Function at 0x69cc28ed
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x1018], 0x22c
mov eax, dword [ebp + 0xc]
and eax, 3
test eax, eax
je 0x69cc298f
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x1000], 0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1000]
cmp eax, 0x3ff
ja 0x69cc2956
mov eax, dword [ebp + 0x14]
mov edx, dword [eax + 0x1000]
mov eax, dword [ebp + 0x14]
mov dword [eax + edx*4], 0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1000]
lea edx, [eax + 1]
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x1000], edx
jmp 0x69cc291c
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x1010], 0
mov eax, dword [ebp + 0x14]
mov ebx, dword [eax + 0x1010]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call eax
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax + ebx*4], edx
mov eax, dword [ebp + 0xc]
and eax, 2
test eax, eax
je 0x69cc298f
mov eax, 0
jmp 0x69cc2bbe
cmp dword [ebp + 8], 0
je 0x69cc299b
cmp dword [ebp + 0x14], 0
jne 0x69cc29a5
mov eax, 0
jmp 0x69cc2bbe
mov eax, dword [ebp + 8]
movzx eax, word [eax]
test ax, ax
jne 0x69cc29ba
mov eax, 0
jmp 0x69cc2bbe
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x1244], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x1014], edx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1014]
cmp eax, 0xffffffff
je 0x69cc2bb9
mov eax, dword [ebp + 0x14]
lea edx, [eax + 0x1018]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1014]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_Process32FirstW
sub esp, 8
test eax, eax
setne al
test al, al
je 0x69cc2b33
mov eax, dword [ebp + 0x14]
add eax, 0x103c
movzx edx, word [eax]
mov eax, dword [ebp + 8]
movzx eax, word [eax]
cmp dx, ax
jne 0x69cc2b04
mov eax, dword [ebp + 0x14]
lea edx, [eax + 0x103c]
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpW]
call eax
sub esp, 8
test eax, eax
sete al
test al, al
je 0x69cc2b04
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1010]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1020]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.69cc28b1
test eax, eax
sete al
test al, al
je 0x69cc2b04
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1244]
lea edx, [eax + 1]
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x1244], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1244]
mov eax, dword [ebp + 0x14]
mov edx, dword [eax + 0x1020]
mov eax, dword [ebp + 0x14]
add ecx, 0x490
mov dword [eax + ecx*4 + 8], edx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1010]
lea edx, [eax + 1]
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x1010], edx
mov eax, dword [ebp + 0x14]
mov edx, dword [eax + 0x1010]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1020]
mov eax, dword [ebp + 0x14]
mov dword [eax + edx*4], ecx
mov eax, dword [ebp + 0x14]
lea edx, [eax + 0x1018]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1014]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_Process32NextW
sub esp, 8
test eax, eax
setne al
test al, al
je 0x69cc2b33
jmp 0x69cc2a29
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1014]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1244]
test eax, eax
js 0x69cc2b76
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1244]
lea edx, [eax + 1]
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x1244], edx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1244]
jmp 0x69cc2bbe
mov eax, dword [ebp + 0xc]
and eax, 4
test eax, eax
jne 0x69cc2bb8
mov dword [esp], 0x78
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x1014], edx
jmp 0x69cc29e9
nop
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret