Function at 0x6456c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x658455
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x6cd05c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
push eax
push 2
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x294], edi
cmp edi, 0xffffffff
je 0x645fdf
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x64574f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x645fdf
mov edx, 0x6a86f0
lea ecx, [ebp - 0x284]
call fcn.00405a10
mov edx, 0x6a8740
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x29c]
call fcn.00405a10
mov edx, 0x6a8760
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x298]
call fcn.00405a10
mov edx, 0x6a8780
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x280]
call fcn.00405a10
mov edx, 0x6a87a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x27c]
call fcn.00405a10
mov edx, 0x6a8244
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x278]
call fcn.00405a10
mov edx, 0x6a87c0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x274]
call fcn.00405a10
mov edx, 0x6a87e0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x270]
call fcn.00405a10
mov edx, 0x6a8800
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x26c]
call fcn.00405a10
mov edx, 0x6a8820
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x268]
call fcn.00405a10
mov edx, 0x6a8850
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x264]
call fcn.00405a10
mov byte [ebp - 4], 0xb
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
nop dword [eax]
nop word [eax + eax]
movzx eax, word [ebp + esi*2 - 0x234]
push eax
call fcn.0058f0cb
mov word [ebp + esi*2 - 0x234], ax
add esp, 4
inc esi
cmp esi, 0x104
jl 0x645840
cmp word [ebp - 0x234], 0
jne 0x645870
xor ecx, ecx
jmp 0x64588f
lea ecx, [ebp - 0x234]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x645880
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x28]
call fcn.00404770
mov edx, 0x6a81e4
lea ecx, [ebp - 0x288]
call fcn.00405a10
mov edx, dword [eax]
cmp word [edx], 0
jne 0x6458bb
xor ecx, ecx
jmp 0x6458cf
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x6458c0
sub ecx, esi
sar ecx, 1
push ecx
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
mov edx, dword [ebp - 0x288]
mov edi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x64591b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645919
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645919
push 0
push dword [ecx + 4]
call ebx
jmp 0x64591b
call esi
test edi, edi
je 0x645a39
mov edx, 0x6a8870
lea ecx, [ebp - 0x28c]
call fcn.00405a10
mov edx, dword [eax]
cmp word [edx], 0
jne 0x64593f
xor ecx, ecx
jmp 0x645953
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x645944
sub ecx, esi
sar ecx, 1
push ecx
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
mov edx, dword [ebp - 0x28c]
mov edi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x64599f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x64599d
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x64599d
push 0
push dword [ecx + 4]
call ebx
jmp 0x64599f
call esi
mov ecx, dword [ebp - 0x25c]
test edi, edi
mov edx, 0x6a8890
lea eax, [ecx + 1]
cmovne eax, ecx
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x25c], eax
call fcn.00405a10
mov edx, dword [eax]
cmp word [edx], 0
jne 0x6459cf
xor ecx, ecx
jmp 0x6459e3
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x6459d4
sub ecx, esi
sar ecx, 1
push ecx
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
mov edx, dword [ebp - 0x290]
mov edi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x645a2f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645a2d
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645a2d
push 0
push dword [ecx + 4]
call ebx
jmp 0x645a2f
call esi
test edi, edi
jne 0x645a39
inc dword [ebp - 0x25c]
xor edi, edi
cmp dword [ebp - 0x18], edi
jbe 0x645a6b
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
cmp ecx, 8
lea esi, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
movzx eax, word [edx + edi*2]
push eax
call fcn.0058f0fb
mov word [esi + edi*2], ax
add esp, 4
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x645a40
mov eax, dword [ebp - 0x284]
cmp word [eax], 0
jne 0x645a7b
xor edx, edx
jmp 0x645a8f
mov edx, eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x645a80
sub edx, esi
sar edx, 1
push edx
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
test eax, eax
jne 0x645aab
mov eax, dword [ebp - 0x260]
mov byte [eax + 0xc04], 1
mov eax, dword [ebp - 0x280]
cmp word [eax], 0
jne 0x645abb
xor edx, edx
jmp 0x645acf
mov edx, eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x645ac0
sub edx, esi
sar edx, 1
push edx
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
movzx ebx, byte [0x6e8641]
test eax, eax
mov eax, dword [ebp - 0x27c]
mov edi, 1
cmove ebx, edi
mov byte [0x6e8641], bl
cmp word [eax], 0
jne 0x645b01
xor edx, edx
jmp 0x645b15
mov edx, eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x645b06
sub edx, esi
sar edx, 1
push edx
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
test eax, eax
movzx ebx, bl
mov eax, dword [ebp - 0x278]
cmove ebx, edi
mov byte [0x6e8641], bl
cmp word [eax], 0
jne 0x645b3e
xor edx, edx
jmp 0x645b52
mov edx, eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x645b43
sub edx, esi
sar edx, 1
push edx
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
test eax, eax
movzx ebx, bl
mov eax, dword [ebp - 0x274]
cmove ebx, edi
mov byte [0x6e8641], bl
cmp word [eax], 0
jne 0x645b7b
xor edx, edx
jmp 0x645b8f
mov edx, eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x645b80
sub edx, esi
sar edx, 1
push edx
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
