Function at 0x40be60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f72b
mov eax, dword fs:[0]
push eax
sub esp, 0x314
mov eax, dword [0x450988]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x1c], 0x10
push dword [ebp + 0x18]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x240], 0x22c
mov dword [ebp - 0x14], 0
call fcn.0040b800
add esp, 0xc
push 0
push 2
mov byte [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x240]
push eax
push ebx
mov dword [ebp - 0x244], ebx
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x40c024
lea eax, [ebp - 0x240]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x40c024
sub esp, 0x18
mov edx, esp
xor eax, eax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [ebp - 0x21c], ax
je 0x40bf3f
lea eax, [ebp - 0x21c]
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bf30
sub eax, esi
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
mov ecx, edx
call fcn.004026a0
lea eax, [ebp - 0x260]
push eax
call fcn.0040b730
add esp, 0x1c
cmp dword [ebp + 0x1c], 0x10
mov ecx, eax
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
mov ebx, dword [ecx + 0x10]
jb 0x40bf75
mov ecx, dword [ecx]
mov edi, dword [ebp + 0x18]
cmp ebx, edi
mov edx, edi
cmovb edx, ebx
test edx, edx
je 0x40bfd8
sub edx, 4
jb 0x40bf99
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x40bf9e
add ecx, 4
add esi, 4
sub edx, 4
jae 0x40bf88
cmp edx, 0xfffffffc
je 0x40bfd2
mov al, byte [ecx]
cmp al, byte [esi]
jne 0x40bfcb
cmp edx, 0xfffffffd
je 0x40bfd2
mov al, byte [ecx + 1]
cmp al, byte [esi + 1]
jne 0x40bfcb
cmp edx, 0xfffffffe
je 0x40bfd2
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x40bfcb
cmp edx, 0xffffffff
je 0x40bfd2
mov al, byte [ecx + 3]
cmp al, byte [esi + 3]
je 0x40bfd2
sbb eax, eax
or eax, 1
jmp 0x40bfd4
xor eax, eax
test eax, eax
jne 0x40bfea
cmp ebx, edi
jae 0x40bfe1
or eax, 0xffffffff
jmp 0x40bfe8
xor eax, eax
cmp ebx, edi
setne al
test eax, eax
sete bl
cmp dword [ebp - 0x24c], 0x10
jb 0x40c004
push dword [ebp - 0x260]
call fcn.0040e8c9
add esp, 4
test bl, bl
jne 0x40c067
mov ebx, dword [ebp - 0x244]
lea eax, [ebp - 0x240]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x40bf02
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push dword [ebp - 0x14]
call fcn.0040f054
add esp, 4
cmp dword [ebp + 0x1c], 0x10
jb 0x40c049
push dword [ebp + 8]
call fcn.0040e8c9
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f059
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x320]
call fcn.00407080
lea ecx, [ebp + 8]
push ecx
push 0x441bfc
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00408840
push eax
call fcn.00403fe0
add esp, 8
push eax
call fcn.00403cf0
add esp, 8
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 1
call fcn.004073d0
push dword [ebp - 0x238]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
jmp 0x40c02d