Function at 0x452600
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511df0
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor esi, esi
test ebx, ebx
je 0x45283e
cmp dword [ebx + 0x170], 4
jbe 0x45283e
push 0x22c
lea eax, [ebp - 0x26c]
push esi
push eax
call fcn.004ab2f0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
je 0x45283e
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x452832
add ebx, 0x160
mov dword [ebp - 0x278], ebx
nop
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00402400
add esp, 8
cmp dword [ebx + 0x14], 8
mov dword [ebp - 4], 0
jb 0x4526c4
mov eax, dword [ebx]
jmp 0x4526c6
mov eax, ebx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004024f0
add esp, 8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
mov esi, dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
cmp edx, 0x10
mov byte [ebp - 4], 1
lea ebx, [ebp - 0x40]
cmovae eax, esi
cmovae ecx, esi
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x30]
add eax, ecx
cmp edx, 0x10
mov edi, eax
cmovae ebx, esi
xor ecx, ecx
sub edi, ebx
xor esi, esi
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x452733
movsx ax, byte [esi + ebx]
movzx eax, ax
push eax
call fcn.004bec3d
mov ecx, dword [ebp - 0x270]
add esp, 4
mov byte [esi + ecx], al
inc esi
cmp esi, edi
jne 0x452711
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmp esi, 0x10
lea ebx, [ebp - 0x28]
cmovae eax, edi
cmovae ecx, edi
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x18]
add eax, ecx
cmp esi, 0x10
cmovae ebx, edi
mov edi, eax
sub edi, ebx
xor ecx, ecx
xor esi, esi
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x452792
nop dword [eax]
movsx ax, byte [esi + ebx]
movzx eax, ax
push eax
call fcn.004bec3d
mov ecx, dword [ebp - 0x270]
add esp, 4
mov byte [esi + ecx], al
inc esi
cmp esi, edi
jne 0x452770
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 0x10
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004acf10
add esp, 8
test eax, eax
jne 0x452819
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4527ca
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004092a0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x10
jb 0x4527f8
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004092a0
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x274]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x452830
mov ebx, dword [ebp - 0x278]
jmp 0x4526a0
lea ecx, [ebp - 0x28]
mov esi, 1
call fcn.00408cf0
lea ecx, [ebp - 0x40]
call fcn.00408cf0
jmp 0x452832
xor esi, esi
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret