Function at 0x41b340
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b1ad
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x46f080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x58]
push eax
call fcn.0041b180
add esp, 4
xor esi, esi
mov dword [ebp - 4], 0
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x194]
push 0x124
push esi
push eax
mov dword [ebp - 0x1a4], edi
call fcn.00435b30
add esp, 0xc
mov dword [ebp - 0x198], 0x128
lea eax, [ebp - 0x198]
push eax
push edi
call sub.KERNEL32.dll_Process32First
mov edi, dword [ebp - 0x58]
test eax, eax
je 0x41b6a2
xorps xmm0, xmm0
mov dword [ebp - 0x1a8], esi
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x30], esi
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b3e5
sub ecx, edx
lea eax, [ebp - 0x174]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00406110
mov ecx, dword [ebp - 0x48]
mov eax, 0x7fffffff
sub eax, ecx
mov byte [ebp - 4], 1
cmp eax, 4
jb 0x41b708
add ecx, 4
mov dword [ebp - 0x1ac], ecx
cmp dword [ebp - 0x44], 0xf
lea edi, [ebp - 0x58]
mov eax, 0xf
lea esi, [ebp - 0x28]
cmova edi, dword [ebp - 0x58]
xorps xmm0, xmm0
mov edx, 0x16
movups xmmword [ebp - 0x28], xmm0
cmp ecx, eax
jbe 0x41b484
mov eax, ecx
or eax, 0xf
cmp eax, 0x7fffffff
jbe 0x41b454
mov eax, 0x7fffffff
jmp 0x41b45a
cmp eax, 0x16
cmovb eax, edx
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00406010
mov ecx, dword [ebp - 0x1ac]
mov esi, eax
mov eax, dword [ebp - 0x1a0]
add esp, 8
mov dword [ebp - 0x28], esi
push dword [ebp - 0x48]
mov dword [ebp - 0x18], ecx
push edi
push esi
mov dword [ebp - 0x14], eax
call fcn.004355b0
mov eax, dword [ebp - 0x48]
add esp, 0xc
mov dword [eax + esi], 0x6578652e
mov byte [esi + eax + 4], 0
xorps xmm0, xmm0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x60], 0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x5c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b4c8
sub ecx, edx
lea eax, [ebp - 0x174]
push ecx
push eax
lea ecx, [ebp - 0x70]
call fcn.00406110
cmp dword [ebp - 0x14], 0xf
lea ecx, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x70]
seta byte [ebp - 0x199]
mov esi, dword [ebp - 0x60]
cmova ecx, edi
cmp dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x1a0], eax
seta byte [ebp - 0x19b]
cmova edx, eax
cmp esi, dword [ebp - 0x18]
jne 0x41b577
sub esi, 4
jb 0x41b531
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x41b536
add edx, 4
add ecx, 4
sub esi, 4
jae 0x41b520
cmp esi, 0xfffffffc
je 0x41b56a
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x41b563
cmp esi, 0xfffffffd
je 0x41b56a
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x41b563
cmp esi, 0xfffffffe
je 0x41b56a
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x41b563
cmp esi, 0xffffffff
je 0x41b56a
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x41b56a
sbb eax, eax
or eax, 1
jmp 0x41b56c
xor eax, eax
mov byte [ebp - 0x19a], 1
test eax, eax
je 0x41b57e
mov byte [ebp - 0x19a], 0
cmp byte [ebp - 0x19b], 0
je 0x41b5b9
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1a0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41b5af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b70d
push ecx
push edx
call fcn.00433d61
add esp, 8
cmp byte [ebp - 0x199], 0
mov byte [ebp - 4], 1
je 0x41b5f2
mov ecx, dword [ebp - 0x14]
mov eax, edi
inc ecx
cmp ecx, 0x1000
jb 0x41b5e8
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b70d
push ecx
push edi
call fcn.00433d61
add esp, 8
mov eax, dword [ebp - 0x1a8]
cmp byte [ebp - 0x19a], 0
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
lea esi, [eax + 1]
cmove esi, eax
cmp ecx, 0xf
jbe 0x41b63d
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41b633
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b70d
push ecx
push edx
call fcn.00433d61
add esp, 8
lea eax, [ebp - 0x198]
push eax
push dword [ebp - 0x1a4]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x41b69f
xorps xmm0, xmm0
mov dword [ebp - 0x1a8], esi
lea eax, [ebp - 0x174]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b677
sub eax, edx
lea ecx, [ebp - 0x40]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.00406110
mov ecx, dword [ebp - 0x1ac]
mov byte [ebp - 4], 1
jmp 0x41b41e
mov edi, dword [ebp - 0x58]
push dword [ebp - 0x1a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x44]
cmp esi, 2
setge al
mov byte [ebp - 0x199], al
cmp ecx, 0xf
jbe 0x41b6ed
inc ecx
mov eax, edi
cmp ecx, 0x1000
jb 0x41b6dd
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b70d
push ecx
push edi
call fcn.00433d61
mov al, byte [ebp - 0x199]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00433fc5
mov esp, ebp
pop ebp
ret
call fcn.0040c670
call fcn.00438c9f
int3