Function at 0x10008f40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10092203
mov eax, dword fs:[0]
push eax
sub esp, 0x6e4
mov eax, dword [0x100d7294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
je 0x10008f77
cmp dword [ebp + 0x10], 0
jne 0x10008f7e
xor eax, eax
jmp 0x100093ce
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
je 0x1000910f
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.100672b0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
mov eax, dword [ebp - 0x4dc]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
mov dword [ebp - 0x500], eax
mov ecx, dword [ebp - 0x4dc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x500], 0
je 0x10009018
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1000ad10
mov eax, 1
jmp 0x100093ce
call fcn.10052b20
mov dword [ebp - 0x4e0], eax
push 1
mov edx, dword [ebp - 0x4e0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4e0]
mov edx, dword [eax + 8]
call edx
mov byte [ebp - 0x504], al
cmp byte [ebp - 0x504], 1
je 0x1000904c
jmp 0x1000910a
push 0x10098668
lea ecx, [ebp - 0x248]
call fcn.10004fd0
mov dword [ebp - 4], 0
push 0x100986cc
lea ecx, [ebp - 0x230]
call fcn.10004fd0
mov byte [ebp - 4], 1
call fcn.10052b20
mov dword [ebp - 0x4e4], eax
push str.GetModuleFileNameEx_Failed
push 0xf7
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x5c0]
call fcn.10005660
mov dword [ebp - 0x508], eax
mov edx, dword [ebp - 0x508]
mov dword [ebp - 0x50c], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x50c]
call fcn.10002ad0
push eax
mov eax, dword [ebp - 0x4e4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x4e4]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c0]
call fcn.100065c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.100062e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.100062e0
jmp 0x1000930d
call fcn.10052b20
mov dword [ebp - 0x4e8], eax
push 1
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4e8]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x510], al
cmp byte [ebp - 0x510], 1
je 0x10009143
jmp 0x1000921b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x514], eax
push 0x100986f0
lea ecx, [ebp - 0x278]
call fcn.10004fd0
mov dword [ebp - 4], 3
push 0x100986ec
lea ecx, [ebp - 0x260]
call fcn.10004fd0
mov byte [ebp - 4], 4
call fcn.10052b20
mov dword [ebp - 0x4ec], eax
lea ecx, [ebp - 0x514]
push ecx
push str.LastError:
push 0xfa
lea edx, [ebp - 0x278]
push edx
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x658]
call fcn.10005660
mov dword [ebp - 0x518], eax
mov ecx, dword [ebp - 0x518]
mov dword [ebp - 0x51c], ecx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x51c]
call fcn.10002ad0
mov ecx, eax
call fcn.10002af0
push eax
mov edx, dword [ebp - 0x4ec]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [eax + 0x1c]
call edx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x658]
call fcn.100065c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x260]
call fcn.100062e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.100062e0
call fcn.10052b20
mov dword [ebp - 0x4f0], eax
push 1
mov eax, dword [ebp - 0x4f0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x4f0]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x520], al
cmp byte [ebp - 0x520], 1
je 0x1000924f
jmp 0x1000930d
push str.d:jenkins.jenkinsworkspacedolphin_gamemodegamemodeldsmodeidentifyldsmodeidentifycommon.cpp
lea ecx, [ebp - 0x2a8]
call fcn.10004fd0
mov dword [ebp - 4], 6
push 0x100987c4
lea ecx, [ebp - 0x290]
call fcn.10004fd0
mov byte [ebp - 4], 7
call fcn.10052b20
mov dword [ebp - 0x4f4], eax
push str.hproc_is_NULL
push 0xfb
lea ecx, [ebp - 0x2a8]
push ecx
lea edx, [ebp - 0x290]
push edx
lea ecx, [ebp - 0x6f0]
call fcn.10005660
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x528], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x528]
call fcn.10002ad0
push eax
mov ecx, dword [ebp - 0x4f4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4f4]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6f0]
call fcn.100065c0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x290]
call fcn.100062e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a8]
call fcn.100062e0
mov dword [ebp - 0x4fc], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0xffffffff
je 0x100093c8
push 0x22c
push 0
lea ecx, [ebp - 0x4d4]
push ecx
call fcn.100672b0
add esp, 0xc
mov dword [ebp - 0x4d4], 0x22c
lea edx, [ebp - 0x4d4]
push edx
mov eax, dword [ebp - 0x4d8]
push eax
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 0
je 0x100093bb
mov ecx, dword [ebp - 0x4cc]
cmp ecx, dword [ebp + 8]
jne 0x100093a0
lea edx, [ebp - 0x4b0]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1000ad10
mov dword [ebp - 0x4fc], 1
jmp 0x100093bb
lea edx, [ebp - 0x4d4]
push edx
mov eax, dword [ebp - 0x4d8]
push eax
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x4f8], eax
jmp 0x1000936c
mov ecx, dword [ebp - 0x4d8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4fc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005fbb2
mov esp, ebp
pop ebp
ret