Function at 0x88b72c
Capabilities:
Enumerate processes
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb28
push ebx
push esi
push edi
lea ebx, [ebp - 0x84]
mov eax, 0x90aed8
call fcn.008e306c
mov eax, dword [ebp + 0xc]
mov edx, 0x907868
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x88b76c
test cl, cl
je 0x88b77b
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x88b76c
add eax, 2
add edx, 2
test cl, cl
jne 0x88b750
je 0x88b77b
mov eax, dword [ebx]
mov dword fs:[0], eax
jmp 0x88bd4a
mov word [ebx + 0x10], 8
xor edx, edx
xor ecx, ecx
mov dword [ebp - 4], edx
xor eax, eax
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x18c]
mov word [ebx + 0x10], 0x14
mov word [ebx + 0x10], 0x20
mov dword [ebp - 8], ecx
inc dword [ebx + 0x1c]
mov word [ebx + 0x10], 0x14
mov word [ebx + 0x10], 0x2c
mov dword [ebp - 0xc], eax
inc dword [ebx + 0x1c]
mov word [ebx + 0x10], 0x14
push 0x104
push edx
call sub.kernel32.dll_GetWindowsDirectoryA
mov esi, 0x8f6e68
lea edi, [ebp - 0x2b4]
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x44]
cmp dword [ebp - 0x88], 0
jne 0x88b838
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.008ece90
mov ecx, dword [ebx]
mov dword fs:[0], ecx
jmp 0x88bd4a
lea eax, [ebp - 0x2b4]
push eax
mov edx, dword [ebp - 0x88]
push edx
call sub.kernel32.dll_Process32First
test eax, eax
setne al
and eax, 1
test al, al
je 0x88bd05
mov word [ebx + 0x10], 0x38
lea edx, [ebp - 0x290]
lea eax, [ebp - 0x10]
call fcn.008ecd30
mov edx, eax
inc dword [ebx + 0x1c]
lea eax, [ebp - 4]
call fcn.008ecec0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.008ece90
mov word [ebx + 0x10], 0x44
mov edx, 0x90786d
lea eax, [ebp - 0x14]
call fcn.008ecd30
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.008ed0a4
test eax, eax
lea eax, [ebp - 0x14]
setne cl
and ecx, 1
mov edx, 2
push ecx
dec dword [ebx + 0x1c]
call fcn.008ece90
pop ecx
test cl, cl
je 0x88b91f
mov word [ebx + 0x10], 0x50
lea edx, [ebp - 0x290]
lea eax, [ebp - 0x18]
call fcn.008ecd30
inc dword [ebx + 0x1c]
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 0x1c]
inc dword [ebx + 0x1c]
call fcn.008cdd84
lea edx, [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.008ecec0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.008ece90
mov word [ebx + 0x10], 0x5c
mov edx, 0x90786f
lea eax, [ebp - 0x20]
call fcn.008ecd30
inc dword [ebx + 0x1c]
mov edx, eax
xor eax, eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 4]
inc dword [ebx + 0x1c]
call fcn.008ecee8
lea edx, [ebp - 0x24]
lea eax, [ebp - 0xc]
call fcn.008ecec0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.008ece90
mov edx, 0x907871
lea eax, [ebp - 0x2c]
call fcn.008ecd30
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x290]
mov word [ebx + 0x10], 0x68
lea eax, [ebp - 0x28]
call fcn.008ecd30
inc dword [ebx + 0x1c]
pop edx
call fcn.008ed0a4
test eax, eax
mov edx, 2
sete al
and eax, 1
push eax
lea eax, [ebp - 0x2c]
dec dword [ebx + 0x1c]
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.008ece90
pop ecx
test cl, cl
je 0x88ba84
mov eax, dword [ebp - 0x2ac]
push eax
push 0xf
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov word [ebx + 0x10], 0x14
cmp esi, 0xffffffff
jne 0x88ba26
mov word [ebx + 0x10], 0x74
lea edx, [ebp - 0x290]
lea eax, [ebp - 0x30]
call fcn.008ecd30
mov edx, eax
inc dword [ebx + 0x1c]
lea eax, [ebp - 8]
call fcn.008ecec0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.008ece90
jmp 0x88ba7c
push esi
mov esi, 0x8f6f90
lea edi, [ebp - 0x4d8]
mov ecx, 0x89
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x4d8]
push eax
push esi
call sub.kernel32.dll_Module32First
