Function at 0x1006f737
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2cc
mov eax, dword [0x100c51b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c8]
mov eax, dword [eax]
mov dword [ebp - 0x2a8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2b4], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2d8], eax
mov esi, dword [ebp - 0x2a8]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov ecx, esi
push 1
call fcn.1000e936
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x2ac], eax
mov esi, 0x67919f0
lea ebx, [ebp - 0x26c]
cmp esi, 0x67919ef
jg 0x1006f84a
cmp esi, 0xb5f4c17b
jg 0x1006f9f6
cmp esi, 0xa205e994
jg 0x1006faba
cmp esi, 0x8c02889d
je 0x1006fb71
cmp esi, 0x95016700
jne 0x1006f7b5
mov edi, dword [ebp - 0x2a8]
mov esi, dword [ebp - 0x2bc]
xor eax, eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], 0xf
mov byte [ebp - 0x26c], 0
push esi
call fcn.1009ee80
add esp, 4
mov ecx, ebx
push eax
push esi
call fcn.10007b00
mov ecx, edi
push ebx
lea eax, [ebp - 0x2a0]
push eax
call fcn.10072d16
mov ecx, ebx
call fcn.100087f0
mov esi, 0xa205e995
jmp 0x1006f7b5
cmp esi, 0x2e841b8d
jle 0x1006fa91
cmp esi, 0x3da0cea0
jg 0x1006fae6
cmp esi, 0x2e841b8e
je 0x1006fb8a
cmp esi, 0x30d7839e
jne 0x1006f7b5
lea edi, [ebp - 0x254]
push edi
push ebx
call fcn.10061f56
add esp, 8
mov ecx, edi
push ebx
call fcn.1000105c
mov ecx, ebx
call fcn.100087f0
lea ecx, [ebp - 0x28d]
mov dword [ebp - 0x2b8], ecx
mov eax, dword [ebp - 0x2b8]
mov eax, dword [ebp - 0x2b8]
xorps xmm0, xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
mov byte [eax + 0x20], 0
mov dword [ebp - 0x2bc], ecx
mov esi, dword [ebp - 0x244]
mov ecx, edi
call fcn.10007c1e
push dword [ebp - 0x2bc]
push esi
push eax
call fcn.10060438
add esp, 0xc
mov esi, esp
sub esp, 0xc
mov edi, esp
mov ecx, edi
push ebx
push dword [ebp - 0x2b4]
call fcn.10072912
lea eax, [edi + 8]
mov ecx, dword [ebp - 0x2bc]
mov dword [edi + 8], ecx
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2c0], eax
lea edi, [ebp - 0x294]
mov dword [ebp - 0x2a0], edi
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x26c]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2a0]
mov dword [ecx], eax
mov eax, 0x218e217a
cmp eax, 0xadecc1a
jg 0x1006f973
cmp eax, 0x8d7fc2d7
je 0x1006f9a9
cmp eax, 0xb1563369
je 0x1006f9b2
cmp eax, 0xf06ce0bf
jne 0x1006f94e
mov bl, 1
mov eax, 0xadecc1b
jmp 0x1006f94e
cmp eax, 0xadecc1b
je 0x1006fba7
cmp eax, 0x3ff298d6
je 0x1006f9e5
cmp eax, 0x218e217a
jne 0x1006f94e
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x294]
cmp ecx, dword [eax]
mov eax, 0xb1563369
mov ecx, 0x8d7fc2d7
cmove eax, ecx
jmp 0x1006f94e
mov eax, 0xadecc1b
xor ebx, ebx
jmp 0x1006f94e
mov ecx, dword [ebp - 0x294]
add ecx, 0x10
call fcn.10007bca
mov ecx, dword [ebp - 0x2c0]
push eax
push dword [ecx]
call fcn.1009ca1d
add esp, 8
test eax, eax
mov eax, 0x3ff298d6
mov ecx, 0xf06ce0bf
cmove eax, ecx
jmp 0x1006f94e
mov ecx, edi
call fcn.10071afa
mov eax, 0x218e217a
jmp 0x1006f94e
cmp esi, 0xeb365f1b
jg 0x1006fb3c
cmp esi, 0xb5f4c17c
je 0x1006fbe0
cmp esi, 0xd77f2bb7
jne 0x1006f7b5
lea edi, [ebp - 0x254]
mov dword [ebp - 0x2d0], edi
mov eax, dword [ebp - 0x2d0]
xor eax, eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], 7
mov word [ebp - 0x26c], 0
lea esi, [ebp - 0x218]
push esi
call fcn.1009f1fa
add esp, 4
mov ecx, ebx
push eax
push esi
call fcn.1001a43a
push ebx
push edi
call fcn.1005c1f9
add esp, 8
mov ecx, ebx
call fcn.1000e7f4
mov eax, dword [ebp - 0x2d8]
cmp byte [eax], 0
mov esi, 0x30d7839e
mov eax, 0xb5f4c17c
cmove esi, eax
jmp 0x1006f7b5
cmp esi, 0x67919f0
je 0x1006fdf0
cmp esi, 0x86e86bb
je 0x1006fe0b
cmp esi, 0xb81c729
je 0x1006fb67
jmp 0x1006f7b5
cmp esi, 0xa205e995
je 0x1006fe3e
cmp esi, 0xaeeb38c3
jne 0x1006f7b5
push dword [ebp - 0x2ac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2cc]
jmp 0x1006fb32
cmp esi, 0x3da0cea1
je 0x1006fb32
cmp esi, 0x516f2e1b
jne 0x1006f7b5
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x2cc], ecx
