Function at 0x401748
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
mov edi, 0x4040ec
push edi
push ebx
mov dword [esp + 0x18], eax
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
cmp dword [esp + 0x10], 0xffffffff
je 0x4019b7
push edi
push ebx
mov dword [esp + 0x1c], 0x128
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32First
jmp 0x401945
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push 1
push 0xffffffffffffffff
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x14c]
call fcn.00403035
add esp, 0x10
push edi
push ebx
test eax, eax
je 0x4019c4
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401857
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
jmp 0x4019b9