Function at 0x100012a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10002d2d
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x2b0], eax
cmp eax, 0xffffffff
je 0x1000157b
lea ecx, [ebp - 0x2ac]
mov dword [ebp - 0x2ac], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1000156f
mov dword [ebp - 0x50], str.x32dbg
mov dword [ebp - 0x4c], str.x64dbg
mov dword [ebp - 0x48], str.IDA:_Quick_start
mov dword [ebp - 0x44], str.IDA_v6.8.150423
mov dword [ebp - 0x40], str.HTTPDebuggerUI
mov dword [ebp - 0x3c], str.HTTPDebuggerSvc
mov dword [ebp - 0x38], str.idaq64
mov dword [ebp - 0x34], str.idaq32
mov dword [ebp - 0x30], 0x10003208
mov dword [ebp - 0x2c], str.wireshark
mov dword [ebp - 0x28], str.debug
mov dword [ebp - 0x24], str.ollydbg
mov dword [ebp - 0x20], str.ollydbg64
mov dword [ebp - 0x1c], str.loaddll
mov dword [ebp - 0x18], str.windowrenamer
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x80]
call fcn.10001cb0
mov dword [ebp - 4], 0
lea esi, [ebp - 0x80]
cmp dword [ebp - 0x6c], 7
lea edi, [ebp - 0x80]
mov eax, dword [ebp - 0x70]
xorps xmm0, xmm0
cmova esi, dword [ebp - 0x80]
seta dl
test dl, dl
movups xmmword [ebp - 0x68], xmm0
cmovne edi, dword [ebp - 0x80]
lea eax, [esi + eax*2]
mov dword [ebp - 0x2b4], eax
cmp edi, eax
jne 0x100013d1
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
jmp 0x1000149d
sub eax, edi
xor edx, edx
sar eax, 1
mov esi, 0xf
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], esi
cmp eax, 0x7fffffff
ja 0x10001629
cmp eax, esi
jbe 0x10001468
mov esi, eax
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x1000140d
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
jmp 0x1000142d
cmp esi, 0x16
mov eax, 0x16
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x1000144e
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x1000162e
push ecx
call fcn.10001f4c
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10001612
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
mov edx, dword [ebp - 0x58]
jmp 0x10001462
test eax, eax
je 0x10001460
push eax
call fcn.10001f4c
mov edx, dword [ebp - 0x58]
add esp, 4
jmp 0x10001462
xor eax, eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x54], esi
mov al, byte [edi]
lea ecx, [ebp - 0x68]
cmp esi, 0xf
cmova ecx, dword [ebp - 0x68]
add edi, 2
mov byte [edx + ecx], al
mov edx, dword [ebp - 0x58]
inc edx
mov dword [ebp - 0x58], edx
cmp edi, dword [ebp - 0x2b4]
je 0x1000148e
mov esi, dword [ebp - 0x54]
jmp 0x10001468
cmp dword [ebp - 0x54], 0xf
lea eax, [ebp - 0x68]
cmova eax, dword [ebp - 0x68]
mov byte [edx + eax], 0
lea esi, [ebp - 0x50]
mov ecx, str.x32dbg
cmp dword [ebp - 0x54], 0xf
lea eax, [ebp - 0x68]
push ecx
cmova eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
jne 0x10001598
mov ecx, dword [esi + 4]
add esi, 4
test ecx, ecx
jne 0x100014a5
mov ecx, dword [ebp - 0x54]
cmp ecx, 0xf
jbe 0x10001501
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100014f7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001612
push ecx
push edx
call fcn.10001f81
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
cmp ecx, 7
jbe 0x10001554
mov edx, dword [ebp - 0x80]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000154a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001612
push ecx
push edx
call fcn.10001f81
add esp, 8
lea eax, [ebp - 0x2ac]
push eax
push dword [ebp - 0x2b0]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10001376
push dword [ebp - 0x2b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001f3e
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x2b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x54]
cmp ecx, 0xf
jbe 0x100015d4
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100015ca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001612
push ecx
push edx
call fcn.10001f81
add esp, 8
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
cmp ecx, 7
jbe 0x10001622
mov edx, dword [ebp - 0x80]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10001618
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001618
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10001f81
add esp, 8
mov al, 1
jmp 0x1000157d
call fcn.100011a0
call fcn.10001100
int3