Function at 0x1000d833
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push 0x36c
mov eax, 0x1003a1aa
call fcn.10022cff
mov esi, ecx
mov dword [ebp - 0x364], esi
lea eax, [ebp - 0x378]
mov word [ebp - 0x353], 0x512
xor ebx, ebx
mov byte [ebp - 0x354], 0xe
push eax
lea ecx, [ebp - 0x354]
mov dword [ebp - 0x350], ebx
call fcn.100073aa
push ebx
push 2
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1000d8a9
and dword [ebp - 0x350], 0
lea ecx, [ebp - 0x354]
mov word [ebp - 0x353], 0x1912
mov byte [ebp - 0x354], 0xe
jmp 0x1000dcc0
mov edi, 0x22c
lea eax, [ebp - 0x34c]
push edi
push 0
push eax
call fcn.100255c0
movaps xmm0, xmmword [0x10044b30]
xor eax, eax
add esp, 0xc
mov byte [ebp - 0x24], al
mov byte [ebp - 0x32], al
mov byte [ebp - 0x60], al
lea eax, [ebp - 0x34c]
movups xmmword [ebp - 0x78], xmm0
push eax
movaps xmm0, xmmword [0x10044b40]
push ebx
mov dword [ebp - 0x34c], edi
mov dword [ebp - 0x30], 0x6e72656b
mov dword [ebp - 0x2c], 0x32336c65
mov dword [ebp - 0x28], 0x6c6c642e
mov dword [ebp - 0x40], 0x6f577349
mov dword [ebp - 0x3c], 0x50343677
mov dword [ebp - 0x38], 0x65636f72
mov word [ebp - 0x34], 0x7373
mov dword [ebp - 0x20], 0x6c64746e
mov dword [ebp - 0x1c], 0x6c642e6c
mov word [ebp - 0x18], 0x6c
mov dword [ebp - 0x68], 0x616d726f
mov dword [ebp - 0x64], 0x6e6f6974
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x4c], 0x72506e6f
mov dword [ebp - 0x48], 0x7365636f
mov word [ebp - 0x44], 0x73
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1000dc94
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x1000dc86
mov eax, dword [ebp - 0x36c]
test eax, eax
je 0x1000da01
cmp dword [ebp - 0x370], 0
je 0x1000da01
sub eax, dword [ebp - 0x370]
cmp eax, 0x7d000
jbe 0x1000da01
sub esp, 0x14
lea eax, [ebp - 0x378]
mov ecx, esp
push eax
call fcn.10005a66
mov ecx, esi
call fcn.1000ca04
lea ecx, [ebp - 0x378]
call fcn.10005b11
and dword [ebp - 0x358], 0
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x35c]
mov word [ebp - 0x35b], 0x1b12
mov byte [ebp - 0x35c], 0xe
call fcn.100073aa
push eax
lea ecx, [ebp - 0x378]
call fcn.100061e9
dec dword [0x100509d8]
lea ecx, [ebp - 0x8c]
call fcn.10005aee
mov ecx, dword [ebp - 0x344]
xor edx, edx
mov dword [ebp - 0xf4], edx
xor eax, eax
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xe0], 7
mov word [ebp - 0xf4], ax
mov dword [ebp - 0xdc], edx
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0xc8], 7
mov word [ebp - 0xdc], ax
mov dword [ebp - 0xc4], edx
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb0], 7
mov word [ebp - 0xc4], ax
mov dword [ebp - 0xac], edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], 7
mov word [ebp - 0xac], ax
mov word [ebp - 0x104], 0x120e
mov byte [ebp - 0x102], 0x1c
mov dword [ebp - 0xf8], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x328]
mov dword [ebp - 0x100], ecx
lea ecx, [ebp - 0xf4]
push eax
call fcn.10012757
push 0
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x90]
call fcn.10005d9d
pop ecx
mov edi, eax
mov byte [ebp - 4], 6
cmp dword [edi + 0x14], 8
jb 0x1000dad6
mov edi, dword [edi]
mov esi, dword [ebp - 0x344]
call fcn.1001cea1
test al, al
jne 0x1000daea
xor eax, eax
inc eax
jmp 0x1000db43
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000db41
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000db3a
and dword [ebp - 0x360], 0
lea ecx, [ebp - 0x360]
push ecx
push esi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x360], eax
sete al
inc eax
jmp 0x1000db43
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 4], 5
call fcn.1001340c
mov edx, dword [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x90]
call fcn.1001d002
pop ecx
push eax
lea ecx, [ebp - 0xdc]
call fcn.100127a6
lea ecx, [ebp - 0x90]
call fcn.1001340c
push 0
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x11c]
call fcn.10005d9d
pop ecx
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
jb 0x1000db9f
mov eax, dword [eax]
mov edx, dword [ebp - 0x344]
lea ecx, [ebp - 0x78]
push ecx
push eax
lea ecx, [ebp - 0x90]
call fcn.1001d51c
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xc4]
call fcn.100127a6
lea ecx, [ebp - 0x90]
call fcn.1001340c
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 5
call fcn.1001340c
push 0
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x90]
call fcn.10005d9d
pop ecx
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
jb 0x1000dbfa
mov eax, dword [eax]
mov edx, dword [ebp - 0x344]
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0x11c]
call fcn.1001d5ed
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xac]
call fcn.100127a6
lea ecx, [ebp - 0x11c]
call fcn.1001340c
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 5
call fcn.1001340c
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x104]
call fcn.100073fc
mov ecx, eax
call fcn.10005b56
push eax
push dword [ecx + 8]
lea ecx, [ebp - 0x378]
call fcn.10005b6a
dec dword [0x100509d8]
lea ecx, [ebp - 0x8c]
call fcn.10005aee
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 0
call fcn.1000e971
mov esi, dword [ebp - 0x364]
lea eax, [ebp - 0x34c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1000d960
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x358], 0
lea ecx, [ebp - 0x35c]
mov word [ebp - 0x35b], 0x1912
mov byte [ebp - 0x35c], 0xe
lea eax, [ebp - 0x8c]
push eax
call fcn.100073aa
mov ecx, eax
call fcn.10005b56
push eax
push dword [ecx + 8]
lea ecx, [ebp - 0x378]
call fcn.10005b6a
dec dword [0x100509d8]
lea ecx, [ebp - 0x8c]
call fcn.10005aee
sub esp, 0x14
lea eax, [ebp - 0x378]
mov ecx, esp
push eax
call fcn.10005a66
mov ecx, esi
call fcn.1000ca04
dec dword [0x100509d8]
lea ecx, [ebp - 0x378]
call fcn.10005aee
call fcn.10022cbd
ret