Function at 0x100089b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001286e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x278
push ebx
push esi
push edi
mov edi, ecx
push 0
mov dword [ebp - 0x2c], edi
push 2
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x34], eax
push ecx
push eax
mov dword [ebp - 0x280], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x4c]
call fcn.10003170
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x4c]
cmp dword [ebp - 0x38], 7
mov eax, dword [ebp - 0x3c]
cmova ecx, dword [ebp - 0x4c]
seta bl
test bl, bl
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x4c]
cmovne ecx, dword [ebp - 0x4c]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.100034a0
mov byte [ebp - 4], 2
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
seta al
cmova esi, ebx
mov byte [ebp - 0xd], al
cmp ecx, 9
jne 0x10008ae7
mov edi, ecx
mov edx, str.csrss.exe
sub edi, 4
jb 0x10008aa1
nop dword [eax]
mov eax, dword [esi]
cmp eax, dword [edx]
jne 0x10008aa6
add esi, 4
add edx, 4
sub edi, 4
jae 0x10008a90
cmp edi, 0xfffffffc
je 0x10008ada
mov al, byte [esi]
cmp al, byte [edx]
jne 0x10008ad3
cmp edi, 0xfffffffd
je 0x10008ada
mov al, byte [esi + 1]
cmp al, byte [edx + 1]
jne 0x10008ad3
cmp edi, 0xfffffffe
je 0x10008ada
mov al, byte [esi + 2]
cmp al, byte [edx + 2]
jne 0x10008ad3
cmp edi, 0xffffffff
je 0x10008ada
mov al, byte [esi + 3]
cmp al, byte [edx + 3]
je 0x10008ada
sbb eax, eax
or eax, 1
jmp 0x10008adc
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 8
jne 0x10008b57
mov edi, ecx
mov esi, str.ekrn.exe
sub edi, 4
jb 0x10008b11
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008b16
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008b00
cmp edi, 0xfffffffc
je 0x10008b4a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10008b43
cmp edi, 0xfffffffd
je 0x10008b4a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10008b43
cmp edi, 0xfffffffe
je 0x10008b4a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10008b43
cmp edi, 0xffffffff
je 0x10008b4a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10008b4a
sbb eax, eax
or eax, 1
jmp 0x10008b4c
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 9
jne 0x10008bc7
mov edi, ecx
mov esi, str.lsass.exe
sub edi, 4
jb 0x10008b81
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008b86
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008b70
cmp edi, 0xfffffffc
je 0x10008bba
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10008bb3
cmp edi, 0xfffffffd
je 0x10008bba
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10008bb3
cmp edi, 0xfffffffe
je 0x10008bba
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10008bb3
cmp edi, 0xffffffff
je 0x10008bba
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10008bba
sbb eax, eax
or eax, 1
jmp 0x10008bbc
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xc
jne 0x10008c37
mov edi, ecx
mov esi, str.services.exe
sub edi, 4
jb 0x10008bf1
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008bf6
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008be0
cmp edi, 0xfffffffc
je 0x10008c2a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10008c23
cmp edi, 0xfffffffd
je 0x10008c2a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10008c23
cmp edi, 0xfffffffe
je 0x10008c2a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10008c23
cmp edi, 0xffffffff
je 0x10008c2a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10008c2a
sbb eax, eax
or eax, 1
jmp 0x10008c2c
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 8
jne 0x10008ca7
mov edi, ecx
mov esi, str.smss.exe
sub edi, 4
jb 0x10008c61
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008c66
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008c50
cmp edi, 0xfffffffc
je 0x10008c9a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10008c93
cmp edi, 0xfffffffd
je 0x10008c9a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10008c93
cmp edi, 0xfffffffe
je 0x10008c9a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10008c93
cmp edi, 0xffffffff
je 0x10008c9a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10008c9a
sbb eax, eax
or eax, 1
jmp 0x10008c9c
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 9
jne 0x10008d17
mov edi, ecx
mov esi, str.httpd.exe
sub edi, 4
jb 0x10008cd1
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008cd6
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008cc0
cmp edi, 0xfffffffc
je 0x10008d0a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10008d03
cmp edi, 0xfffffffd
je 0x10008d0a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10008d03
