Function at 0x10022d20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100590d2
mov eax, dword fs:[0]
push eax
sub esp, 0x3b0
mov eax, dword [0x100754f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x12c]
push eax
call fcn.10014840
mov edi, eax
add esp, 4
lea eax, [esi + 8]
cmp eax, edi
je 0x10022dad
mov ecx, eax
call fcn.10003f50
movups xmm0, xmmword [edi]
movups xmmword [esi + 8], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x18], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10022de7
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10022ddd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10023849
push edx
push ecx
call fcn.10033b8a
add esp, 8
lea eax, [ebp - 0x12c]
push eax
call fcn.10004a40
mov edi, eax
add esp, 4
lea eax, [esi + 0x20]
cmp eax, edi
je 0x10022e28
mov ecx, eax
call fcn.10003f50
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x20], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x30], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10022e62
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10022e58
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002384e
push edx
push ecx
call fcn.10033b8a
add esp, 8
lea eax, [ebp - 0x12c]
push eax
call fcn.100087e0
mov edi, eax
add esp, 4
lea eax, [esi + 0x38]
cmp eax, edi
je 0x10022ea3
mov ecx, eax
call fcn.10003f50
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x38], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x48], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10022edd
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10022ed3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10023853
push edx
push ecx
call fcn.10033b8a
add esp, 8
lea eax, [ebp - 0x12c]
push eax
call fcn.10004c50
mov edi, eax
add esp, 4
lea eax, [esi + 0x50]
cmp eax, edi
je 0x10022f1e
mov ecx, eax
call fcn.10003f50
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x50], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x60], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10022f58
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10022f4e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10023858
push edx
push ecx
call fcn.10033b8a
add esp, 8
lea eax, [ebp - 0x12c]
push eax
call fcn.10008ae0
mov edi, eax
add esp, 4
lea eax, [esi + 0x68]
cmp eax, edi
je 0x10022f99
mov ecx, eax
call fcn.10003f50
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x68], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x78], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10022fd3
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10022fc9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002385d
push edx
push ecx
call fcn.10033b8a
add esp, 8
lea eax, [ebp - 0x12c]
push eax
call fcn.10008650
mov edi, eax
add esp, 4
lea eax, [esi + 0x80]
cmp eax, edi
je 0x1002301d
mov ecx, eax
call fcn.10003f50
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x80], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x90], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10023057
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002304d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10023862
push edx
push ecx
call fcn.10033b8a
add esp, 8
lea eax, [esi + 0x1e8]
lea ecx, [esi + 0x98]
cmp ecx, eax
je 0x1002307a
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x10023071
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.10006df0
lea eax, [esi + 0xb4]
mov byte [esi + 0xb0], 1
push eax
call fcn.10013d80
mov edx, dword [0x10075008]
add esp, 4
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100230a0
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0xcc]
call fcn.10006df0
xor eax, eax
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 7
mov word [ebp - 0x174], ax
lea eax, [ebp - 0x174]
mov byte [ebp - 4], 1
push eax
push 0x1005e2dc
push dword [0x10075010]
push SysReAllocString
call fcn.10014c40
add esp, 0x10
test eax, eax
je 0x10023142
cmp dword [ebp - 0x160], 8
lea eax, [ebp - 0x174]
lea ecx, [ebp - 0x3b4]