test eax, eax
movzx ebx, bl
mov eax, dword [ebp - 0x270]
cmove ebx, edi
mov byte [0x6e8641], bl
cmp word [eax], 0
jne 0x645bb8
xor edx, edx
jmp 0x645bcf
mov edx, eax
lea esi, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x645bc0
sub edx, esi
sar edx, 1
push edx
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
test eax, eax
movzx ebx, bl
mov eax, dword [ebp - 0x26c]
cmove ebx, edi
mov byte [0x6e8641], bl
cmp word [eax], 0
jne 0x645bf8
xor edx, edx
jmp 0x645c0f
mov edx, eax
lea esi, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x645c00
sub edx, esi
sar edx, 1
push edx
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
test eax, eax
movzx ebx, bl
mov eax, dword [ebp - 0x268]
cmove ebx, edi
mov byte [0x6e8641], bl
cmp word [eax], 0
jne 0x645c38
xor edx, edx
jmp 0x645c4f
mov edx, eax
lea esi, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x645c40
sub edx, esi
sar edx, 1
push edx
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
test eax, eax
movzx ebx, bl
mov eax, dword [ebp - 0x264]
cmove ebx, edi
mov byte [0x6e8641], bl
cmp word [eax], 0
jne 0x645c78
xor edx, edx
jmp 0x645c8f
mov edx, eax
lea esi, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x645c80
sub edx, esi
sar edx, 1
push edx
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f1c0
test eax, eax
movzx ecx, bl
lea eax, [ebp - 0x258]
cmove ecx, edi
mov edi, dword [ebp - 0x294]
push eax
push edi
mov byte [0x6e8641], cl
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x645831
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x25c], 1
jle 0x645ce6
mov eax, dword [ebp - 0x260]
add dword [eax], 0x100
mov byte [ebp - 4], 0xa
or ebx, 0xffffffff
mov ecx, dword [ebp - 0x264]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x645d33
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645d2f
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645d2f
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [edx + 4]
call edi
jmp 0x645d39
mov ecx, edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 9
mov eax, ebx
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x645d7d
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645d79
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645d79
push 0
push dword [edx + 4]
call edi
jmp 0x645d7d
mov ecx, edx
call esi
mov byte [ebp - 4], 8
mov eax, ebx
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x645dc1
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645dbd
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645dbd
push 0
push dword [edx + 4]
call edi
jmp 0x645dc1
mov ecx, edx
call esi
mov byte [ebp - 4], 7
mov eax, ebx
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x645e05
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645e01
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645e01
push 0
push dword [edx + 4]
call edi
jmp 0x645e05
mov ecx, edx
call esi
mov byte [ebp - 4], 6
mov eax, ebx
mov ecx, dword [ebp - 0x274]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x645e49
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645e45
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645e45
push 0
push dword [edx + 4]
call edi
jmp 0x645e49
mov ecx, edx
call esi
mov byte [ebp - 4], 5
mov eax, ebx
mov ecx, dword [ebp - 0x278]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x645e8d
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645e89
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645e89
push 0
push dword [edx + 4]
call edi
jmp 0x645e8d
mov ecx, edx
call esi
mov byte [ebp - 4], 4
mov eax, ebx
mov ecx, dword [ebp - 0x27c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x645ed1
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645ecd
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645ecd
push 0
push dword [edx + 4]
call edi
jmp 0x645ed1
mov ecx, edx
call esi
mov byte [ebp - 4], 3
mov eax, ebx
mov ecx, dword [ebp - 0x280]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x645f15
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645f11
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645f11
push 0
push dword [edx + 4]
call edi
jmp 0x645f15
mov ecx, edx
call esi
mov byte [ebp - 4], 2
mov eax, ebx
mov ecx, dword [ebp - 0x298]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x645f59
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645f55
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645f55
push 0
push dword [edx + 4]
call edi
jmp 0x645f59
mov ecx, edx
call esi
mov byte [ebp - 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0x29c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x645f9d
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645f99
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645f99
push 0
push dword [edx + 4]
call edi
jmp 0x645f9d
mov ecx, edx
call esi
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x284]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x645fdf
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x645fdb
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x645fdb
push 0
push dword [edx + 4]
call edi
jmp 0x645fdf
mov ecx, edx
call esi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x646038
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x7fffffff
jbe 0x645ff7
call fcn.0058a3fd
add eax, eax
cmp eax, 0x1000
jb 0x64602f
test byte [ebp - 0x28], 0x1f
je 0x64600b
call fcn.0058a3fd
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x646017
call fcn.0058a3fd
sub ecx, eax
cmp ecx, 4
jae 0x646023
call fcn.0058a3fd
cmp ecx, 0x23
jbe 0x64602d
call fcn.0058a3fd
mov ecx, eax
push ecx
call fcn.0044e231
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00583e60
mov esp, ebp
pop ebp
ret