Function at 0x1000aa41
Capabilities:
Enumerate processes

Disassembly:
push 0x270
mov eax, 0x1001594b
call fcn.10015554
xor edi, edi
xor esi, esi
mov dword [ebp - 0x240], edi
inc esi
call fcn.1000a321
push edi
push 0xa
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x274], ebx
cmp ebx, 0xffffffff
je 0x1000adbd
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push ebx
call dword [sym.imp.kernel32.dll_Process32FirstW]
test eax, eax
je 0x1000adbd
test esi, esi
je 0x1000ad8c
mov ecx, dword [ebp - 0x234]
call fcn.10012e2c
mov esi, eax
test esi, esi
je 0x1000aba1
push esi
call fcn.10012e2c
lea eax, [esi + 4]
mov ecx, 0x1001aba0
push eax
call fcn.10012e2c
push 0xff
lea eax, [ebp - 0x218]
push eax
lea edi, [esi + 0xc]
push 0x100
push edi
call dword [sym.imp.ucrtbase_clr0400.dll_wcsncpy_s]
xor eax, eax
push 0x2e
push edi
mov word [esi + 0x20a], ax
call dword [sym.imp.VCRUNTIME140_CLR0400.dll_wcsrchr]
add esp, 0x18
test eax, eax
je 0x1000ab04
xor ecx, ecx
mov word [eax], cx
cmp dword [0x10019020], 0
je 0x1000aba1
push 2
pop eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], 0x10
mov dword [ebp - 0x250], 0x1000171c
mov dword [ebp - 4], 1
push dword [esi + 0x220]
lea eax, [ebp - 0x25c]
push edi
push 0x10008b5c
push eax
call fcn.10012e2c
add esp, 0x10
lea ecx, [ebp - 0x25c]
call fcn.1000a12c
mov ecx, dword [ebp - 0x254]
mov esi, dword [ebp - 0x25c]
not ecx
and ecx, 1
shr esi, cl
lea ecx, [ebp - 0x25c]
call fcn.1000c91a
lea eax, [esi + esi]
push eax
push dword [ebp - 0x250]
push edi
call sub.VCRUNTIME140_CLR0400.dll_memcpy
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x25c]
call fcn.10012e2c
mov esi, dword [ebp - 0x234]
mov byte [ebp - 0x278], 0
push dword [ebp - 0x278]
push 0x28
call fcn.10012e2c
mov edi, eax
test edi, edi
je 0x1000abe2
xor eax, eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
jmp 0x1000abe4
xor edi, edi
xor eax, eax
mov dword [ebp - 0x248], edi
test edi, edi
setne al
mov dword [ebp - 0x244], eax
test edi, edi
je 0x1000ad59
mov edx, edi
mov ecx, esi
call fcn.1000b0e5
test al, al
je 0x1000ad53
and dword [ebp - 0x24c], 0
xor ebx, ebx
cmp ebx, 0x20
jae 0x1000ad4d
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x24c]
push ebx
push eax
lea edx, [ebp - 0x248]
call fcn.10012e2c
mov esi, eax
test esi, esi
je 0x1000ad3f
push esi
call fcn.10012e2c
and dword [ebp - 0x244], 0
lea ecx, [ebp - 0x218]
push 0xff
push ecx
lea eax, [esi + 0xc]
push 0x100
push eax
mov dword [ebp - 0x270], eax
call dword [sym.imp.ucrtbase_clr0400.dll_wcsncpy_s]
xor eax, eax
mov word [esi + 0x20a], ax
lea eax, [esi + 0xc]
push 0x2e
push eax
call dword [sym.imp.VCRUNTIME140_CLR0400.dll_wcsrchr]
add esp, 0x18
test eax, eax
je 0x1000ac94
xor ecx, ecx
mov word [eax], cx
cmp dword [0x10019020], 0
je 0x1000ad3f
push 2
pop eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], 0x10
mov dword [ebp - 0x260], 0x1000171c
mov dword [ebp - 4], 3
push dword [esi + 0x224]
lea eax, [esi + 0xc]
push dword [esi + 0x220]
push eax
lea eax, [ebp - 0x26c]
push 0x10008b44
push eax
call fcn.10012e2c
add esp, 0x14
lea ecx, [ebp - 0x26c]
call fcn.1000a12c
mov ecx, dword [ebp - 0x264]
mov esi, dword [ebp - 0x26c]
not ecx
and ecx, 1
shr esi, cl
lea ecx, [ebp - 0x26c]
call fcn.1000c91a
lea eax, [esi + esi]
push eax
push dword [ebp - 0x260]
push dword [ebp - 0x270]
call sub.VCRUNTIME140_CLR0400.dll_memcpy
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.10012e2c
inc ebx
cmp dword [ebp - 0x24c], 0
je 0x1000ac19
mov ebx, dword [ebp - 0x274]
mov eax, dword [ebp - 0x244]
test eax, eax
jne 0x1000ad70
lea eax, [ebp - 0x248]
mov ecx, 0x1001aba0
push eax
call fcn.10012e2c
jmp 0x1000ad86
lea edx, [edi + 0x10]
mov ecx, edi
call fcn.1001398e
test edi, edi
je 0x1000ad86
push ecx
mov ecx, edi
call fcn.10012e2c
mov edi, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.kernel32.dll_Process32NextW]
mov esi, eax
test esi, esi
jne 0x1000adae
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x240], edi
test edi, edi
je 0x1000aa9a
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.100154fe
ret