Function at 0x1000ccf0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4483
mov eax, dword fs:[0]
push eax
sub esp, 0x6e4
mov eax, dword [0x100ed294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
je 0x1000cd27
cmp dword [ebp + 0x10], 0
jne 0x1000cd2e
xor eax, eax
jmp 0x1000d17e
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
je 0x1000cebf
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.1006cfe0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
mov eax, dword [ebp - 0x4dc]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
mov dword [ebp - 0x500], eax
mov ecx, dword [ebp - 0x4dc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x500], 0
je 0x1000cdc8
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1000eac0
mov eax, 1
jmp 0x1000d17e
call fcn.10056330
mov dword [ebp - 0x4e0], eax
push 1
mov edx, dword [ebp - 0x4e0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4e0]
mov edx, dword [eax + 8]
call edx
mov byte [ebp - 0x504], al
cmp byte [ebp - 0x504], 1
je 0x1000cdfc
jmp 0x1000ceba
push 0x100ac998
lea ecx, [ebp - 0x248]
call fcn.10008d80
mov dword [ebp - 4], 0
push 0x100ac9f8
lea ecx, [ebp - 0x230]
call fcn.10008d80
mov byte [ebp - 4], 1
call fcn.10056330
mov dword [ebp - 0x4e4], eax
push str.GetModuleFileNameEx_Failed
push 0xf7
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x5c0]
call fcn.10009410
mov dword [ebp - 0x508], eax
mov edx, dword [ebp - 0x508]
mov dword [ebp - 0x50c], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x50c]
call fcn.10006880
push eax
mov eax, dword [ebp - 0x4e4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x4e4]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c0]
call fcn.1000a370
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.1000a090
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.1000a090
jmp 0x1000d0bd
call fcn.10056330
mov dword [ebp - 0x4e8], eax
push 1
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4e8]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x510], al
cmp byte [ebp - 0x510], 1
je 0x1000cef3
jmp 0x1000cfcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x514], eax
push 0x100aca18
lea ecx, [ebp - 0x278]
call fcn.10008d80
mov dword [ebp - 4], 3
push 0x100aca78
lea ecx, [ebp - 0x260]
call fcn.10008d80
mov byte [ebp - 4], 4
call fcn.10056330
mov dword [ebp - 0x4ec], eax
lea ecx, [ebp - 0x514]
push ecx
push str.LastError:
push 0xfa
lea edx, [ebp - 0x278]
push edx
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x658]
call fcn.10009410
mov dword [ebp - 0x518], eax
mov ecx, dword [ebp - 0x518]
mov dword [ebp - 0x51c], ecx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x51c]
call fcn.10006880
mov ecx, eax
call fcn.100068a0
push eax
mov edx, dword [ebp - 0x4ec]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [eax + 0x1c]
call edx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x658]
call fcn.1000a370
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x260]
call fcn.1000a090
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.1000a090
call fcn.10056330
mov dword [ebp - 0x4f0], eax
push 1
mov eax, dword [ebp - 0x4f0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x4f0]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x520], al
cmp byte [ebp - 0x520], 1
je 0x1000cfff
jmp 0x1000d0bd
push str.d:jenkins.jenkinsworkspacehalo_gamemodegamemodeldsmodeidentifyldsmodeidentifycommon.cpp
lea ecx, [ebp - 0x2a8]
call fcn.10008d80
mov dword [ebp - 4], 6
push 0x100acae8
lea ecx, [ebp - 0x290]
call fcn.10008d80
mov byte [ebp - 4], 7
call fcn.10056330
mov dword [ebp - 0x4f4], eax
push str.hproc_is_NULL
push 0xfb
lea ecx, [ebp - 0x2a8]
push ecx
lea edx, [ebp - 0x290]
push edx
lea ecx, [ebp - 0x6f0]
call fcn.10009410
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x528], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x528]
call fcn.10006880
push eax
mov ecx, dword [ebp - 0x4f4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4f4]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6f0]
call fcn.1000a370
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x290]
call fcn.1000a090
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a8]
call fcn.1000a090
mov dword [ebp - 0x4fc], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0xffffffff
je 0x1000d178
push 0x22c
push 0
lea ecx, [ebp - 0x4d4]
push ecx
call fcn.1006cfe0
add esp, 0xc
mov dword [ebp - 0x4d4], 0x22c
lea edx, [ebp - 0x4d4]
push edx
mov eax, dword [ebp - 0x4d8]
push eax
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 0
je 0x1000d16b
mov ecx, dword [ebp - 0x4cc]
cmp ecx, dword [ebp + 8]
jne 0x1000d150
lea edx, [ebp - 0x4b0]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1000eac0
mov dword [ebp - 0x4fc], 1
jmp 0x1000d16b
lea edx, [ebp - 0x4d4]
push edx
mov eax, dword [ebp - 0x4d8]
push eax
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x4f8], eax
jmp 0x1000d11c
mov ecx, dword [ebp - 0x4d8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4fc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100633f2
mov esp, ebp
pop ebp
ret