Function at 0x10002a89
Capabilities:
Enumerate processes
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x27c
mov eax, dword [0x1007b430]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 2
mov dword [esp + 0x14], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x10002ac6
xor eax, eax
jmp 0x10002fc6
lea eax, [esp + 0x148]
push eax
push esi
mov dword [esp + 0x150], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x10002aec
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10002abf
mov eax, 0x92a2517a
mov dword [esp + 0x4c], 0xdd02d157
mov dword [esp + 0x50], 0x3a39ba4
mov dword [esp + 0x54], 0xe981e279
mov dword [esp + 0x58], 0x9e0539f6
mov dword [esp + 0x5c], 0x271096b9
mov dword [esp + 0x60], 0xc10e2ddb
mov dword [esp + 0x64], 0x64760001
mov dword [esp + 0x68], 0xc0fe273f
mov dword [esp + 0x20], 0x895abd73
mov dword [esp + 0x24], 0x4c54dd8c
mov dword [esp + 0x28], 0xc0bfbba0
mov dword [esp + 0x2c], 0xa83a3d7c
mov dword [esp + 0x30], 0xe6b9485d
mov dword [esp + 0x34], 0xe3713124
mov dword [esp + 0x38], 0x81579b86
mov dword [esp + 0xc8], 0x19e8fad2
mov dword [esp + 0xcc], 0x2d3461d0
mov dword [esp + 0xd0], 0x8bf8da16
mov dword [esp + 0xd4], 0x83ed98a3
mov dword [esp + 0xd8], 0xeb012b00
mov dword [esp + 0xdc], 0xe0937145
mov dword [esp + 0xe0], 0x33fbccb2
mov dword [esp + 0xe4], 0xaadac54f
mov dword [esp + 0xe8], 0xce1599c2
mov dword [esp + 0xec], 0xc7edc178
mov dword [esp + 0xf0], 0x5ebe7aef
mov dword [esp + 0xf4], 0xcd92ce14
mov dword [esp + 0xf8], 0xf4091774
mov dword [esp + 0xfc], 0xe4195568
mov dword [esp + 0x100], 0x4840105b
mov dword [esp + 0x104], 0xaa75d0b8
mov dword [esp + 0x90], 0x90ffa223
mov dword [esp + 0x94], 0xe6d13a0b
mov dword [esp + 0x98], 0x136534da
mov dword [esp + 0x9c], 0x8594c64a
mov dword [esp + 0xa0], 0x2284c0ea
mov dword [esp + 0xa4], 0x7450a4e2
mov dword [esp + 0x7c], 0xb02ef94
mov dword [esp + 0x80], 0x6b68c4c6
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], 0x18aaa971
mov dword [esp + 0x8c], 0x97cc3cdb
mov dword [esp + 0xa8], 0x8e9e8add
mov dword [esp + 0xac], 0x6a120622
mov dword [esp + 0xb0], 0x923d5594
mov dword [esp + 0xb4], 0x8fea93a
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x274bfff4
mov dword [esp + 0xc0], 0xa29ab500
mov dword [esp + 0xc4], 0xa18a1a81
mov dword [esp + 0x3c], 0xc68b2fd8
mov dword [esp + 0x40], 0xa7c90283
mov dword [esp + 0x44], 0x53613efe
mov dword [esp + 0x48], 0x729d8b64
mov dword [esp + 0x6c], 0x2282ad08
mov dword [esp + 0x70], 0x25223f05
mov dword [esp + 0x74], 0x1a2124c0
mov dword [esp + 0x78], 0xf868b2f1
mov dword [esp + 0x14], 0x6906ab2e
mov dword [esp + 0x18], 0x4457ad16
mov dword [esp + 0x1c], 0x294d9611
mov dword [esp + 0x108], 0xce659691
mov dword [esp + 0x10c], 0xd50dea99
mov dword [esp + 0x110], 0xb4ca0887
mov dword [esp + 0x114], 0x406ef54c
mov dword [esp + 0x118], 0x60d51755
mov dword [esp + 0x11c], 0x5f1c2fc2
mov dword [esp + 0x120], 0x175dbf9c
mov dword [esp + 0x124], 0x1a35902a
