Function at 0x100b7950
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x1019428e
mov eax, dword fs:[0]
push eax
mov eax, 0x1354
call fcn.10130320
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x1350], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101e5aec]
xor eax, esp
push eax
lea eax, [esp + 0x1368]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1378]
mov ebp, dword [esp + 0x1384]
mov ebx, dword [esp + 0x1388]
lea ecx, [esp + 0x1024]
mov dword [esp + 0x20], 0
mov edx, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1034], ecx
mov dword [esp + 0x1038], edx
mov dword [esp + 0x1370], 1
mov eax, dword [esp + 0x1034]
mov byte [eax], 0
mov dword [esp + 0x1370], 2
mov edx, edx
mov edi, 0x10198a18
mov esi, ebp
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x100b7a02
mov ebp, 0x10198bf0
push ecx
pop ecx
mov edi, 0x10198a18
mov esi, ebx
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x100b7a23
mov ebx, 0x10198bf0
cmp dword [0x101d08f8], 0x72d6
lea ecx, [esp + 0x18]
call fcn.10021b40
mov byte [esp + 0x1370], 3
lea ecx, [esp + 0x14]
call fcn.10021b40
mov byte [esp + 0x1370], 4
push ecx
pop ecx
test ebp, ebp
jne 0x100b7a4f
xor eax, eax
jmp 0x100b7a5f
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100b7a54
sub eax, edx
push eax
push ebp
lea ecx, [esp + 0x20]
call fcn.10048330
cmp dword [0x101d08e4], 0x7a3c
test ebx, ebx
jne 0x100b7a7c
xor eax, eax
jmp 0x100b7a8c
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100b7a81
sub eax, edx
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.10048330
cmp dword [0x101d08e8], 0x76a2
lea ecx, [esp + 0x18]
call fcn.1007b790
mov bh, bh
lea ecx, [esp + 0x14]
call fcn.1007b790
mov dl, dl
cmp dword [0x101d08e8], 0x76a2
mov eax, dword [esp + 0x1380]
lea edx, [esp + 0x1164]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x100b7ad1
mov ecx, ecx
lea ecx, [esp + 0x1164]
push ecx
call fcn.1005ed80
add esp, 4
mov edx, edx
mov esi, esi
push 0x1000
lea edx, [esp + 0x28]
push 0
push edx
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d08e4], 0xffff85c3
xor edi, edi
cmp dword [0x101d08f0], 0xffffe315
push edx
pop edx
push 0x128
lea eax, [esp + 0x1040]
push edi
push eax
call fcn.1012ea60
add esp, 0xc
mov bl, bl
mov dword [esp + 0x103c], 0x128
cmp dword [0x101d08ec], 0xffffd18d
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp dword [0x101d0904], 0x301b
cmp esi, 0xffffffff
jne 0x100b7b7d
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x1024]
push ecx
mov ecx, esi
call fcn.100046a0
jmp 0x100b7cc1
lea edx, [esp + 0x103c]
push edx
push esi
call sub.KERNEL32.dll_Process32First
mov bl, bl
test eax, eax
mov ebx, dword [esp + 0x138c]
je 0x100b7c4d
lea esp, [esp]
cmp dword [0x101d08e8], 0xffff895d
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x1060]
mov byte [esp + eax + 0x1264], cl
add eax, 1
test cl, cl
jne 0x100b7bb0
cmp dword [0x101d08fc], 0xfffff233
lea eax, [esp + 0x1264]
push eax
call fcn.1005ed80
add esp, 4
cmp dword [0x101d08e4], 0x7a3c
lea ecx, [esp + 0x1164]
lea eax, [esp + 0x1264]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100b7c17
test dl, dl
je 0x100b7c13
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100b7c17
add eax, 2
add ecx, 2
test dl, dl
jne 0x100b7bf7
xor eax, eax
jmp 0x100b7c1c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100b7c35
mov ecx, dword [esp + 0x1044]
mov dword [esp + edi*4 + 0x24], ecx
add edi, 1
push edx
pop edx
test bl, 4
jne 0x100b7c4d
lea edx, [esp + 0x103c]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
mov eax, eax
test eax, eax
jne 0x100b7ba0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x101d08f4], 0xffff8705
test edi, edi
je 0x100b7cae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [0x101d08fc], 0xfffff233
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1028]
push edx
mov edx, dword [esp + 0x20]
push ebx
push ecx
push edx
push eax
call fcn.100b22e0
add esp, 0x18
mov bl, bl
test bl, 0x20
je 0x100b7cae
mov esi, dword [esp + 0x1c]
lea edx, [esp + 0x1024]
mov ecx, esi
call fcn.100b6510
jmp 0x100b7cc1
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x1024]
push eax
mov ecx, esi
call fcn.100046a0
mov dword [esp + 0x20], 1
mov byte [esp + 0x1370], 3
lea ecx, [esp + 0x14]
call fcn.10021bb0
mov byte [esp + 0x1370], 2
lea ecx, [esp + 0x18]
call fcn.10021bb0
mov byte [esp + 0x1370], 0
lea ecx, [esp + 0x1024]
call fcn.10002070
mov eax, esi
mov ecx, dword [esp + 0x1368]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1350]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x1360
ret