Function at 0x403545
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp + 0xc]
mov esi, 0x1fc
push esi
mov dword [ebp - 0x158], eax
xor ebx, ebx
lea eax, [ebp - 0x35c]
push ebx
push eax
call fcn.00451d90
push esi
lea eax, [ebp - 0x55c]
push ebx
push eax
mov dword [ebp - 0x360], 0xd1de2a3f
mov dword [ebp - 0x35c], 0x68ea296c
mov dword [ebp - 0x358], 0x5ab2c665
mov dword [ebp - 0x354], 0xcfd54cbd
mov dword [ebp - 0x350], 0x981d563b
mov dword [ebp - 0x34c], 0xf04cdd8d
mov dword [ebp - 0x348], 0xc3175f21
mov dword [ebp - 0x344], 0xc75da922
mov dword [ebp - 0x340], 0x37b479f7
mov dword [ebp - 0x33c], 0x82a759a1
mov dword [ebp - 0x338], 0x9141f2d5
mov dword [ebp - 0x334], 0xc5e45b88
mov dword [ebp - 0x330], 0xfdd2940a
mov dword [ebp - 0x32c], 0xf006256b
mov dword [ebp - 0x328], 0x5706b464
mov dword [ebp - 0x324], 0x277db966
mov dword [ebp - 0x320], 0x51dd49b2
mov dword [ebp - 0x31c], 0x423ff333
mov dword [ebp - 0x318], 0xf410cf18
mov dword [ebp - 0x314], 0x70e8f7f6
mov dword [ebp - 0x310], 0x543e43f6
mov dword [ebp - 0x30c], 0xad98a7d4
mov dword [ebp - 0x308], 0x84a2226d
mov dword [ebp - 0x304], 0xd8197e93
mov dword [ebp - 0x300], 0x4b2c03ad
mov dword [ebp - 0x2fc], 0x68bf2019
mov dword [ebp - 0x2f8], 0xe2c00cfb
mov dword [ebp - 0x2f4], 0x46cd3d11
call fcn.00451d90
add esp, 0x18
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x28], bl
lea edi, [ebp - 0x27]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x15c]
mov byte [eax], bl
mov eax, dword [ebp - 0x158]
push ebx
push 2
mov dword [ebp - 0x560], 0x529e3e22
mov dword [ebp - 0x55c], 0x885b697c
mov dword [ebp - 0x558], 0xfc69eb96
mov dword [ebp - 0x554], 0x67b50ab3
mov byte [eax], bl
mov dword [ebp - 0x150], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x154], eax
cmp eax, 0xffffffff
je 0x403839
lea ecx, [ebp - 0x150]
push ecx
push eax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x403825
push 8
mov eax, 0x3f3f3f3f
pop ecx
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x12c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40373d
sub eax, edx
cmp eax, 0x10
jae 0x40375f
lea eax, [ebp - 0x12c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403754
sub eax, edx
jmp 0x403762
push 0x10
pop eax
push eax
push ebx
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0044fcc0
lea eax, [ebp - 0x28]
add esp, 0x10
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40377d
sub eax, esi
inc eax
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0044fef2
push 0x6c
call fcn.0043fb20
add esp, 0xc
cmp eax, ebx
je 0x4037a8
call fcn.00402f7d
mov esi, eax
jmp 0x4037aa
xor esi, esi
lea eax, [ebp - 0x28]
push eax
push 0x20
pop eax
call fcn.00406747
mov ecx, esi
call fcn.004067db
lea eax, [ebp - 0x360]
lea edi, [esi + 0x58]
push eax
mov eax, edi
call fcn.004034df
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x560]
push eax
mov eax, edi
call fcn.004034df
push esi
mov edi, eax
call fcn.0043fb5a
add esp, 0xc
cmp dword [ebp - 0x160], ebx
je 0x4037fe
mov eax, dword [ebp - 0x15c]
mov byte [eax], 1
cmp edi, ebx
je 0x40380b
mov eax, dword [ebp - 0x158]
mov byte [eax], 1
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403727
cmp dword [ebp - 0x154], ebx
je 0x403839
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e6cf
leave
ret 8