cmp edi, 0xfffffffe
je 0x10008d0a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10008d03
cmp edi, 0xffffffff
je 0x10008d0a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10008d0a
sbb eax, eax
or eax, 1
jmp 0x10008d0c
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xa
jne 0x10008d87
mov edi, ecx
mov esi, str.msedge.exe
sub edi, 4
jb 0x10008d41
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008d46
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008d30
cmp edi, 0xfffffffc
je 0x10008d7a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10008d73
cmp edi, 0xfffffffd
je 0x10008d7a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10008d73
cmp edi, 0xfffffffe
je 0x10008d7a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10008d73
cmp edi, 0xffffffff
je 0x10008d7a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10008d7a
sbb eax, eax
or eax, 1
jmp 0x10008d7c
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0x16
jne 0x10008df7
mov edi, ecx
mov esi, str.SearchProtocolHost.exe
sub edi, 4
jb 0x10008db1
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008db6
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008da0
cmp edi, 0xfffffffc
je 0x10008dea
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10008de3
cmp edi, 0xfffffffd
je 0x10008dea
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10008de3
cmp edi, 0xfffffffe
je 0x10008dea
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10008de3
cmp edi, 0xffffffff
je 0x10008dea
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10008dea
sbb eax, eax
or eax, 1
jmp 0x10008dec
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xd
jne 0x10008e67
mov edi, ecx
mov esi, str.UI0Detect.exe
sub edi, 4
jb 0x10008e21
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008e26
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008e10
cmp edi, 0xfffffffc
je 0x10008e5a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10008e53
cmp edi, 0xfffffffd
je 0x10008e5a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10008e53
cmp edi, 0xfffffffe
je 0x10008e5a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10008e53
cmp edi, 0xffffffff
je 0x10008e5a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10008e5a
sbb eax, eax
or eax, 1
jmp 0x10008e5c
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xb
jne 0x10008edb
mov edi, ecx
mov esi, str.wininit.exe
sub edi, 4
jb 0x10008e95
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008e9a
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008e84
cmp edi, 0xfffffffc
je 0x10008ece
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10008ec7
cmp edi, 0xfffffffd
je 0x10008ece
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10008ec7
cmp edi, 0xfffffffe
je 0x10008ece
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10008ec7
cmp edi, 0xffffffff
je 0x10008ece
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10008ece
sbb eax, eax
or eax, 1
jmp 0x10008ed0
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 7
jne 0x10008f4f
mov edi, ecx
mov esi, str.lsm.exe
sub edi, 4
jb 0x10008f09
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008f0e
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008ef8
cmp edi, 0xfffffffc
je 0x10008f42
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10008f3b
cmp edi, 0xfffffffd
je 0x10008f42
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10008f3b
cmp edi, 0xfffffffe
je 0x10008f42
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10008f3b
cmp edi, 0xffffffff
je 0x10008f42
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10008f42
sbb eax, eax
or eax, 1
jmp 0x10008f44
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xb
jne 0x10008fc7
mov edi, ecx
mov esi, str.spoolsv.exe
sub edi, 4
jb 0x10008f81
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008f86
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008f70
cmp edi, 0xfffffffc
je 0x10008fba
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10008fb3
cmp edi, 0xfffffffd
je 0x10008fba
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10008fb3
cmp edi, 0xfffffffe
je 0x10008fba
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10008fb3
cmp edi, 0xffffffff
je 0x10008fba
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10008fba
sbb eax, eax
or eax, 1
jmp 0x10008fbc
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0x10
jne 0x1000903b
mov edi, ecx
mov esi, str.IpOverUsbSvc.exe
sub edi, 4
jb 0x10008ff5
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10008ffa
add edx, 4
add esi, 4
sub edi, 4
jae 0x10008fe4
cmp edi, 0xfffffffc
je 0x1000902e