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x23c], 0x22c
mov esi, 0x8c02889d
push ecx
push dword [ebp - 0x2ac]
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x2c4], eax
jmp 0x1006f7b5
mov esi, 0xb81c729
jmp 0x1006f7b5
cmp esi, 0x226916a
jne 0x1006fe4e
mov esi, dword [ebp - 0x2a8]
mov eax, dword [esi]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.1000e8c2
push 0x28
push dword [esi]
call fcn.1000791c
add esp, 8
mov esi, 0xeb365f1c
jmp 0x1006f7b5
cmp dword [ebp - 0x2c4], 0
mov esi, 0xd77f2bb7
mov eax, 0xaeeb38c3
cmove esi, eax
jmp 0x1006f7b5
mov ecx, dword [ebp - 0x2a8]
lea eax, [ebp - 0x254]
push eax
push ebx
call fcn.100738dc
mov esi, 0x86e86bb
jmp 0x1006f7b5
mov eax, dword [ebp - 0x2a0]
mov edi, dword [ebp - 0x2a4]
mov eax, dword [edi]
mov ecx, edi
push dword [eax + 4]
push edi
call fcn.1000e8c2
push 0x28
push dword [edi]
call fcn.1000791c
add esp, 8
mov esp, esi
test bl, 1
mov esi, 0xa205e995
mov eax, 0x95016700
jmp 0x1006fde2
mov dword [ebp - 0x2d4], esp
push eax
sub esp, 8
mov edi, esp
lea ecx, [ebp - 0x254]
call fcn.10007bca
mov esi, eax
mov ecx, edi
push ebx
push dword [ebp - 0x2b4]
call fcn.10072912
lea eax, [edi + 8]
mov dword [edi + 8], esi
mov dword [ebp - 0x294], edi
mov edi, 0x7068d97f
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a4]
mov eax, dword [eax]
mov dword [ebp - 0x2c0], eax
mov eax, 0x1de80c2b
mov dword [ebp - 0x2b0], ecx
lea esi, [ebp - 0x298]
cmp eax, 0x4a416c9c
jle 0x1006fc71
cmp eax, 0x7068d97e
jle 0x1006fca4
cmp eax, 0x7068d97f
je 0x1006fd1e
cmp eax, 0x7191206a
je 0x1006fd2a
cmp eax, 0x7c62d9bd
jne 0x1006fc3d
mov bl, 1
mov eax, 0x89e5df68
jmp 0x1006fc3d
cmp eax, 0xf78f8ef5
jle 0x1006fcca
cmp eax, 0xf78f8ef6
je 0x1006fd5d
cmp eax, 0x1de80c2b
jne 0x1006fda1
cmp dword [ebp - 0x2c0], 0
mov eax, 0x96a55b17
mov ecx, 0x5da0afae
cmove eax, ecx
jmp 0x1006fc3d
cmp eax, 0x4a416c9d
je 0x1006fd78
cmp eax, 0x5da0afae
jne 0x1006fc3d
mov eax, 0x1bb72dc2
mov dword [ebp - 0x2b0], 0
jmp 0x1006fc3d
cmp eax, 0x89e5df68
je 0x1006fd89
cmp eax, 0x96a55b17
jne 0x1006fc3d
mov dword [ebp - 0x2a0], esi
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x26c]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2a0]
mov dword [ecx], eax
mov eax, 0xf78f8ef6
jmp 0x1006fc3d
mov eax, 0x89e5df68
xor ebx, ebx
jmp 0x1006fc3d
mov ecx, dword [ebp - 0x298]
add ecx, 0x10
call fcn.10007bca
mov ecx, dword [ebp - 0x2a4]
push eax
push dword [ecx]
call fcn.1009ca1d
add esp, 8
test eax, eax
mov eax, 0x4a416c9d
mov ecx, 0x7c62d9bd
cmove eax, ecx
jmp 0x1006fc3d
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x298]
cmp ecx, dword [eax]
mov eax, 0x7191206a
cmove eax, edi
jmp 0x1006fc3d
mov ecx, esi
call fcn.10071afa
mov eax, 0xf78f8ef6
jmp 0x1006fc3d
mov eax, dword [ebp - 0x2a0]
mov eax, 0x1bb72dc2
mov ecx, ebx
mov dword [ebp - 0x2b0], ecx
jmp 0x1006fc3d
cmp eax, 0x1bb72dc2
jne 0x1006fc3d
mov esi, dword [ebp - 0x294]
mov eax, dword [esi]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.1000e8c2
push 0x28
push dword [esi]
call fcn.1000791c
add esp, 8
mov esp, dword [ebp - 0x2d4]
test byte [ebp - 0x2b0], 1
mov esi, 0x86e86bb
mov eax, 0x2e841b8e
cmovne esi, eax
lea ebx, [ebp - 0x26c]
jmp 0x1006f7b5
mov eax, dword [ebp - 0x2ac]
cmp eax, 0xffffffff
mov esi, 0x516f2e1b
mov eax, 0x3da0cea1
cmove esi, eax
jmp 0x1006f7b5
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x2ac]
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x2c4], eax
lea ecx, [ebp - 0x254]
call fcn.100087f0
mov eax, dword [ebp - 0x2d0]
mov esi, 0x8c02889d
jmp 0x1006f7b5
mov eax, dword [ebp - 0x2b8]
mov esi, 0x86e86bb
jmp 0x1006f7b5
cmp esi, 0xeb365f1c
jne 0x1006f7b5
mov esi, dword [ebp - 0x2b4]
mov eax, dword [esi]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.1000e8c2
push 0x28
push dword [esi]
call fcn.1000791c
add esp, 8
mov eax, dword [ebp - 0x2c8]
mov esi, dword [eax]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100879aa
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret