Function at 0x48552a
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14a0
call fcn.004ade10
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x145c], ecx
and dword [ebp - 0x1498], 0
and dword [ebp - 0x1478], 0
push 0x410
push 0
lea eax, [ebp - 0x61c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x410
push 0
lea eax, [ebp - 0xa2c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0x122c]
push eax
call fcn.004b0090
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x485915
push dword [ebp + 8]
push 0x53ff10
push 0x400
lea eax, [ebp - 0x122c]
push eax
call fcn.0041cdb4
add esp, 0x10
cmp dword [ebp - 0x145c], 0
je 0x4855ed
mov eax, dword [ebp - 0x145c]
sub eax, 4
mov dword [ebp - 0x147c], eax
jmp 0x4855f4
and dword [ebp - 0x147c], 0
lea eax, [ebp - 0x122c]
push eax
mov eax, dword [ebp - 0x147c]
add eax, 8
push eax
call fcn.004863e2
pop ecx
pop ecx
push 0x410
push 0
lea eax, [ebp - 0x61c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x207
push dword [ebp + 8]
lea eax, [ebp - 0x61c]
push eax
call fcn.004d9104
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
call fcn.004ce705
pop ecx
cmp dword [ebp - 0x145c], 0
je 0x485660
mov eax, dword [ebp - 0x145c]
sub eax, 4
mov dword [ebp - 0x1480], eax
jmp 0x485667
and dword [ebp - 0x1480], 0
push 0x104
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push eax
mov ecx, dword [ebp - 0x1480]
call fcn.00485b8e
cmp dword [ebp - 0x145c], 0
je 0x48569f
mov eax, dword [ebp - 0x145c]
sub eax, 4
mov dword [ebp - 0x1484], eax
jmp 0x4856a6
and dword [ebp - 0x1484], 0
push 0x104
lea eax, [ebp - 0x61c]
push eax
mov ecx, dword [ebp - 0x1484]
call fcn.0048641c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x1464], eax
cmp dword [ebp - 0x1464], 0xffffffff
je 0x485915
mov dword [ebp - 0x1458], 0x22c
lea eax, [ebp - 0x1458]
push eax
push dword [ebp - 0x1464]
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x1490], eax
cmp dword [ebp - 0x1490], 0
je 0x485902
lea eax, [ebp - 0x1434]
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.004d5f0c
pop ecx
pop ecx
test eax, eax
jne 0x4858db
xor eax, eax
inc eax
imul eax, eax, 0
mov dword [ebp - 0x1488], eax
cmp dword [ebp - 0x1488], 0x208
jae 0x48573f
jmp 0x485744
call fcn.004adf6c
mov eax, dword [ebp - 0x1488]
mov byte [ebp + eax - 0x20c], 0
push dword [ebp - 0x1450]
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1468], eax
cmp dword [ebp - 0x1468], 0
je 0x4857a0
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0x1468]
call sub.PSAPI.DLL_GetModuleFileNameExA
push dword [ebp - 0x1468]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x1468], 0
xor eax, eax
inc eax
imul eax, eax, 0
movsx eax, byte [ebp + eax - 0x20c]
test eax, eax
jne 0x4857cf
push 0x208
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x1450]
mov ecx, dword [ebp - 0x145c]
call fcn.004866aa
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x146c], eax
cmp dword [ebp - 0x146c], 0
jne 0x4857f0
and dword [ebp - 0x148c], 0
jmp 0x4858b7
push dword [ebp - 0x146c]
call fcn.004cc4f3
pop ecx
inc eax
mov dword [ebp - 0x1474], eax
cmp dword [ebp - 0x1474], 0x3fffffff
jle 0x48581b
and dword [ebp - 0x1460], 0
jmp 0x4858ab
mov eax, dword [ebp - 0x1474]
shl eax, 1
call fcn.004ae160
mov dword [ebp - 0x1470], esp
mov eax, dword [ebp - 0x14a0]
mov dword [ebp - 0x1460], eax
cmp dword [ebp - 0x1470], 0
je 0x48584c
cmp dword [ebp - 0x146c], 0
jne 0x485855
and dword [ebp - 0x1460], 0
jmp 0x4858ab
mov eax, dword [ebp - 0x1470]
mov byte [eax], 0
push 0
push 0
mov eax, dword [ebp - 0x1474]
shl eax, 1
push eax
push dword [ebp - 0x1470]
push 0xffffffffffffffff
push dword [ebp - 0x146c]
push 0
push dword [ebp - 0x1498]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x149c], eax
cmp dword [ebp - 0x149c], 0
jne 0x48589f
and dword [ebp - 0x1460], 0
jmp 0x4858ab
mov eax, dword [ebp - 0x1470]
mov dword [ebp - 0x1460], eax
mov eax, dword [ebp - 0x1460]
mov dword [ebp - 0x148c], eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x148c]
call fcn.004d9182
pop ecx
pop ecx
test eax, eax
jne 0x4858db
mov dword [ebp - 0x1478], 1
jmp 0x485902
mov dword [ebp - 0x1458], 0x22c
lea eax, [ebp - 0x1458]
push eax
push dword [ebp - 0x1464]
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x1490], eax
jmp 0x4856fb
push dword [ebp - 0x1464]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x1464], 0xffffffff
push dword [ebp - 0x1478]
push dword [ebp + 8]
push str.CheckProcessIsRuningByName_AddShell__s__return__d
push 0x400
lea eax, [ebp - 0x122c]
push eax
call fcn.0041cdb4
add esp, 0x14
cmp dword [ebp - 0x145c], 0
je 0x485951
mov eax, dword [ebp - 0x145c]
sub eax, 4
mov dword [ebp - 0x1494], eax
jmp 0x485958
and dword [ebp - 0x1494], 0
lea eax, [ebp - 0x122c]
push eax
mov eax, dword [ebp - 0x1494]
add eax, 8
push eax
call fcn.004863e2
pop ecx
pop ecx
mov eax, dword [ebp - 0x1478]
lea esp, [ebp - 0x14a0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4