Function at 0x40af7d
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x49d30d
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x164
push ebx
xor ebx, ebx
push esi
push edi
push ecx
pop esi
push ebx
pop dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0x49e2f4
push ebx
pop dword [ebp - 0x28]
push ebx
pop dword [ebp - 0x24]
push ebx
push 2
push ebx
pop dword [ebp - 4]
call dword [0x4dfc64]
cmp eax, 0xffffffff
push eax
pop dword [ebp - 0x18]
je 0x40afd0
push 0xae
push 0x4d56d8
call fcn.0040aab2
test eax, eax
jne 0x40afe3
push 0xdf3dd1e5
call fcn.00401953
test eax, eax
pop ecx
jne 0x40b1e9
mov edi, 0x128
lea eax, [ebp - 0x170]
push edi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x170]
push edi
pop dword [ebp - 0x170]
push eax
push dword [ebp - 0x18]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40b1e9
push dword [ebp - 0x168]
push ebx
push 0x400
call dword [0x4dfc78]
mov dword [esp - 4], 0
add dword [esp - 4], edi
sub esp, 4
sub edi, eax
pop edi
je 0x40b046
xor edi, edi
lea edi, [eax + edi + 0x5c]
sub edi, 0x5c
mov dword [esp - 4], 0
add dword [esp - 4], edi
sub esp, 4
sub edi, ebx
pop edi
je 0x40b08a
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
call dword [0x4dfc90]
push edi
call dword [0x4dfcf4]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.0040151d
pop ecx
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x40b08e
push ebx
pop dword [ebp - 0x14]
lea eax, [ebp - 0x14c]
push eax
call dword [0x4dfc88]
cmp eax, 0x4f
jg 0x40b19b
mov edi, 0x4d5118
push 0xdeb8ac20
call fcn.00401953
test eax, eax
pop ecx
je 0x40b0f1
xor eax, eax
add eax, dword [edi]
cmp dword [esp - 4], eax
je 0x40b0ce
mov dword [esp - 4], 0
add dword [esp - 4], eax
sub esp, 4
sub eax, ebx
pop eax
je 0x40b0f1
push eax
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40b19b
add edi, 4
jmp 0x40b0a9
push dword [esi + 0xb0]
pop ecx
call fcn.004067cf
push eax
pop edi
lea eax, [ebp - 0x14c]
push eax
call dword [0x4dfc88]
lea edi, [eax + edi + 0x38]
sub edi, 0x38
cmp edi, 0x3da2
jge 0x40b1e9
push dword [esi + 0xb0]
pop ecx
lea eax, [ebp - 0xd]
push 1
push eax
mov byte [ebp - 0xd], 1
call fcn.004065fc
push dword [esi + 0xb0]
pop ecx
lea eax, [ebp - 0x14c]
push eax
call fcn.00406830
push dword [ebp - 0x14]
pop eax
push dword [esi + 0xb0]
pop ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.004065fc
push dword [ebp - 0x168]
pop eax
push dword [esi + 0xb0]
pop ecx
push eax
pop dword [ebp - 0x14]
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.004065fc
push dword [ebp - 0x158]
pop eax
push dword [esi + 0xb0]
pop ecx
push eax
pop dword [ebp - 0x14]
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.004065fc
push 0x1541
push 0xffffd082
push 0xffffe9a7
push 0xffffc069
call fcn.0040ae55
test eax, eax
je 0x40b1cb
lea eax, [ebp - 0x170]
push eax
push dword [ebp - 0x18]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40b1e9
push 0xc05
push 0xffffe877
push 0xfffff2ca
push 0x2fa1
call fcn.0040ae55
jmp 0x40b00f
cmp dword [ebp - 0x18], 0xffffffff
je 0x40b1f8
push dword [ebp - 0x18]
call dword [0x4dfcf4]
push dword [esi + 0xb0]
pop ecx
lea eax, [ebp - 0xd]
push 1
push eax
mov byte [ebp - 0xd], bl
call fcn.004065fc
push dword [ebp - 0xc]
pop ecx
pop edi
pop esi
mov eax, 0x3e8
pop ebx
mov dword fs:[0], ecx
leave
ret 0x24