Function at 0x43ac40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x553373
mov eax, dword fs:[0]
push eax
sub esp, 0x174
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
mov dword [ebp - 0x168], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43ac90
xor al, al
jmp 0x43aecc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.0042ec60
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x180]
call fcn.0042d0b0
mov esi, eax
lea eax, [ebp - 0x40]
cmp eax, esi
je 0x43acee
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x43acd3
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00427a30
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
call fcn.004278c0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x16c]
cmp eax, 0x10
jb 0x43ad10
inc eax
lea ecx, [ebp - 0x180]
push eax
push dword [ebp - 0x180]
call fcn.00427a30
lea eax, [ebp - 0x168]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x43aeae
nop word [eax + eax]
mov edx, dword [ebp - 0x160]
lea ecx, [ebp - 0x28]
call fcn.0042ec60
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x180]
call fcn.0042d0b0
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x43ad89
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x43ad6e
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00427a30
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004278c0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x16c]
cmp eax, 0x10
jb 0x43adab
inc eax
lea ecx, [ebp - 0x180]
push eax
push dword [ebp - 0x180]
call fcn.00427a30
push dword [ebp - 0x30]
lea eax, [ebp - 0x180]
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.004272e0
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x43adf8
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x43addd
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00427a30
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004278c0
mov eax, dword [ebp - 0x16c]
cmp eax, 0x10
jb 0x43ae16
inc eax
lea ecx, [ebp - 0x180]
push eax
push dword [ebp - 0x180]
call fcn.00427a30
mov esi, dword [ebp - 0x18]
test esi, esi
sete al
test al, al
jne 0x43ae7d
cmp dword [ebp - 0x2c], 0x10
lea edx, [ebp - 0x40]
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x40]
mov eax, edi
cmp dword [ebp - 0x14], 0x10
cmovae ecx, dword [ebp - 0x28]
cmp esi, edi
cmovb eax, esi
push eax
call fcn.004266d0
add esp, 4
test eax, eax
jne 0x43ae61
cmp esi, edi
jae 0x43ae58
or eax, 0xffffffff
jmp 0x43ae5f
xor eax, eax
cmp esi, edi
setne al
test eax, eax
sete al
test al, al
je 0x43ae7d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x160]
cmp eax, ecx
je 0x43ae7d
call fcn.0042d4b0
lea eax, [ebp - 0x168]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
mov byte [ebp - 4], 0
mov esi, eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x43aea6
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00427a30
test esi, esi
jne 0x43ad30
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x43aeca
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00427a30
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
ret