
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret