Function at 0x418120
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.SetupWhitelist_started
push dword [0x502db0]
xor eax, eax
mov edi, ecx
mov dword [ebp - 0xa0c], eax
call fcn.004403a0
push dword [0x502db0]
call fcn.004400a0
lea ebx, [edi + 0x515c]
add esp, 0xc
mov dword [ebp - 0xa18], ebx
test ebx, ebx
je 0x41818d
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418173
sub ecx, edx
je 0x41818d
mov dword [ebp - 0xa0c], ebx
mov byte [ebp - 0xa01], 0x7c
jmp 0x4181c2
cmp dword [edi + 0x454], 0
je 0x4181b6
push 0x46e2b4
push 0x67
mov ecx, 0x50fb40
call fcn.0040f920
mov dword [ebp - 0xa0c], eax
mov byte [ebp - 0xa01], 0xa
jmp 0x4181c2
mov al, byte [ebp - 0xa01]
mov byte [ebp - 0xa01], al
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push 0
call esi
push eax
push dword [0x502db0]
call fcn.0043f650
add esp, 0xc
mov dword [ebp - 0xa08], 0
push 0
push 0x40000002
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
call esi
mov ecx, dword [ebp - 0xa08]
mov dword [edi + ecx*4 + 0xb1f0], eax
inc dword [ebp - 0xa08]
cmp ebx, 0xffffffff
je 0x4182e0
lea eax, [ebp - 0xa00]
mov dword [ebp - 0xa00], pe_nt_image_headers32
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4182d9
cmp dword [ebp - 0x9e8], 0
je 0x4182c4
push 0x4197b0
push 4
lea eax, [ebp - 0xa08]
push eax
lea esi, [edi + 0xb1f0]
lea eax, [ebp - 0x9e8]
push esi
push eax
call fcn.00452a74
add esp, 0x14
test eax, eax
je 0x4182c4
push 0x4197b0
push 4
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0x9f8]
push esi
push eax
call fcn.00452a74
add esp, 0x14
test eax, eax
jne 0x4182c4
mov ecx, dword [ebp - 0xa08]
mov eax, dword [ebp - 0x9f8]
push 0
mov dword [edi + ecx*4 + 0xb1f0], eax
push dword [ebp - 0x9f8]
inc dword [ebp - 0xa08]
push dword [0x502db0]
call fcn.0043f650
add esp, 0xc
push 0
push 0x40000002
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0xa00]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x418230
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push str.after_AddSafeProcess
push dword [0x502db0]
call fcn.004403a0
mov esi, dword [ebp - 0xa0c]
add esp, 8
test esi, esi
je 0x4184aa
push str.safeList_not_equal_to_null
push dword [0x502db0]
call fcn.004403a0
movsx eax, byte [ebp - 0xa01]
mov ebx, esi
push eax
push esi
mov dword [ebp - 0xa14], eax
call fcn.00454913
add esp, 0x10
mov dword [ebp - 0xa08], eax
test eax, eax
je 0x418390
mov ecx, eax
sub ecx, ebx
cmp byte [eax - 1], 0xd
lea eax, [ebp - 0x108]
lea esi, [ecx - 1]
cmovne esi, ecx
push esi
push ebx
push 0x104
push eax
call fcn.00453cb2
add esp, 0x10
cmp esi, 0x104
jae 0x4184bb
mov eax, dword [ebp - 0xa08]
push dword [ebp - 0xa14]
inc eax
mov byte [ebp + esi - 0x108], 0
push eax
mov dword [ebp - 0xa10], eax
call fcn.00454913
add esp, 8
mov dword [ebp - 0xa08], eax
jmp 0x4183ad
push ebx
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00449d78
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xa10], eax
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4183b6
sub ecx, edx
je 0x4183d8
lea eax, [ebp - 0x108]
push eax
push 0
push dword [0x502db0]
call fcn.0043f650
add esp, 0xc
xor esi, esi
push esi
push 0x40000002
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418450
lea eax, [ebp - 0xa00]
mov dword [ebp - 0xa00], pe_nt_image_headers32
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x418449
nop word [eax + eax]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x9dc]
push eax
call fcn.004549c7
add esp, 8
test eax, eax
jne 0x418438
mov eax, dword [ebp - 0x9f8]
mov dword [ebp + esi*4 - 0x8d8], eax
inc esi
lea eax, [ebp - 0xa00]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x418410
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edx, edx
test esi, esi
jle 0x41847f
nop word [eax + eax]
mov ecx, dword [edi + 0xafcc]
mov eax, dword [ebp + edx*4 - 0x8d8]
inc edx
mov dword [edi + ecx*4 + 0xa7fc], eax
inc dword [edi + 0xafcc]
cmp edx, esi
jl 0x418460
mov ebx, dword [ebp - 0xa10]
test ebx, ebx
je 0x418494
mov eax, dword [ebp - 0xa08]
jmp 0x418330
cmp dword [ebp - 0xa18], 0
jne 0x4184aa
mov eax, dword [ebp - 0xa0c]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443fa5
mov esp, ebp
pop ebp
ret
call fcn.004443c2
int3