Function at 0x10038250
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098388
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov byte [eax], 0
xor eax, eax
mov dword [ebp - 0x10], esp
push eax
mov ecx, 0x4a
lea edi, [ebp - 0x148]
push 2
rep stosd dword es:[edi], eax
mov dword [ebp - 4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x100382b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x148]
push ecx
push esi
mov dword [ebp - 0x148], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x100384fc
lea edx, [ebp - 0x124]
push edx
lea ecx, [ebp - 0x18]
call fcn.10011f50
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub eax, 0x10
push eax
mov byte [ebp - 4], 1
call fcn.10001a10
add eax, 0x10
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.1001a260
lea ecx, [ebp - 0x14]
call fcn.1001a260
mov edi, dword [ebp - 0x14]
push 0x2e
push edi
call fcn.10075b6a
add esp, 8
test eax, eax
jne 0x10038328
or eax, 0xffffffff
jmp 0x1003832a
sub eax, edi
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.10003b90
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.100029e0
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10038365
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edi, dword [ebp - 0x14]
mov eax, dword [edi - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
call fcn.10003b90
mov eax, dword [eax]
push edi
push eax
call fcn.10077004
mov ebx, eax
mov eax, dword [ebp - 0x20]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100383a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x100384a0
mov ecx, dword [ebp - 0x140]
mov eax, dword [ebp + 0xc]
push ecx
push 0
push 0x1f0fff
mov byte [eax], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x10038432
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100383fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10038509
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
test ebx, ebx
jne 0x10038447
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1003846c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1003848d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100384be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100384df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x148]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100382d3
jmp 0x10038502
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret