Function at 0x100c8ce0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10120bf2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x330
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100c8d52
push 0x228
lea eax, [ebp - 0x334]
push 0
push eax
call fcn.10077450
add esp, 0xc
mov dword [ebp - 0x338], 0x22c
lea eax, [ebp - 0x338]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x100c8d65
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.1001b450
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
nop dword [eax]
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x314]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c8db0
sub ecx, edx
lea eax, [ebp - 0x314]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.1001a860
lea edx, [ebp - 0x34]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.100e8500
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x100c8e1c
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c8e12
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c988c
push edx
push ecx
call fcn.1007306e
add esp, 8
mov edi, dword [ebp - 0x40]
xor eax, eax
xor esi, esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
test edi, edi
je 0x100c8e6f
nop dword [eax]
cmp dword [ebp - 0x3c], 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
movzx eax, word [eax + esi*2]
push eax
call fcn.10081093
add esp, 4
movzx ecx, ax
cmp dword [ebp - 0x3c], 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
mov word [eax + esi*2], cx
inc esi
cmp esi, edi
jb 0x100c8e40
push dword [ebp - 0x38]
lea eax, [ebp - 0x50]
push eax
push ecx
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001c610
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x100c8ec4
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c8eba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c988c
push edx
push ecx
call fcn.1007306e
add esp, 8
lea eax, [ebp - 0x338]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100c8d90
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x18
xor eax, eax
mov dword [ebp - 0x40], 0
push str.g2dJqYtJmU_BKiHLMosd6g
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.1001a860
lea edx, [ebp - 0x50]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x68]
call fcn.100c9fe0
mov edx, eax
mov byte [ebp - 4], 5
cmp dword [edx + 0x14], 8
jb 0x100c8f21
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c8f40
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.1001a860
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001a360
mov edx, dword [ebp - 0x20]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
setne bl
cmp edx, 8
jb 0x100c8fab
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c8fa1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c988c
push edx
push ecx
call fcn.1007306e
add esp, 8
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x100c8fe9
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c8fdf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c9891
push edx
push ecx
call fcn.1007306e
add esp, 8
xor eax, eax
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp edx, 8
jb 0x100c903a
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c9030
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c9896
push edx
push ecx
call fcn.1007306e
add esp, 8
push 0x18
xor eax, eax
movzx edi, bl
push str.gCRuyN7kke1mlI7007HfcA
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x58], 0
add edi, edi
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.1001a860
mov byte [ebp - 4], 6
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x10], 1
call fcn.100c9fe0
mov edx, eax
mov dword [ebp - 4], 7
cmp dword [edx + 0x14], 8
mov dword [ebp - 0x10], 3
jb 0x100c9093
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x70], 0
xor eax, eax
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c90b0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x80]
call fcn.1001a860
lea eax, [ebp - 0x80]
mov dword [ebp - 4], 8
push eax
lea eax, [ebp - 0x38]
mov ebx, 7
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c91ed
push 0x18
xor eax, eax
mov dword [ebp - 0x24], 0
push str.sjFFrtWnK15mlI7007HfcA
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x34], ax
call fcn.1001a860
mov dword [ebp - 4], 9
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x10], 0xf
call fcn.100c9fe0
mov dword [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x10], 0x1f
jb 0x100c9144
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xd4]
call fcn.1001a4c0
lea eax, [ebp - 0xd4]
mov dword [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x84]
mov ebx, 0x3f
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c91ed
push str.NIfVcoTVJMEp1gPELFqSw
lea ecx, [ebp - 0x50]
call fcn.1001a4c0
mov dword [ebp - 4], 0xc
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x10], 0x7f
call fcn.100c9fe0
mov dword [ebp - 4], 0xd
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x10], 0xff
jb 0x100c91bb
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x104]
call fcn.1001a4c0
lea eax, [ebp - 0x104]
mov ebx, 0x1ff
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001a360
mov byte [ebp - 0x11], 0
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
je 0x100c91f1
mov byte [ebp - 0x11], 1
test ebx, 0x100
je 0x100c923f
mov edx, dword [ebp - 0xf0]
and ebx, 0xfffffeff
cmp edx, 8
jb 0x100c923f
mov ecx, dword [ebp - 0x104]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c9235
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c989b
push edx
push ecx
call fcn.1007306e
add esp, 8
mov dword [ebp - 4], 0xc
test bl, bl
jns 0x100c92ad
mov edx, dword [ebp - 0xd8]
and ebx, 0xffffff7f
cmp edx, 8
jb 0x100c9290
mov ecx, dword [ebp - 0xec]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c9286
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98a0
push edx
push ecx
call fcn.1007306e
add esp, 8
xor eax, eax
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 7
