Function at 0x427b00
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x44e04e
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
mov eax, dword [0x466d98]
xor eax, esp
mov dword [esp + 0x1d0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x466d98]
xor eax, esp
push eax
lea eax, [esp + 0x1e8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1fc]
xor edi, edi
push edi
push 2
mov dword [esp + 0x20], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [esp + 0x14], ebx
cmp ebx, 0xffffffff
mov dword [esp + 0x1f0], edi
mov dword [esp + 0xbc], 0x128
jne 0x427c40
push 1
push 2
lea ecx, [esp + 0x44]
call fcn.00404370
mov byte [esp + 0x1f0], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x40]
push str.CreateToolhelp32Snapshot____of_process_
push eax
call fcn.004073a0
add esp, 8
mov ecx, eax
call fcn.00403e80
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x40]
call fcn.004044d0
mov esi, 0x10
cmp dword [eax + 0x18], esi
mov byte [esp + 0x1f0], 2
jb 0x427bcb
mov eax, dword [eax + 4]
jmp 0x427bce
add eax, 4
push eax
push str.BaseLib::CProcessManage::ProcessPidToGetMsg
push 0x188
push str..ywSMPpubProcessManage.cpp
push 0x5001
call fcn.004075e0
mov ecx, eax
call fcn.0041f2e0
cmp dword [esp + 0x34], esi
jb 0x427c02
mov edx, dword [esp + 0x20]
push edx
call fcn.00433d63
add esp, 4
lea ecx, [esp + 0x88]
mov byte [esp + 0x1f0], 0
call fcn.00404450
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0x8c], vtable.std::ios_base.0
call fcn.004339e9
add esp, 4
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x427f8b
lea ecx, [esp + 0xbc]
push ecx
push ebx
call sub.KERNEL32.dll_Process32First
cmp eax, 1
je 0x427d25
push 1
push 2
lea ecx, [esp + 0x44]
call fcn.00404370
mov byte [esp + 0x1f0], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x40]
push str.Process32First__
push edx
call fcn.004073a0
add esp, 8
mov ecx, eax
call fcn.00403e80
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
call fcn.004044d0
mov esi, 0x10
cmp dword [eax + 0x18], esi
mov byte [esp + 0x1f0], 4
jb 0x427cb1
mov eax, dword [eax + 4]
jmp 0x427cb4
add eax, 4
push eax
push str.BaseLib::CProcessManage::ProcessPidToGetMsg
push 0x193
push str..ywSMPpubProcessManage.cpp
push 0x5001
call fcn.004075e0
mov ecx, eax
call fcn.0041f2e0
cmp dword [esp + 0x34], esi
jb 0x427ce8
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00433d63
add esp, 4
lea ecx, [esp + 0x88]
mov byte [esp + 0x1f0], 0
call fcn.00404450
lea edx, [esp + 0x88]
push edx
mov dword [esp + 0x8c], vtable.std::ios_base.0
call fcn.004339e9
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x427f8b
mov ebp, dword [esp + 0x1f8]
lea esp, [esp]
mov eax, dword [esp + 0xc4]
cmp ebp, eax
je 0x427d52
lea eax, [esp + 0xbc]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x427d30
jmp 0x427f82
push eax
xor edi, edi
push edi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
mov dword [esp + 0x38], ebp
test ebp, ebp
mov bl, 5
mov byte [esp + 0x1f0], bl
jne 0x427e4b
push 1
push 2
lea ecx, [esp + 0x44]
call fcn.00404370
mov byte [esp + 0x1f0], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0xc4]
push eax
push 0x453df0
push ecx
lea edx, [esp + 0x48]
push str.OpenProcess__
push edx
call fcn.004073a0
add esp, 8
mov ecx, eax
call fcn.00403e80
push eax
call fcn.004073a0
add esp, 8
mov ecx, eax
call fcn.00403e80
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
call fcn.004044d0
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0x1f0], 7
jb 0x427deb
mov eax, dword [eax + 4]
jmp 0x427dee
add eax, 4
push eax
push str.BaseLib::CProcessManage::ProcessPidToGetMsg
push 0x1a6
push str..ywSMPpubProcessManage.cpp
push 0x5001
call fcn.004075e0
mov ecx, eax
call fcn.0041f2e0
lea ecx, [esp + 0x1c]
call fcn.00403ce0
lea ecx, [esp + 0x88]
mov byte [esp + 0x1f0], bl
call fcn.00404450
lea ecx, [esp + 0x88]
push ecx
mov dword [esp + 0x8c], vtable.std::ios_base.0
call fcn.004339e9
add esp, 4
jmp 0x427f0c
push ebp
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov edi, eax
test edi, edi
jne 0x427f0c
push 1
push 2
lea ecx, [esp + 0x44]
call fcn.00404370
mov byte [esp + 0x1f0], 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0xc4]
push eax
push 0x453df0
push edx
lea eax, [esp + 0x48]
push str.GetPriorityClass__
push eax
call fcn.004073a0
add esp, 8
mov ecx, eax
call fcn.00403e80
push eax
call fcn.004073a0
add esp, 8
mov ecx, eax
call fcn.00403e80
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x40]
call fcn.004044d0
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0x1f0], 9
jb 0x427ecf
mov eax, dword [eax + 4]
jmp 0x427ed2
add eax, 4
push eax
push str.BaseLib::CProcessManage::ProcessPidToGetMsg
push 0x1af
push str..ywSMPpubProcessManage.cpp
push 0x5001
call fcn.004075e0
mov ecx, eax
call fcn.0041f2e0
lea ecx, [esp + 0x1c]
call fcn.00403ce0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1f0], bl
call fcn.00401b40
mov edx, dword [esp + 0xc4]
lea eax, [esp + 0xe0]
mov dword [esi], edx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x427f20
sub eax, edx
push eax
lea eax, [esp + 0xe4]
push eax
lea ecx, [esi + 4]
call fcn.00405b30
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0xd4]
mov eax, dword [esp + 0xd8]
mov dword [esi + 0x3c], ecx
mov ecx, dword [esp + 0xc4]
mov dword [esi + 0x40], edx
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edi
add esi, 0x20
push esi
push ecx
mov ecx, dword [esp + 0x20]
call fcn.00426820
push ebp
mov edi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x1e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d0]
xor ecx, esp
call fcn.00433d68
add esp, 0x1e0
ret 8