cmovae eax, dword [ebp - 0x174]
push eax
call fcn.100083d0
mov edx, eax
lea edi, [edx + 1]
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10023120
sub edx, edi
lea ecx, [esi + 0xe4]
push edx
push eax
call fcn.10006df0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x3a8], eax
mov word [esi + 0xfc], 0
mov edx, dword [str.2.0.0]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023156
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x100]
call fcn.10006df0
call fcn.100152a0
test eax, eax
setne al
mov byte [esi + 0x118], al
call fcn.10015190
test eax, eax
setne al
mov byte [esi + 0x119], al
lea eax, [ebp - 0x12c]
push eax
call fcn.100146f0
mov edi, eax
add esp, 4
lea eax, [esi + 0x11c]
cmp eax, edi
je 0x100231d6
mov ecx, eax
call fcn.10003f50
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x11c], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x12c], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10023210
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10023206
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10023867
push edx
push ecx
call fcn.10033b8a
add esp, 8
xor eax, eax
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 7
mov word [ebp - 0x15c], ax
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 2
push eax
push 0x1005d8fc
push str.PowerPoint.ApplicationCurVer
push SysReAllocString
call fcn.10014c40
add esp, 0x10
test eax, eax
je 0x100232a3
cmp dword [ebp - 0x14c], 0
jbe 0x100232a3
cmp dword [ebp - 0x148], 8
lea eax, [ebp - 0x15c]
lea ecx, [ebp - 0x3b4]
cmovae eax, dword [ebp - 0x15c]
push eax
call fcn.100083d0
mov edx, eax
lea edi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10023281
sub edx, edi
lea ecx, [esi + 0x134]
push edx
push eax
call fcn.10006df0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x3a8], eax
call fcn.100049e0
test eax, eax
je 0x100232ce
push 0
mov dword [esi + 0x14c], eax
call fcn.100395a3
add esp, 4
mov dword [ebp - 0x3b8], edx
sub eax, dword [esi + 0x14c]
mov dword [esi + 0x150], eax
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.100365a0
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x100233c4
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x12c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023324
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.10006df0
push 1
push 1
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 3
push 0x1005e328
push eax
call fcn.10016160
lea ecx, [esi + 0x154]
add esp, 0x10
lea eax, [ebp - 0x12c]
cmp ecx, eax
je 0x10023386
cmp dword [ebp - 0x118], 0x10
push dword [ebp - 0x11c]
cmovae eax, dword [ebp - 0x12c]
push eax
call fcn.10006df0
mov edx, dword [ebp - 0x118]
mov byte [ebp - 4], 2
cmp edx, 0x10
jb 0x100233c4
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100233ba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002386c
push edx
push ecx
call fcn.10033b8a
add esp, 8
mov ecx, esi
call fcn.10023890
mov dword [esi + 0x16c], eax
call fcn.10004a10
mov dword [esi + 0x170], eax
xor eax, eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 7
mov word [ebp - 0x144], ax
lea eax, [ebp - 0x144]
mov byte [ebp - 4], 4
push eax
push 0x1005e32c
push dword [0x10075010]
push SysReAllocString
call fcn.10014c40
add esp, 0x10
test eax, eax
je 0x1002344f
mov edx, dword [ebp - 0x134]
test edx, edx
je 0x1002344f
lea ecx, [esi + 0x174]
lea eax, [ebp - 0x144]
cmp ecx, eax
je 0x1002344f
cmp dword [ebp - 0x130], 8
push edx
cmovae eax, dword [ebp - 0x144]
push eax
call fcn.10006ee0
lea eax, [ebp - 0x3a4]
mov dword [ebp - 0x3a4], 0
push eax
push str.aidtasktm
push dword [0x10075010]
push SysReAllocString
call fcn.100149c0
add esp, 0x10
test eax, eax
je 0x100234a4
mov eax, dword [ebp - 0x3a4]
push 0
mov dword [esi + 0x18c], eax
call fcn.100395a3
add esp, 4
mov dword [ebp - 0x3b8], edx
sub eax, dword [ebp - 0x3a4]
mov dword [esi + 0x190], eax
lea eax, [ebp - 0x3a4]
push eax
push str.LoadBehavior
push str.SoftwareMicrosoftOfficePowerPointAddinsOfficeTeamAddin.Connect
push SysReAllocString
call fcn.100149c0
add esp, 0x10
