Function at 0x1002ed90
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x10040c61
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0x140], 0
call fcn.10031f20
xor eax, eax
mov ecx, 0x4a
lea edi, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
push 2
mov byte [esp + 0x148], 1
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 8]
mov esi, eax
call fcn.10017290
lea eax, [esp + 0xc]
mov dword [esp + 8], esi
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
setne al
mov byte [esp + 0x134], al
test al, al
mov dword [esp + 0x140], 2
je 0x1002f020
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x36
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002ee3d
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [esp + 0x30]
push eax
push ecx
call esi
test eax, eax
jne 0x1002f048
push 0x37
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002ee65
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea edx, [esp + 0x30]
push eax
push edx
call esi
test eax, eax
jne 0x1002f048
push 0x38
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002ee8d
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
lea eax, [esp + 0x34]
push eax
call esi
test eax, eax
jne 0x1002f048
push 0x39
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002eeb5
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [esp + 0x30]
push eax
push ecx
call esi
test eax, eax
jne 0x1002f048
push 0x3a
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002eedd
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea edx, [esp + 0x30]
push eax
push edx
call esi
test eax, eax
jne 0x1002f048
push 0x3b
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002ef05
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
lea eax, [esp + 0x34]
push eax
call esi
test eax, eax
jne 0x1002f048
push 0x3c
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002ef2d
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [esp + 0x30]
push eax
push ecx
call esi
test eax, eax
jne 0x1002f048
push 0x3d
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002ef55
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea edx, [esp + 0x30]
push eax
push edx
call esi
test eax, eax
jne 0x1002f048
push 0x3e
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002ef7d
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
lea eax, [esp + 0x34]
push eax
call esi
test eax, eax
jne 0x1002f048
push 0x3f
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002efa5
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [esp + 0x30]
push eax
push ecx
call esi
test eax, eax
jne 0x1002f048
push 0x40
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002efcd
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea edx, [esp + 0x30]
push eax
push edx
call esi
test eax, eax
jne 0x1002f048
push 0x41
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002eff1
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
lea eax, [esp + 0x34]
push eax
call esi
test eax, eax
jne 0x1002f048
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
setne al
test al, al
mov byte [esp + 0x134], al
jne 0x1002ee25
mov eax, dword [esp + 8]
test eax, eax
je 0x1002f02f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
add esp, 0x13c
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x1002f057
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x138]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x13c
ret