test eax, eax
je 0x88ba7c
mov word [ebx + 0x10], 0x80
lea edx, [ebp - 0x3b8]
lea eax, [ebp - 0x34]
call fcn.008ecd30
mov edx, eax
inc dword [ebx + 0x1c]
lea eax, [ebp - 8]
call fcn.008ecec0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.008ece90
push esi
call sub.kernel32.dll_CloseHandle
jmp 0x88bab5
mov word [ebx + 0x10], 0x8c
lea edx, [ebp - 0x290]
lea eax, [ebp - 0x38]
call fcn.008ecd30
mov edx, eax
inc dword [ebx + 0x1c]
lea eax, [ebp - 8]
call fcn.008ecec0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.008ece90
mov word [ebx + 0x10], 0x98
xor ecx, ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], ecx
push eax
inc dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.008ed260
lea eax, [ebp - 0x3c]
push eax
mov edx, 0x907873
lea eax, [ebp - 0x40]
call fcn.008ecd30
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x40]
pop eax
call fcn.008ecf74
push eax
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.008ece90
pop ecx
test cl, cl
je 0x88bbbf
mov word [ebx + 0x10], 0xa4
xor eax, eax
lea edx, [ebp - 0x44]
mov dword [ebp - 0x44], eax
push edx
inc dword [ebx + 0x1c]
cmp dword [ebp - 8], 0
je 0x88bb40
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx - 4]
jmp 0x88bb42
xor ecx, ecx
lea eax, [ebp - 8]
mov edx, 0xc
call fcn.008ed260
lea edx, [ebp - 0x44]
lea eax, [ebp - 8]
call fcn.008ecec0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.008ece90
mov word [ebx + 0x10], 0xb0
lea edx, [ebp - 0x18c]
lea eax, [ebp - 0x48]
call fcn.008ecd30
inc dword [ebx + 0x1c]
xor ecx, ecx
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x4c]
inc dword [ebx + 0x1c]
lea edx, [ebp - 8]
call fcn.008ecee8
lea edx, [ebp - 0x4c]
lea eax, [ebp - 8]
call fcn.008ecec0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.008ece90
push 1
lea ecx, [ebp - 8]
push ecx
call fcn.008eccac
add esp, 8
lea eax, [ebp - 8]
call fcn.008ed070
mov esi, dword [ebp - 8]
movsx eax, byte [esi]
cmp eax, 0x5c
jne 0x88bc28
mov word [ebx + 0x10], 0xbc
xor edx, edx
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], edx
push ecx
inc dword [ebx + 0x1c]
test esi, esi
je 0x88bbfe
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 4]
jmp 0x88bc00
xor ecx, ecx
lea eax, [ebp - 8]
mov edx, 5
call fcn.008ed260
lea edx, [ebp - 0x50]
lea eax, [ebp - 8]
call fcn.008ecec0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.008ece90
mov word [ebx + 0x10], 0xc8
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x5c]
inc dword [ebx + 0x1c]
mov edx, 4
mov eax, dword [ebp - 0x29c]
call fcn.008cd8e8
lea eax, [ebp - 0x5c]
push eax
mov edx, 0x90787f
lea eax, [ebp - 0x54]
call fcn.008ecd30
inc dword [ebx + 0x1c]
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov edx, eax
inc dword [ebx + 0x1c]
lea eax, [ebp - 8]
lea ecx, [ebp - 0x58]
call fcn.008ecee8
lea eax, [ebp - 0x58]
xor edx, edx
mov dword [ebp - 0x60], edx
lea ecx, [ebp - 0x60]
inc dword [ebx + 0x1c]
pop edx
call fcn.008ecee8
lea edx, [ebp - 0x60]
lea eax, [ebp - 0xc]
call fcn.008eced4
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.008ece90
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x2ac]
mov edx, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x3c]
lea eax, [ebp - 0x2b4]
push eax
mov edx, dword [ebp - 0x88]
push edx
call sub.kernel32.dll_Process32Next
test eax, eax
setne al
and eax, 1
test al, al
jne 0x88b85b
mov edx, dword [ebp - 0x88]
push edx
call sub.kernel32.dll_CloseHandle
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.008ece90
dec dword [ebx + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.008ece90
mov ecx, dword [ebx]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8