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10009027
cmp edi, 0xfffffffd
je 0x1000902e
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10009027
cmp edi, 0xfffffffe
je 0x1000902e
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10009027
cmp edi, 0xffffffff
je 0x1000902e
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1000902e
sbb eax, eax
or eax, 1
jmp 0x10009030
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xc
jne 0x100090af
mov edi, ecx
mov esi, str.sqlservr.exe
sub edi, 4
jb 0x10009069
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1000906e
add edx, 4
add esi, 4
sub edi, 4
jae 0x10009058
cmp edi, 0xfffffffc
je 0x100090a2
mov al, byte [edx]
cmp al, byte [esi]
jne 0x1000909b
cmp edi, 0xfffffffd
je 0x100090a2
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x1000909b
cmp edi, 0xfffffffe
je 0x100090a2
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x1000909b
cmp edi, 0xffffffff
je 0x100090a2
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x100090a2
sbb eax, eax
or eax, 1
jmp 0x100090a4
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xa
jne 0x10009127
mov edi, ecx
mov esi, str.mysqld.exe
sub edi, 4
jb 0x100090e1
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x100090e6
add edx, 4
add esi, 4
sub edi, 4
jae 0x100090d0
cmp edi, 0xfffffffc
je 0x1000911a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10009113
cmp edi, 0xfffffffd
je 0x1000911a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10009113
cmp edi, 0xfffffffe
je 0x1000911a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10009113
cmp edi, 0xffffffff
je 0x1000911a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1000911a
sbb eax, eax
or eax, 1
jmp 0x1000911c
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xd
jne 0x1000919b
mov edi, ecx
mov esi, str.sqlwriter.exe
sub edi, 4
jb 0x10009155
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1000915a
add edx, 4
add esi, 4
sub edi, 4
jae 0x10009144
cmp edi, 0xfffffffc
je 0x1000918e
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10009187
cmp edi, 0xfffffffd
je 0x1000918e
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10009187
cmp edi, 0xfffffffe
je 0x1000918e
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10009187
cmp edi, 0xffffffff
je 0x1000918e
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1000918e
sbb eax, eax
or eax, 1
jmp 0x10009190
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xb
jne 0x1000920f
mov edi, ecx
mov esi, str.jusched.exe
sub edi, 4
jb 0x100091c9
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x100091ce
add edx, 4
add esi, 4
sub edi, 4
jae 0x100091b8
cmp edi, 0xfffffffc
je 0x10009202
mov al, byte [edx]
cmp al, byte [esi]
jne 0x100091fb
cmp edi, 0xfffffffd
je 0x10009202
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x100091fb
cmp edi, 0xfffffffe
je 0x10009202
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x100091fb
cmp edi, 0xffffffff
je 0x10009202
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10009202
sbb eax, eax
or eax, 1
jmp 0x10009204
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 9
jne 0x10009287
mov edi, ecx
mov esi, str.IDMan.exe
sub edi, 4
jb 0x10009241
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10009246
add edx, 4
add esi, 4
sub edi, 4
jae 0x10009230
cmp edi, 0xfffffffc
je 0x1000927a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10009273
cmp edi, 0xfffffffd
je 0x1000927a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10009273
cmp edi, 0xfffffffe
je 0x1000927a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10009273
cmp edi, 0xffffffff
je 0x1000927a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1000927a
sbb eax, eax
or eax, 1
jmp 0x1000927c
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0x11
jne 0x100092fb
mov edi, ecx
mov esi, str.SearchIndexer.exe
sub edi, 4
jb 0x100092b5
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x100092ba
add edx, 4
add esi, 4
sub edi, 4
jae 0x100092a4
cmp edi, 0xfffffffc
je 0x100092ee
mov al, byte [edx]
cmp al, byte [esi]
jne 0x100092e7
cmp edi, 0xfffffffd
je 0x100092ee
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x100092e7
cmp edi, 0xfffffffe
je 0x100092ee
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x100092e7
cmp edi, 0xffffffff
je 0x100092ee
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x100092ee
sbb eax, eax
or eax, 1
jmp 0x100092f0
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xd
jne 0x1000936f
mov edi, ecx
mov esi, str.IEMonitor.exe
sub edi, 4
jb 0x10009329
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1000932e
add edx, 4
add esi, 4
sub edi, 4
jae 0x10009318
