Function at 0x4057d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5cc
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push ecx
push ecx
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4057fb
jmp 0x405826
mov dword [ebp - 0x548], 0x128
lea eax, [ebp - 0x548]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32First
push edx
push edx
test eax, eax
jne 0x40584e
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x29
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00403ace
jmp 0x405abc
mov dword [esp + 4], 0x20000
lea eax, [ebp - 0x584]
mov dword [esp], eax
call fcn.0040eefc
mov dword [esp], str.psapi.dll
call fcn.004051aa
mov dword [esp + 4], str.GetModuleFileNameExA
mov dword [esp], eax
call fcn.004051be
mov esi, eax
test eax, eax
jne 0x4058a4
mov dword [esp], 0x4109df
call fcn.004051aa
mov dword [esp + 4], str.GetModuleFileNameExA
mov dword [esp], eax
call fcn.004051be
mov esi, eax
mov eax, dword [ebp - 0x540]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x410
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
mov edi, eax
test eax, eax
setne byte [ebp - 0x599]
je 0x4058fc
test esi, esi
je 0x4058fc
mov dword [esp + 0xc], 0x104
lea eax, [ebp - 0x21c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edi
call esi
sub esp, 0x10
test eax, eax
jne 0x40590a
mov byte [ebp - 0x21c], 0x2d
mov byte [ebp - 0x21b], 0
lea eax, [ebp - 0x58c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x594]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_GetProcessTimes
sub esp, 0x14
xor edx, edx
test eax, eax
je 0x405943
xor edx, edx
cmp dword [ebp - 0x594], 0
setne dl
test edx, edx
je 0x4059c3
lea eax, [ebp - 0x578]
mov dword [esp + 4], eax
lea eax, [ebp - 0x594]
mov dword [esp], eax
call sub.KERNEL32.dll_FileTimeToSystemTime
push eax
push eax
movzx eax, word [ebp - 0x56c]
mov dword [esp + 0x20], eax
movzx eax, word [ebp - 0x56e]
mov dword [esp + 0x1c], eax
movzx eax, word [ebp - 0x570]
mov dword [esp + 0x18], eax
movzx eax, word [ebp - 0x578]
mov dword [esp + 0x14], eax
movzx eax, word [ebp - 0x576]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x572]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._.2d__.2d__d__.2d:_.2d:_.2d
mov dword [esp + 4], 0x20
lea eax, [ebp - 0x568]
mov dword [esp], eax
call fcn.004099d7
jmp 0x4059d1
mov byte [ebp - 0x568], 0x2d
mov byte [ebp - 0x567], 0
cmp byte [ebp - 0x599], 0
je 0x4059e3
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
push ecx
lea eax, [ebp - 0x568]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x21c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x540]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x524]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_a_d_a_s_a_s_a
mov dword [esp + 4], 0x204
lea edi, [ebp - 0x420]
mov dword [esp], edi
call fcn.004099d7
cmp eax, 0xffffffff
je 0x405a44
mov dword [esp + 8], eax
mov dword [esp + 4], edi
lea eax, [ebp - 0x584]
mov dword [esp], eax
call fcn.0040efba
lea eax, [ebp - 0x548]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
push edx
push edx
test eax, eax
jne 0x4058a4
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
push eax
mov eax, dword [ebp - 0x57c]
test eax, eax
je 0x405a8b
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x584]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x28
jmp 0x405aa3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x29
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00403ace
lea eax, [ebp - 0x584]
mov dword [esp], eax
call fcn.0040ef43
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret