Function at 0x495dc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58f086
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x610304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push esi
push 2
xor ebx, ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x495e45
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str._Util::NetBar::IsNetBarEnv__CreateToolhelp32Snapshot_failed__last_error:_d_n
push 0x5af9d8
push 2
push str.Util::NetBar::IsNetBarEnv
push 0x1b5
push str.E:_txupdatecoding_baseutilfunNetBar.cpp
call fcn.00452950
add esp, 0x1c
call esi
push eax
push str._Util::NetBar::IsNetBarEnv__CreateToolhelp32Snapshot_failed__last_error:_d_n
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 8
xor eax, eax
jmp 0x496011
lea eax, [ebp - 0x23c]
push eax
push edi
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x495eab
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str._Util::NetBar::IsNetBarEnv__Process32First_failed__last_error:_d_n
push 0x5af9d8
push 2
push str.Util::NetBar::IsNetBarEnv
push 0x1c2
push str.E:_txupdatecoding_baseutilfunNetBar.cpp
call fcn.00452950
add esp, 0x1c
call esi
push eax
push str._Util::NetBar::IsNetBarEnv__Process32First_failed__last_error:_d_n
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 8
xor eax, eax
jmp 0x496011
lea ecx, [ebp - 0x240]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
mov dword [ebp - 4], esi
mov dword [ebp - 0x248], 0
mov ecx, dword [ebp - 0x234]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x244]
push ecx
mov dword [ebp - 0x244], 0xffffffff
call fcn.00495c10
add esp, 0x10
test eax, eax
jne 0x495f36
cmp dword [ebp - 0x244], 0xffffffff
je 0x495f23
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x240]
add esi, 0xa
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__
push 0x5aa3a4
lea ecx, [ebp - 0x240]
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x495ec3
jmp 0x495f5b
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x240]
add esi, 0x14
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__
push 0x5aa3a4
lea ecx, [ebp - 0x240]
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__
cmp esi, 0x14
jb 0x495ff6
lea ecx, [ebp - 0x244]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
push esi
lea edx, [ebp - 0x244]
push 0x5afbe8
mov ebx, 1
push edx
mov byte [ebp - 4], bl
call sym.txupd.exe_public:_void___cdecl_CTXStringW::Format_wchar_t_const__
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x240]
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_class_CTXStringW_const__
lea ecx, [ebp - 0x240]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push str.current_env_maybe_cybercafe:__s__n
push 0x5af9d8
push 2
push str.Util::NetBar::IsNetBarEnv
push 0x1e1
push str.E:_txupdatecoding_baseutilfunNetBar.cpp
call fcn.004587e0
add esp, 0x1c
lea ecx, [ebp - 0x240]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push str.current_env_maybe_cybercafe:__s__n
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 8
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 0
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], 0xffffffff
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00584870
mov esp, ebp
pop ebp
ret