test eax, eax
je 0x100234d6
cmp dword [ebp - 0x3a4], 3
sete al
mov byte [esi + 0x194], al
call fcn.10015100
test eax, eax
setne al
mov byte [esi + 0x1a8], al
lea eax, [ebp - 0x144]
push eax
push str.Version
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Client
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10014c40
add esp, 0x10
test eax, eax
je 0x10023532
lea ecx, [esi + 0x1ac]
lea eax, [ebp - 0x144]
cmp ecx, eax
je 0x10023532
cmp dword [ebp - 0x130], 8
push dword [ebp - 0x134]
cmovae eax, dword [ebp - 0x144]
push eax
call fcn.10006ee0
lea edi, [esi + 0x200]
push edi
push dword [edi + 4]
push dword [edi]
call fcn.1001bb30
mov eax, dword [edi]
push 0x228
mov dword [edi + 4], eax
lea eax, [ebp - 0x39c]
push 0
push eax
call fcn.100365a0
add esp, 0x18
mov dword [ebp - 0x3a0], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x3b8], eax
test eax, eax
je 0x10023688
lea ecx, [ebp - 0x3a0]
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
nop dword [eax]
xor eax, eax
mov dword [ebp - 0x11c], 0
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x118], 7
mov word [ebp - 0x12c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100235b6
sub ecx, edx
lea eax, [ebp - 0x37c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.10006ee0
mov eax, dword [edi + 4]
mov byte [ebp - 4], 5
cmp dword [edi + 8], eax
je 0x1002360f
movups xmm0, xmmword [ebp - 0x12c]
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov word [ebp - 0x12c], ax
jmp 0x10023624
lea ecx, [ebp - 0x12c]
push ecx
push eax
mov ecx, edi
call fcn.1001bba0
mov edx, dword [ebp - 0x118]
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x10023662
mov ecx, dword [ebp - 0x12c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10023658
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10023849
push edx
push ecx
call fcn.10033b8a
add esp, 8
lea eax, [ebp - 0x3a0]
push eax
push dword [ebp - 0x3b8]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10023590
push dword [ebp - 0x3b8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.1001c8f0
cmp dword [esi + 0x218], 0
mov eax, dword [esi + 0x21c]
mov edx, dword [ebp - 0x130]
mov dword [esi + 0x1c8], eax
setne al
mov dword [esi + 0x1cc], 0
mov byte [esi + 0x1d0], al
cmp edx, 8
jb 0x100236f5
mov ecx, dword [ebp - 0x144]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100236eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10023871
push edx
push ecx
call fcn.10033b8a
add esp, 8
mov edx, dword [ebp - 0x148]
xor eax, eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 7
mov word [ebp - 0x144], ax
cmp edx, 8
jb 0x10023752
mov ecx, dword [ebp - 0x15c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10023748
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10023876
push edx
push ecx
call fcn.10033b8a
add esp, 8
mov edx, dword [ebp - 0x160]
xor eax, eax
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 7
mov word [ebp - 0x15c], ax
cmp edx, 8
jb 0x100237af
mov ecx, dword [ebp - 0x174]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100237a5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002387b
push edx
push ecx
call fcn.10033b8a
add esp, 8
mov edi, dword [ebp - 0x3b0]
xor eax, eax
mov edx, dword [ebp - 0x3a8]
xor esi, esi
sub edi, edx
mov dword [ebp - 0x164], 0
sar edi, 2
mov dword [ebp - 0x160], 7
mov word [ebp - 0x174], ax
test edi, edi
je 0x100237f9
push dword [edx + esi*4]
call fcn.10033ba1
mov edx, dword [ebp - 0x3a8]
inc esi
add esp, 4
cmp esi, edi
jb 0x100237e3
test edx, edx
je 0x1002382c
mov ecx, dword [ebp - 0x3ac]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10023822
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10023880
push ecx
push edx
call fcn.10033b8a
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10033ba6
mov esp, ebp
pop ebp
ret
call fcn.100392dc
call fcn.100392dc
call fcn.100392dc
call fcn.100392dc
call fcn.100392dc
call fcn.100392dc
call fcn.100392dc
call fcn.100392dc
call fcn.100392dc
call fcn.100392dc
call fcn.100392dc
call fcn.100392dc
int3