mov dword [esp + 0x128], 0xad508441
mov dword [esp + 0x12c], 0xa531cc94
mov dword [esp + 0x130], 0x4b8cfba
mov dword [esp + 0x134], 0xf1cc23e4
mov dword [esp + 0x138], 0x6ccef6bb
mov dword [esp + 0x13c], 0x25afd43
mov dword [esp + 0x140], 0xc0496880
mov dword [esp + 0x144], 0x2e30dbe9
xor esi, esi
lea eax, [esp + esi + 0x16c]
mov cl, byte [eax]
mov dl, cl
sub dl, 0x41
cmp dl, 0x19
ja 0x10002dff
add cl, 0x20
inc esi
cmp esi, 0x104
mov byte [eax], cl
jl 0x10002de9
lea edx, [esp + 0x16c]
call fcn.100022c5
mov esi, eax
lea eax, [esp + 0x16c]
push ebx
push eax
xor edi, edi
call fcn.1004e020
pop ecx
pop ecx
lea ecx, [esp + 0x16c]
sub eax, ecx
cmp eax, 0x10
jle 0x10002e6f
xor eax, eax
mov byte [esp + 0x270], bl
lea edi, [esp + 0x271]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, ecx
push 0x10
push eax
lea eax, [esp + 0x278]
push eax
call fcn.1004def0
add esp, 0xc
lea edx, [esp + 0x270]
call fcn.100022c5
mov edi, eax
xor eax, eax
cmp dword [esp + eax*4 + 0x4c], esi
jne 0x10002e7c
or dword [esp + 0xc], 1
inc eax
cmp eax, 8
jl 0x10002e71
xor ecx, ecx
mov eax, dword [esp + ecx*4 + 0x20]
cmp eax, esi
je 0x10002e90
cmp eax, edi
jne 0x10002e95
or dword [esp + 0xc], 2
inc ecx
cmp ecx, 7
jl 0x10002e84
xor eax, eax
cmp dword [esp + eax*4 + 0xc8], esi
jne 0x10002eab
or dword [esp + 0xc], 4
inc eax
cmp eax, 0x10
jl 0x10002e9d
cmp esi, 0x456b109f
jne 0x10002ebe
or dword [esp + 0xc], 0x40
xor eax, eax
cmp dword [esp + eax*4 + 0x90], esi
jne 0x10002ece
or dword [esp + 0xc], 0x20
inc eax
cmp eax, 6
jl 0x10002ec0
xor eax, eax
cmp dword [esp + eax*4 + 0x7c], esi
jne 0x10002ee4
or dword [esp + 0xc], 0x400
inc eax
cmp eax, 5
jl 0x10002ed6
xor eax, eax
cmp dword [esp + eax*4 + 0xa8], esi
jne 0x10002efd
or dword [esp + 0xc], 0x400
inc eax
cmp eax, 8
jl 0x10002eec
xor eax, eax
cmp dword [esp + eax*4 + 0x3c], esi
jne 0x10002f13
or dword [esp + 0xc], 0x200
inc eax
cmp eax, 4
jl 0x10002f05
xor eax, eax
cmp dword [esp + eax*4 + 0x6c], esi
jne 0x10002f29
or dword [esp + 0xc], 0x80
inc eax
cmp eax, 4
jl 0x10002f1b
xor eax, eax
cmp dword [esp + eax*4 + 0x14], esi
jne 0x10002f3f
or dword [esp + 0xc], 0x100
inc eax
cmp eax, 3
jl 0x10002f31
xor eax, eax
cmp dword [esp + eax*4 + 0x108], esi
jne 0x10002f58
or dword [esp + 0xc], 0x800
inc eax
cmp eax, 0x10
jl 0x10002f47
lea eax, [esp + 0x148]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10002de7
push 0x20
pop ecx
lea eax, [esp + 0x4c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10002f7e
push 0x1c
pop ecx
lea eax, [esp + 0x20]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10002f8b
push 0x40
pop ecx
lea eax, [esp + 0xc8]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10002f9b
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100024b5
or dword [esp + 0xc], eax
call fcn.100022f6
or dword [esp + 0xc], eax
call fcn.10002815
or eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004b8fc
mov esp, ebp
pop ebp
ret