cmp edi, 0xfffffffc
je 0x10009362
mov al, byte [edx]
cmp al, byte [esi]
jne 0x1000935b
cmp edi, 0xfffffffd
je 0x10009362
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x1000935b
cmp edi, 0xfffffffe
je 0x10009362
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x1000935b
cmp edi, 0xffffffff
je 0x10009362
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10009362
sbb eax, eax
or eax, 1
jmp 0x10009364
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xc
jne 0x100093e7
mov edi, ecx
mov esi, str.wmpnetwk.exe
sub edi, 4
jb 0x100093a1
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x100093a6
add edx, 4
add esi, 4
sub edi, 4
jae 0x10009390
cmp edi, 0xfffffffc
je 0x100093da
mov al, byte [edx]
cmp al, byte [esi]
jne 0x100093d3
cmp edi, 0xfffffffd
je 0x100093da
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x100093d3
cmp edi, 0xfffffffe
je 0x100093da
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x100093d3
cmp edi, 0xffffffff
je 0x100093da
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x100093da
sbb eax, eax
or eax, 1
jmp 0x100093dc
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xa
jne 0x1000945b
mov edi, ecx
mov esi, str.devenv.exe
sub edi, 4
jb 0x10009415
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1000941a
add edx, 4
add esi, 4
sub edi, 4
jae 0x10009404
cmp edi, 0xfffffffc
je 0x1000944e
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10009447
cmp edi, 0xfffffffd
je 0x1000944e
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10009447
cmp edi, 0xfffffffe
je 0x1000944e
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10009447
cmp edi, 0xffffffff
je 0x1000944e
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1000944e
sbb eax, eax
or eax, 1
jmp 0x10009450
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xc
jne 0x100094cf
mov edi, ecx
mov esi, str.WUDFHost.exe
sub edi, 4
jb 0x10009489
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1000948e
add edx, 4
add esi, 4
sub edi, 4
jae 0x10009478
cmp edi, 0xfffffffc
je 0x100094c2
mov al, byte [edx]
cmp al, byte [esi]
jne 0x100094bb
cmp edi, 0xfffffffd
je 0x100094c2
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x100094bb
cmp edi, 0xfffffffe
je 0x100094c2
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x100094bb
cmp edi, 0xffffffff
je 0x100094c2
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x100094c2
sbb eax, eax
or eax, 1
jmp 0x100094c4
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xb
jne 0x10009547
mov edi, ecx
mov esi, str.MSBuild.exe
sub edi, 4
jb 0x10009501
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10009506
add edx, 4
add esi, 4
sub edi, 4
jae 0x100094f0
cmp edi, 0xfffffffc
je 0x1000953a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10009533
cmp edi, 0xfffffffd
je 0x1000953a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10009533
cmp edi, 0xfffffffe
je 0x1000953a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10009533
cmp edi, 0xffffffff
je 0x1000953a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1000953a
sbb eax, eax
or eax, 1
jmp 0x1000953c
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xb
jne 0x100095bf
mov edi, ecx
mov esi, str.conhost.exe
sub edi, 4
jb 0x10009575
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1000957e
add edx, 4
add esi, 4
sub edi, 4
jae 0x10009564
cmp edi, 0xfffffffc
je 0x100095b2
mov al, byte [edx]
cmp al, byte [esi]
jne 0x100095ab
cmp edi, 0xfffffffd
je 0x100095b2
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x100095ab
cmp edi, 0xfffffffe
je 0x100095b2
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x100095ab
cmp edi, 0xffffffff
je 0x100095b2
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x100095b2
sbb eax, eax
or eax, 1
jmp 0x100095b4
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xc
jne 0x1000963b
mov edi, ecx
mov esi, str.mspdbsrv.exe
sub edi, 4
jb 0x100095f1
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x100095fa
add edx, 4
add esi, 4
sub edi, 4
jae 0x100095e0
cmp edi, 0xfffffffc
je 0x1000962e
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10009627
cmp edi, 0xfffffffd
je 0x1000962e
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10009627
cmp edi, 0xfffffffe
je 0x1000962e
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10009627
cmp edi, 0xffffffff
je 0x1000962e
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1000962e
sbb eax, eax
or eax, 1
jmp 0x10009630
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xc
jne 0x100096b3
mov edi, ecx
mov esi, str.vcpkgsrv.exe
sub edi, 4
jb 0x10009669
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10009672
add edx, 4
add esi, 4
sub edi, 4
jae 0x10009658
cmp edi, 0xfffffffc
je 0x100096a6
mov al, byte [edx]
cmp al, byte [esi]
jne 0x1000969f
cmp edi, 0xfffffffd
je 0x100096a6
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x1000969f
cmp edi, 0xfffffffe
je 0x100096a6
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x1000969f
cmp edi, 0xffffffff
je 0x100096a6
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x100096a6
sbb eax, eax
or eax, 1
jmp 0x100096a8
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xd
jne 0x1000972b
mov edi, ecx
mov esi, str.eguiProxy.exe
sub edi, 4
jb 0x100096e1
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x100096ea
add edx, 4
add esi, 4
sub edi, 4
jae 0x100096d0
cmp edi, 0xfffffffc
je 0x1000971e
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10009717
cmp edi, 0xfffffffd
je 0x1000971e
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10009717
cmp edi, 0xfffffffe
je 0x1000971e
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10009717
cmp edi, 0xffffffff
je 0x1000971e
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1000971e
sbb eax, eax
or eax, 1
jmp 0x10009720
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 9
jne 0x100097a7
mov edi, ecx
mov esi, str.mstsc.exe
sub edi, 4
jb 0x10009759
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10009762
add edx, 4
add esi, 4
sub edi, 4
jae 0x10009748
cmp edi, 0xfffffffc
je 0x1000979a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10009793
cmp edi, 0xfffffffd
je 0x1000979a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10009793
cmp edi, 0xfffffffe
je 0x1000979a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10009793
cmp edi, 0xffffffff
je 0x1000979a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1000979a
sbb eax, eax
or eax, 1
jmp 0x1000979c
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xa
jne 0x10009827
mov edi, ecx
mov esi, str.msedge.exe
sub edi, 4
jb 0x100097d5
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x100097de
add edx, 4
add esi, 4
sub edi, 4
jae 0x100097c4
cmp edi, 0xfffffffc
je 0x1000981a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10009813
cmp edi, 0xfffffffd
je 0x1000981a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10009813
cmp edi, 0xfffffffe
je 0x1000981a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10009813
cmp edi, 0xffffffff
je 0x1000981a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1000981a
sbb eax, eax
or eax, 1
jmp 0x1000981c
xor eax, eax
test eax, eax
je 0x100098a2
mov al, byte [ebp - 0xd]
test al, al
lea edx, [ebp - 0x28]
cmovne edx, ebx
cmp ecx, 0xb
jne 0x10009954
mov esi, str.svchost.exe
sub ecx, 4
jb 0x10009853
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1000985c
add edx, 4
add esi, 4
sub ecx, 4
jae 0x10009842
cmp ecx, 0xfffffffc
je 0x10009898
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10009891
cmp ecx, 0xfffffffd
je 0x10009898
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10009891
cmp ecx, 0xfffffffe
je 0x10009898
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10009891
cmp ecx, 0xffffffff
je 0x10009898
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x10009898
sbb eax, eax
or eax, 1
jmp 0x1000989a
xor eax, eax
test eax, eax
jne 0x10009954
cmp byte [ebp - 0xd], 0
mov byte [ebp - 4], 1
je 0x100098dc
mov ecx, dword [ebp - 0x14]
mov eax, ebx
inc ecx
cmp ecx, 0x1000
jb 0x100098d2
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100099cb
push ecx
push ebx
call fcn.1000ef69
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
cmp ecx, 7
jbe 0x1000991e
mov edx, dword [ebp - 0x4c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10009914
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100099cb
push ecx
push edx
call fcn.1000ef69
add esp, 8
mov edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x34]
lea eax, [ebp - 0x280]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10008a24
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push ecx
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x10009970
mov ecx, eax
call fcn.100033b0
add dword [edi + 4], 0x18
jmp 0x10009978
push eax
mov ecx, edi
call fcn.1000b900
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x1000998c
mov edx, dword [ebp - 0x28]
push eax
call fcn.100017b0
add esp, 4
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
cmp ecx, 7
jbe 0x10009921
mov edx, dword [ebp - 0x4c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100099bc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100099cb
push ecx
push edx
call fcn.1000ef69
add esp, 8
jmp 0x10009921
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3