Function at 0x632190e0
Capabilities:
Access peb ldr_data
Enumerate processes

Disassembly:
push ebp
mov eax, 0xfb7c
push edi
push esi
push ebx
call fcn.6337fa50
sub esp, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov edi, dword [eax + 0xc]
lea edx, [eax + 0xc]
lea eax, [esp + 0x170]
mov dword [esp + 0x30], 0xfa00
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x170], 0
mov dword [esp + 0x174], 0x35448
mov byte [esp + 0x178], 0
mov dword [esp + 0x34], 9
cmp edx, edi
je 0x632193db
mov eax, edi
xor esi, esi
mov eax, dword [eax]
add esi, 1
cmp edx, eax
jne 0x63219184
movzx esi, si
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov ebp, eax
cmp eax, 0xffffffff
je 0x632191f7
lea ebx, [esp + 0x48]
mov dword [esp], eax
xor edi, edi
mov dword [esp + 4], ebx
mov dword [esp + 0x48], 0x128
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
je 0x632193ca
mov dword [esp + 4], ebx
add edi, 1
mov dword [esp], ebp
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
jne 0x632191d3
mov dword [esp], ebp
add esi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
sub eax, ecx
cmp eax, 1
jle 0x632193bd
mov eax, dword [esp + 0x28]
mov word [eax + ecx], si
add dword [esp + 0x34], 2
lea eax, [esp + 0x20]
lea ebx, [esp + 0x48]
mov dword [esp], eax
call fcn.63218d70
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x1c], esi
je 0x63219393
mov ebp, esi
mov esi, ebx
lea esi, [esi]
mov ebx, dword [ebp + 0x28]
xor edx, edx
jmp 0x6321925e
mov byte [esi + edx], cl
add edx, 1
cmp edx, 0xff
je 0x63219267
movzx ecx, word [ebx + edx*2]
test cx, cx
jne 0x63219250
mov edi, dword [esp + 0x30]
mov byte [esp + edx + 0x48], 0
mov ecx, edi
mov dword [esp + 0x18], edi
sub ecx, eax
cmp ecx, 1
jle 0x632193b0
mov ecx, esi
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
and edx, 0x80808080
je 0x63219283
mov ebx, edx
shr ebx, 0x10
test edx, 0x8080
cmove edx, ebx
lea ebx, [ecx + 2]
cmove ecx, ebx
mov ebx, edx
add bl, dl
mov edx, dword [esp + 0x28]
sbb ecx, 3
sub ecx, esi
add ecx, 1
mov word [edx + eax], cx
mov ecx, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov edi, dword [ebp + 0x40]
lea eax, [ecx + 2]
mov dword [esp + 0x18], ebx
sub ebx, eax
mov dword [esp + 0x34], eax
cmp ebx, 3
jle 0x632193b0
mov eax, dword [esp + 0x28]
mov dword [eax + ecx + 2], edi
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
add eax, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x18], edi
mov edx, dword [esp + 0x18]
mov ecx, esi
mov edi, dword [ecx]
add ecx, 4
lea ebx, [edi - 0x1010101]
not edi
and ebx, edi
and ebx, 0x80808080
je 0x63219304
mov edi, ebx
mov dword [esp + 0x18], edx
shr edi, 0x10
test ebx, 0x8080
cmove ebx, edi
lea edi, [ecx + 2]
cmove ecx, edi
mov edx, ebx
add dl, bl
mov edx, dword [esp + 0x18]
sbb ecx, 3
xor ebx, ebx
sub ecx, esi
add ecx, 1
jmp 0x63219371
movzx edx, byte [esi + ebx]
mov edi, dword [esp + 0x28]
add ebx, 1
mov byte [edi + eax], dl
mov eax, dword [esp + 0x34]
add eax, 1
mov dword [esp + 0x34], eax
cmp ecx, ebx
jle 0x63219386
mov edx, dword [esp + 0x30]
sub edx, eax
test edx, edx
jg 0x63219350
add ebx, 1
mov dword [esp + 0x20], 1
cmp ecx, ebx
jg 0x6321936d
mov ebp, dword [ebp]
cmp dword [esp + 0x1c], ebp
jne 0x63219240
lea eax, [esp + 0x20]
mov dword [esp], eax
call fcn.63192fec
add esp, 0xfb7c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x20], 1
jmp 0x632192fe
mov dword [esp + 0x20], 1
jmp 0x63219217
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x632191f7
xor esi, esi
jmp 0x63219190