Function at 0x10012410
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
push esi
push edi
xor esi, esi
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x140]
mov dword [ebp - 0x144], esi
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [ebp - 0x247]
mov byte [ebp - 0x248], al
mov ebx, dword [sym.imp.MSVCRT.dll_putchar]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x30
mov dword [ebp - 0xc], esi
stosb byte es:[edi], al
call ebx
push 0x10002e80
call fcn.10014e20
push 0x30
call ebx
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
push 0x30
mov dword [ebp - 0x14], esi
call ebx
add esp, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp esi, 0xffffffff
jne 0x1001249e
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x400
push 0x40
mov dword [ebp - 0x144], 0x128
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x10002e74
mov dword [ebp - 8], eax
mov byte [eax], 0x7d
mov edi, 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x30
mov esi, eax
call ebx
add esp, 4
push 0x10002e60
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x30
mov dword [ebp - 0x1c], eax
call ebx
push 0x30
call ebx
add esp, 8
push 0x10002e48
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x30
mov dword [ebp - 0x18], eax
call ebx
mov ecx, dword [ebp - 0x14]
add esp, 4
lea eax, [ebp - 0x144]
push eax
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1001269b
push 0x30
call ebx
mov edx, dword [ebp - 0x13c]
add esp, 4
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x30
mov esi, eax
call ebx
mov eax, dword [ebp - 0x13c]
add esp, 4
test eax, eax
je 0x10012683
cmp eax, 4
je 0x10012683
cmp eax, 8
je 0x10012683
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x30
call ebx
add esp, 4
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0xc]
push eax
push 4
push ecx
push esi
call dword [ebp - 0x1c]
push 0x30
call ebx
mov eax, dword [ebp - 0xc]
add esp, 4
lea edx, [ebp - 0x248]
push 0x104
push edx
push eax
push esi
call dword [ebp - 0x18]
push 0x30
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 4
lea ecx, [ebp - 0x120]
push ecx
call esi
mov edx, eax
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 4], edx
call esi
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
push edx
lea eax, [ecx + eax + 6]
lea esi, [eax + edi]
call dword [sym.imp.KERNEL32.dll_LocalSize]
cmp eax, esi
jae 0x100125f1
mov eax, dword [ebp - 8]
push 0x42
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x13c]
lea eax, [ebp - 0x120]
mov dword [edi + edx], ecx
add edi, 4
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 8]
mov ecx, eax
inc ecx
lea esi, [ebp - 0x120]
mov eax, ecx
add edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x120]
push ecx
call esi
mov edx, dword [ebp - 4]
lea edi, [edx + eax + 1]
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 4], edi
call esi
mov edx, dword [ebp - 8]
mov ecx, eax
inc ecx
lea esi, [ebp - 0x248]
mov eax, ecx
add edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 4]
lea eax, [edx + eax + 1]
mov dword [ebp - 4], eax
mov edi, eax
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x144]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1001251c
mov eax, dword [ebp - 8]
push 0x42
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 0x10002e80
mov esi, eax
call fcn.10014e20
mov ecx, dword [ebp - 0x14]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret