Function at 0x4523a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511df0
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor esi, esi
test ebx, ebx
je 0x4525de
cmp dword [ebx + 0x158], 4
jbe 0x4525de
push 0x22c
lea eax, [ebp - 0x26c]
push esi
push eax
call fcn.004ab2f0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
je 0x4525de
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4525d2
add ebx, 0x148
mov dword [ebp - 0x278], ebx
nop
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00402400
add esp, 8
cmp dword [ebx + 0x14], 8
mov dword [ebp - 4], 0
jb 0x452464
mov eax, dword [ebx]
jmp 0x452466
mov eax, ebx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004024f0
add esp, 8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
mov esi, dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
cmp edx, 0x10
mov byte [ebp - 4], 1
lea ebx, [ebp - 0x40]
cmovae eax, esi
cmovae ecx, esi
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x30]
add eax, ecx
cmp edx, 0x10
mov edi, eax
cmovae ebx, esi
xor ecx, ecx
sub edi, ebx
xor esi, esi
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x4524d3
movsx ax, byte [esi + ebx]
movzx eax, ax
push eax
call fcn.004bec3d
mov ecx, dword [ebp - 0x270]
add esp, 4
mov byte [esi + ecx], al
inc esi
cmp esi, edi
jne 0x4524b1
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmp esi, 0x10
lea ebx, [ebp - 0x28]
cmovae eax, edi
cmovae ecx, edi
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x18]
add eax, ecx
cmp esi, 0x10
cmovae ebx, edi
mov edi, eax
sub edi, ebx
xor ecx, ecx
xor esi, esi
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x452532
nop dword [eax]
movsx ax, byte [esi + ebx]
movzx eax, ax
push eax
call fcn.004bec3d
mov ecx, dword [ebp - 0x270]
add esp, 4
mov byte [esi + ecx], al
inc esi
cmp esi, edi
jne 0x452510
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 0x10
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004acf10
add esp, 8
test eax, eax
jne 0x4525b9
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x45256a
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004092a0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x10
jb 0x452598
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004092a0
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x274]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4525d0
mov ebx, dword [ebp - 0x278]
jmp 0x452440
lea ecx, [ebp - 0x28]
mov esi, 1
call fcn.00408cf0
lea ecx, [ebp - 0x40]
call fcn.00408cf0
jmp 0x4525d2
xor esi, esi
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret