Function at 0x100d11c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x1010eeb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1017773c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24c], esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1017745c]
cmp eax, dword [ecx + 4]
jg 0x100d1453
cmp dword [0x1010ee10], 0
push ebx
push edi
jne 0x100d1395
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call fcn.100d1ea0
test al, al
jne 0x100d127a
push edi
lea eax, [ebp - 0x1c]
push str._05d
push eax
call fcn.100aa6c0
mov edi, eax
add esp, 0xc
cmp edi, 0x1010ee00
je 0x100d138d
mov ecx, dword [0x1010ee14]
cmp ecx, 0x10
jb 0x100d134a
mov edx, dword [0x1010ee00]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100d1340
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d1489
jmp 0x100d1340
push 0
push 2
mov dword [ebp - 0x24c], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov ebx, eax
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.100e00b0
add esp, 0xc
mov dword [ebp - 0x248], 0x22c
lea eax, [ebp - 0x248]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x100d12e7
cmp dword [ebp - 0x240], edi
je 0x100d12db
lea eax, [ebp - 0x248]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100d12c0
jmp 0x100d12e7
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x24c], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [ebp - 0x24c]
lea eax, [ebp - 0x1c]
push str._05d__05d
push eax
call fcn.100aa6c0
mov edi, eax
add esp, 0x10
cmp edi, 0x1010ee00
je 0x100d138d
mov ecx, dword [0x1010ee14]
cmp ecx, 0x10
jb 0x100d134a
mov edx, dword [0x1010ee00]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100d1340
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d148e
push ecx
push edx
call fcn.100dde0b
add esp, 8
mov dword [0x1010ee10], 0
mov dword [0x1010ee14], 0xf
mov byte [0x1010ee00], 0
movups xmm0, xmmword [edi]
movups xmmword [0x1010ee00], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [0x1010ee10], xmm0
mov dword [edi + 0x10], 0
mov byte [edi], 0
mov dword [edi + 0x14], 0xf
lea ecx, [ebp - 0x1c]
call fcn.100a8680
xorps xmm0, xmm0
mov eax, 0x1010ee00
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
cmp dword [0x1010ee14], 0x10
mov ebx, dword [0x1010ee10]
cmovae eax, dword [0x1010ee00]
mov dword [ebp - 0x24c], eax
cmp ebx, 0x7fffffff
ja 0x100d1493
mov dword [esi + 0x14], 0xf
cmp ebx, 0x10
jae 0x100d13fc
mov dword [esi + 0x10], ebx
movups xmm0, xmmword [eax]
pop edi
mov eax, esi
movups xmmword [esi], xmm0
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100de133
mov esp, ebp
pop ebp
ret
mov edi, ebx
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x100d1410
mov edi, SysReAllocString
jmp 0x100d141a
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
mov ecx, esi
push eax
call fcn.100d92a0
lea ecx, [ebx + 1]
mov dword [esi], eax
push ecx
push dword [ebp - 0x24c]
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], edi
call fcn.100dfb30
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, esi
xor ecx, ebp
pop edi
pop ebx
pop esi
call fcn.100de133
mov esp, ebp
pop ebp
ret
push 0x1017745c
call fcn.100de1b5
add esp, 4
cmp dword [0x1017745c], 0xffffffff
jne 0x100d11fd
push 0x100fc8c0
call fcn.100de11e
push 0x1017745c
call fcn.100de164
add esp, 8
jmp 0x100d11fd
call fcn.100e246f
call fcn.100e246f
call fcn.100a9be0
int3