Function at 0x10005000
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x100053dc
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x1000801c]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1000801c]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1b], 0
xor ebp, ebp
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov dword [esp + 0x1c0], ebp
mov al, 0x6c
mov cl, 0x6e
mov byte [esp + 0x182], al
mov byte [esp + 0x17d], al
mov byte [esp + 0x183], al
mov byte [esp + 0x1a1], al
mov byte [esp + 0x1a4], al
mov al, 0x70
mov byte [esp + 0x17b], cl
mov byte [esp + 0x1a9], cl
mov cl, 0x68
mov byte [esp + 0x1a5], al
mov byte [esp + 0x1ab], al
mov bl, 0x65
lea eax, [esp + 0x198]
mov byte [esp + 0x1ad], cl
mov byte [esp + 0x1a2], cl
mov dl, 0x32
push eax
lea ecx, [esp + 0x17c]
push ecx
mov byte [esp + 0x186], 0x33
mov byte [esp + 0x188], 0x2e
mov byte [esp + 0x182], 0x72
mov byte [esp + 0x189], 0x64
mov byte [esp + 0x187], dl
mov byte [esp + 0x181], bl
mov byte [esp + 0x184], bl
mov byte [esp + 0x18c], 0
mov byte [esp + 0x180], 0x6b
mov byte [esp + 0x1b6], 0x6f
mov byte [esp + 0x1ae], 0x33
mov byte [esp + 0x1b7], 0x74
mov byte [esp + 0x1a5], bl
mov byte [esp + 0x1b2], 0x61
mov byte [esp + 0x1b0], 0x53
mov byte [esp + 0x1af], dl
mov byte [esp + 0x1a3], 0x61
mov byte [esp + 0x1ab], bl
mov byte [esp + 0x1a4], 0x74
mov byte [esp + 0x1a6], 0x54
mov byte [esp + 0x1b8], 0
mov byte [esp + 0x1a2], bl
mov byte [esp + 0x1b4], 0x73
mov byte [esp + 0x1a0], 0x43
mov byte [esp + 0x1a8], 0x6f
mov byte [esp + 0x1a7], 0x6f
mov byte [esp + 0x1a1], 0x72
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
jne 0x100051ba
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c0], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor al, al
jmp 0x100053a5
push ebp
push 2
call eax
mov esi, eax
or edi, 0xffffffff
mov dword [esp + 0x1c], esi
cmp esi, edi
je 0x100051ea
lea edx, [esp + 0x3c]
push edx
push esi
mov dword [esp + 0x44], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x10005202
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c0], edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor al, al
jmp 0x100053a5
mov edi, dword [sym.imp.MSVCR90.dll_tolower]
xor esi, esi
lea ebx, [ebx]
movsx eax, byte [esp + esi + 0x60]
push eax
call edi
mov byte [esp + esi + 0x64], al
inc esi
add esp, 4
cmp esi, 0x104
jl 0x10005210
lea ecx, [esp + 0x60]
push ecx
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push 0
lea edx, [esp + 0x168]
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x16c], 0x2e
mov byte [esp + 0x16e], 0x78
mov byte [esp + 0x170], 0
mov byte [esp + 0x16d], bl
mov byte [esp + 0x16f], bl
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char_const___unsigned_int_const]
test eax, eax
jbe 0x10005361
push 0
lea eax, [esp + 0x18c]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x194], 0x73
mov byte [esp + 0x192], 0x6f
mov byte [esp + 0x199], 0x63
mov byte [esp + 0x19c], 0
mov byte [esp + 0x196], 0x72
mov byte [esp + 0x190], 0x76
mov byte [esp + 0x193], 0x78
mov byte [esp + 0x191], 0x62
mov byte [esp + 0x195], bl
mov byte [esp + 0x19a], bl
mov byte [esp + 0x198], 0x69
mov byte [esp + 0x19b], 0x2e
mov byte [esp + 0x197], 0x76
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char_const___unsigned_int_const]
test eax, eax
jne 0x100052f8
inc ebp
push 0
lea ecx, [esp + 0x170]
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17a], 0x61
mov byte [esp + 0x179], 0x72
mov byte [esp + 0x177], 0x78
mov byte [esp + 0x176], 0x6f
mov byte [esp + 0x17c], 0x2e
mov byte [esp + 0x17d], 0
mov byte [esp + 0x178], 0x74
mov byte [esp + 0x175], 0x62
mov byte [esp + 0x174], 0x76
mov byte [esp + 0x17b], 0x79
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char_const___unsigned_int_const]
test eax, eax
jne 0x10005361
inc ebp
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x3c]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10005208
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 1
mov bl, 1
jg 0x1000538e
mov bl, byte [esp + 0x1b]
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c0], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, bl
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.10001b8a
add esp, 0x1b0
ret