mov word [ebp - 0xec], ax
mov dword [ebp - 4], 0xb
test bl, 0x40
je 0x100c930a
mov edx, dword [ebp - 0x3c]
and ebx, 0xffffffbf
cmp edx, 8
jb 0x100c92f6
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c92ec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98a5
push edx
push ecx
call fcn.1007306e
add esp, 8
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
mov dword [ebp - 4], 0xa
test bl, 0x20
je 0x100c9359
mov edx, dword [ebp - 0xc0]
and ebx, 0xffffffdf
cmp edx, 8
jb 0x100c9359
mov ecx, dword [ebp - 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c934f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98aa
push edx
push ecx
call fcn.1007306e
add esp, 8
mov dword [ebp - 4], 9
test bl, 0x10
je 0x100c93c5
mov edx, dword [ebp - 0x90]
and ebx, 0xffffffef
cmp edx, 8
jb 0x100c93a8
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c939e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98af
push edx
push ecx
call fcn.1007306e
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov dword [ebp - 4], 8
test bl, 8
je 0x100c9422
mov edx, dword [ebp - 0x20]
and ebx, 0xfffffff7
cmp edx, 8
jb 0x100c940e
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c9404
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98b4
push edx
push ecx
call fcn.1007306e
add esp, 8
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
mov dword [ebp - 4], 7
mov edx, dword [ebp - 0x6c]
cmp edx, 8
jb 0x100c9463
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c9459
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98b9
push edx
push ecx
call fcn.1007306e
add esp, 8
mov dword [ebp - 4], 6
mov edx, dword [ebp - 0xa8]
cmp edx, 8
jb 0x100c94aa
mov ecx, dword [ebp - 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c94a0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98be
push edx
push ecx
call fcn.1007306e
add esp, 8
xor eax, eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 4], eax
and ebx, 0xfffffff8
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xa8], 7
mov word [ebp - 0xbc], ax
cmp edx, 8
jb 0x100c9507
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c94fd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98c3
push edx
push ecx
call fcn.1007306e
add esp, 8
mov eax, edi
mov dword [ebp - 0x70], 0
or eax, 1
mov dword [ebp - 0x6c], 7
cmp byte [ebp - 0x11], 0
lea ecx, [ebp - 0x80]
push 0x18
cmove eax, edi
mov esi, ebx
mov dword [ebp - 0x38], eax
xor eax, eax
push str.igE9GT3zhQIp1gPELFqSw
mov word [ebp - 0x80], ax
call fcn.1001a860
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x80]
or ebx, 0x200
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x10], ebx
call fcn.100c9fe0
mov edx, eax
mov ecx, esi
mov dword [ebp - 4], 0xf
or ecx, 0x600
cmp dword [edx + 0x14], 8
mov dword [ebp - 0x10], ecx
jb 0x100c9572
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x58], 0
xor eax, eax
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c9590
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x68]
call fcn.1001a860
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x88]
or esi, 0xe00
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esi
mov edi, esi
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c9669
push 0x18
xor eax, eax
mov dword [ebp - 0x24], 0
push str.l0PF_ifqACrATEfPeOVdg
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.1001a860
mov dword [ebp - 4], 0x11
lea edx, [ebp - 0x34]
or esi, 0x1000
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x10], esi
call fcn.100c9fe0
mov ecx, edi
mov dword [ebp - 4], 0x12
or ecx, 0x3000
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x10], ecx
jb 0x100c9634
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xd4]
call fcn.1001a4c0
lea eax, [ebp - 0xd4]
mov esi, edi
push eax
lea eax, [ebp - 0x84]
or esi, 0x7000
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c9669
xor bl, bl
jmp 0x100c966b
mov bl, 1
test esi, 0x4000
je 0x100c96b9
mov edx, dword [ebp - 0xc0]
and esi, 0xffffbfff
cmp edx, 8
jb 0x100c96b9
mov ecx, dword [ebp - 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c96af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98c8
push edx
push ecx
call fcn.1007306e
add esp, 8
test esi, 0x2000
je 0x100c9724
mov edx, dword [ebp - 0xa8]
and esi, 0xffffdfff
cmp edx, 8
jb 0x100c9707
mov ecx, dword [ebp - 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c96fd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98cd
push edx
push ecx
call fcn.1007306e
add esp, 8
xor eax, eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 7
mov word [ebp - 0xbc], ax
test esi, 0x1000
je 0x100c977a
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x100c9766
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c975c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98d2
push edx
push ecx
call fcn.1007306e
add esp, 8
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x100c97b4
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c97aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98d7
push edx
push ecx
call fcn.1007306e
add esp, 8
mov edx, dword [ebp - 0x90]
cmp edx, 8
jb 0x100c97f4
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c97ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98dc
push edx
push ecx
call fcn.1007306e
add esp, 8
mov edx, dword [ebp - 0x6c]
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
cmp edx, 8
jb 0x100c984b
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c9841
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c98e1
push edx
push ecx
call fcn.1007306e
add esp, 8
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
mov esi, dword [ebp - 0x38]
push eax
or esi, 8
test bl, bl
push dword [eax]
cmove esi, dword [ebp - 0x38]
lea eax, [ebp - 0x88]
push eax
call fcn.1001ad40
push 0x28
push dword [ebp - 0x1c]
call fcn.1007306e
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
call fcn.10080da8
int3