Function at 0x10006f00
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
sub esp, 0x310
push ebx
push esi
push 0
push 2
xor bl, bl
mov dword [esp + 0xf4], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x100072f7
lea eax, [esp + 0xec]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x100072f0
push ebp
push edi
mov edi, 0x65
lea ebp, [eax + 0x77]
nop word [eax + eax]
mov eax, 0x72
mov dword [esp + 0x9c], 0x760061
mov word [esp + 0xa6], ax
mov eax, 0x67
mov word [esp + 0xa0], ax
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0xa0]
mov dword [esp + 0xb6], edi
push eax
mov dword [esp + 0xb0], 0x780076
mov dword [esp + 0xaa], 0x730063
mov dword [esp + 0xb4], 0x65002e
mov word [esp + 0xb8], bp
call fcn.1002ca51
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x88], edi
cmove ebx, eax
mov dword [esp + 0x78], 0x650067
mov eax, 0x6d
mov dword [esp + 0x74], 0x760061
mov word [esp + 0x7c], ax
lea eax, [esp + 0x120]
push eax
lea eax, [esp + 0x78]
mov dword [esp + 0x82], 0x780063
push eax
mov dword [esp + 0x8a], 0x65002e
mov word [esp + 0x8e], bp
call fcn.1002ca51
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0xfc], 0x780065
cmove ebx, eax
mov dword [esp + 0xe6], 0x670076
mov eax, 0x61
mov dword [esp + 0x100], edi
mov word [esp + 0xf0], ax
mov ecx, 0x6e
mov word [esp + 0xe4], ax
lea eax, [esp + 0x128]
push eax
mov word [esp + 0xfa], cx
lea eax, [esp + 0xe8]
mov ecx, 0x69
mov dword [esp + 0xf0], 0x730064
push eax
mov dword [esp + 0x100], 0x2e0074
mov dword [esp + 0xfa], 0x650067
mov word [esp + 0xf2], cx
call fcn.1002ca51
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x40], 0x6e0067
cmove ebx, eax
mov dword [esp + 0x4c], 0x650078
xor eax, eax
mov dword [esp + 0x3c], 0x760061
mov word [esp + 0x50], ax
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x48], 0x780073
push eax
mov dword [esp + 0x50], 0x65002e
call fcn.1002ca51
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x6c], 0x650078
cmove ebx, eax
mov dword [esp + 0x60], 0x720067
mov eax, 0x73
mov dword [esp + 0x5c], 0x760061
mov dword [esp + 0x66], 0x2e0078
mov word [esp + 0x64], ax
mov word [esp + 0x6a], di
xor eax, eax
mov word [esp + 0x70], ax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.1002ca51
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0xac], 0x760061
cmove ebx, eax
mov dword [esp + 0xb8], 0x2e0078
lea eax, [esp + 0x140]
mov dword [esp + 0xbc], 0x780065
push eax
lea eax, [esp + 0xb0]
mov dword [esp + 0xc4], edi
push eax
mov dword [esp + 0xb8], 0x730067
mov dword [esp + 0xbc], 0x630076
call fcn.1002ca51
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x40], 0x760061
cmove ebx, eax
mov dword [esp + 0x50], edi
lea eax, [esp + 0x148]
mov dword [esp + 0x48], 0x2e0069
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x48], 0x750067
push eax
mov dword [esp + 0x54], 0x780065
call fcn.1002ca51
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x8c], 0x760061
cmove ebx, eax
mov dword [esp + 0x9e], edi
lea eax, [esp + 0x150]
mov dword [esp + 0x98], 0x65002e
push eax
lea eax, [esp + 0x90]
mov dword [esp + 0x98], 0x780069
push eax
mov dword [esp + 0x98], 0x750067
mov word [esp + 0xa4], bp
call fcn.1002ca51
add esp, 0x40
movzx ebx, bl
test eax, eax
mov dword [esp + 0xb8], 0x760061
mov eax, 1
mov dword [esp + 0xd0], edi
cmove ebx, eax
mov dword [esp + 0xc8], 0x2e0078
mov eax, 0x64
mov dword [esp + 0xc2], 0x760073
mov word [esp + 0xc0], ax
mov eax, 0x63
mov word [esp + 0xc6], ax
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0xbc]
mov dword [esp + 0xc0], 0x770067
push eax
mov dword [esp + 0xd4], 0x780065
call fcn.1002ca51
add esp, 8
movzx ebx, bl
test eax, eax
mov eax, 1
cmove ebx, eax
lea eax, [esp + 0xf4]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x10006f50
pop edi
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
add esp, 0x310
ret