Function at 0x427f54
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00427f54
xor esi, esi
xor edi, edi
mov ecx, 0x53
push esi
dec ecx
jne 0x427f70
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x427fa6
jmp 0x4282e4
mov eax, 0x128
mov dword [ebp - 0x1c4], eax
lea ebx, [ebp - 0x1c4]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1d0], eax
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x1d0], 0
je 0x4282d8
lea ebx, [ebp - 0x1a0]
call fcn.0045ce8d
xor eax, eax
call fcn.00452fc5
lea ebx, [ebp - 0x50]
call fcn.0045c323
mov edx, 0x186307c
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x428045
mov eax, dword [ebp - 0x50]
call fcn.00457d88
mov edx, 0x1863088
call fcn.0045d0ba
mov eax, 0x80000020
call fcn.00454915
push dword [ebp - 0x1bc]
call fcn.0042830c
call fcn.00457d88
jmp 0x4282ba
mov edx, 0x1863090
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x428093
mov eax, dword [ebp - 0x50]
call fcn.00457d88
mov edx, 0x18630a0
call fcn.0045d0ba
mov eax, 0x80000020
call fcn.00454915
push dword [ebp - 0x1bc]
call fcn.0042830c
call fcn.00457d88
jmp 0x4282ba
mov edx, 0x18630ac
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x4280e1
mov eax, dword [ebp - 0x50]
call fcn.00457d88
mov edx, 0x18630a0
call fcn.0045d0ba
mov eax, 0x80000020
call fcn.00454915
push dword [ebp - 0x1bc]
call fcn.0042830c
call fcn.00457d88
jmp 0x4282ba
mov edx, 0x18630c4
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x42812f
mov eax, dword [ebp - 0x50]
call fcn.00457d88
mov edx, 0x18630d8
call fcn.0045d0ba
mov eax, 0x80000020
call fcn.00454915
push dword [ebp - 0x1bc]
call fcn.0042830c
call fcn.00457d88
jmp 0x4282ba
mov edx, 0x18630e4
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x42817d
mov eax, dword [ebp - 0x50]
call fcn.00457d88
mov edx, 0x18630d8
call fcn.0045d0ba
mov eax, 0x80000020
call fcn.00454915
push dword [ebp - 0x1bc]
call fcn.0042830c
call fcn.00457d88
jmp 0x4282ba
mov edx, 0x18630f8
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x4281cb
mov eax, dword [ebp - 0x50]
call fcn.00457d88
mov edx, 0x18630d8
call fcn.0045d0ba
mov eax, 0x80000020
call fcn.00454915
push dword [ebp - 0x1bc]
call fcn.0042830c
call fcn.00457d88
jmp 0x4282ba
mov edx, 0x186310c
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x428219
mov eax, dword [ebp - 0x50]
call fcn.00457d88
mov edx, 0x1863120
call fcn.0045d0ba
mov eax, 0x80000020
call fcn.00454915
push dword [ebp - 0x1bc]
call fcn.0042830c
call fcn.00457d88
jmp 0x4282ba
mov edx, 0x1863130
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x428267
mov eax, dword [ebp - 0x50]
call fcn.00457d88
mov edx, 0x1863120
call fcn.0045d0ba
mov eax, 0x80000020
call fcn.00454915
push dword [ebp - 0x1bc]
call fcn.0042830c
call fcn.00457d88
jmp 0x4282ba
mov edx, 0x1863144
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x4282b2
mov eax, dword [ebp - 0x50]
call fcn.00457d88
mov edx, 0x1863120
call fcn.0045d0ba
mov eax, 0x80000020
call fcn.00454915
push dword [ebp - 0x1bc]
call fcn.0042830c
call fcn.00457d88
jmp 0x4282ba
mov eax, dword [ebp - 0x50]
call fcn.00457d88
lea ebx, [ebp - 0x1c4]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1d0], eax
jmp 0x427fd0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
call fcn.0045cf2c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret