Function at 0x41a980
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.SetupWhitelist_started
push 1
push dword [0x50c768]
xor eax, eax
mov edi, ecx
mov dword [ebp - 0xa0c], eax
call fcn.00444090
push dword [0x50c768]
call fcn.00443d90
lea ebx, [edi + 0x55fc]
add esp, 0x10
mov dword [ebp - 0xa14], ebx
test ebx, ebx
je 0x41a9ef
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a9d5
sub ecx, edx
je 0x41a9ef
mov dword [ebp - 0xa0c], ebx
mov byte [ebp - 0xa01], 0x7c
jmp 0x41aa24
cmp dword [edi + 0x454], 0
je 0x41aa18
push 0x472b78
push 0x67
mov ecx, 0x51efe8
call fcn.00411610
mov dword [ebp - 0xa0c], eax
mov byte [ebp - 0xa01], 0xa
jmp 0x41aa24
mov al, byte [ebp - 0xa01]
mov byte [ebp - 0xa01], al
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
call esi
push eax
push dword [0x50c768]
call fcn.00443270
add esp, 0xc
mov dword [ebp - 0xa08], 0
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
call esi
mov ecx, dword [ebp - 0xa08]
mov dword [edi + ecx*4 + 0xe15c], eax
inc dword [ebp - 0xa08]
cmp ebx, 0xffffffff
je 0x41ab42
lea eax, [ebp - 0xa00]
mov dword [ebp - 0xa00], 0x128
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x41ab3b
cmp dword [ebp - 0x9e8], 0
je 0x41ab26
push 0x41c1f0
push 4
lea eax, [ebp - 0xa08]
push eax
lea esi, [edi + 0xe15c]
lea eax, [ebp - 0x9e8]
push esi
push eax
call fcn.00456844
add esp, 0x14
test eax, eax
je 0x41ab26
push 0x41c1f0
push 4
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0x9f8]
push esi
push eax
call fcn.00456844
add esp, 0x14
test eax, eax
jne 0x41ab26
mov ecx, dword [ebp - 0xa08]
mov eax, dword [ebp - 0x9f8]
push 0
mov dword [edi + ecx*4 + 0xe15c], eax
push dword [ebp - 0x9f8]
inc dword [ebp - 0xa08]
push dword [0x50c768]
call fcn.00443270
add esp, 0xc
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0xa00]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41aa92
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.after_AddSafeProcess
push 1
push dword [0x50c768]
call fcn.00444090
mov esi, dword [ebp - 0xa0c]
add esp, 0xc
test esi, esi
je 0x41ac94
push str.safeList_not_equal_to_null
push 1
push dword [0x50c768]
call fcn.00444090
movsx eax, byte [ebp - 0xa01]
mov ebx, esi
push eax
push esi
mov dword [ebp - 0xa10], eax
call fcn.00458755
add esp, 0x14
mov dword [ebp - 0xa08], eax
test eax, eax
je 0x41abf0
mov ecx, eax
sub ecx, ebx
cmp byte [eax - 1], 0xd
lea eax, [ebp - 0x108]
lea esi, [ecx - 1]
cmovne esi, ecx
push esi
push ebx
push 0x104
push eax
call fcn.00457c81
add esp, 0x10
cmp esi, 0x104
jae 0x41aca5
mov ebx, dword [ebp - 0xa08]
push dword [ebp - 0xa10]
inc ebx
mov byte [ebp + esi - 0x108], 0
push ebx
call fcn.00458755
add esp, 8
mov dword [ebp - 0xa08], eax
jmp 0x41ac07
push ebx
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0044db48
add esp, 0xc
xor ebx, ebx
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ac10
sub ecx, edx
je 0x41ac32
lea eax, [ebp - 0x108]
push eax
push 0
push dword [0x50c768]
call fcn.00443270
add esp, 0xc
lea eax, [ebp - 0x8d8]
mov ecx, edi
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00415f80
mov esi, eax
xor edx, edx
test esi, esi
jle 0x41ac6f
nop
mov ecx, dword [edi + 0xde34]
mov eax, dword [ebp + edx*4 - 0x8d8]
inc edx
mov dword [edi + ecx*4 + 0xd664], eax
inc dword [edi + 0xde34]
cmp edx, esi
jl 0x41ac50
test ebx, ebx
je 0x41ac7e
mov eax, dword [ebp - 0xa08]
jmp 0x41ab96
cmp dword [ebp - 0xa14], 0
jne 0x41ac94
mov eax, dword [ebp - 0xa0c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447cbd
mov esp, ebp
pop ebp
ret
call fcn.004480d3
int3