Function at 0x1007d370
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d97ef
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x101120a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea eax, [ebp - 0xe8]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x79
push 0x61
push 0x72
push 0x54
push 0x30
push 0x36
push 0x33
push eax
call fcn.1007e810
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x65
push 0x66
push 0x61
push 0x53
mov dword [ebp - 4], ebx
push 0x30
push 0x36
lea eax, [ebp - 0xd0]
push 0x33
push eax
call fcn.1007e810
add esp, 0x280
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x75
push 0x59
push 0x67
push 0x6e
push 0x61
push 0x46
mov byte [ebp - 4], 1
push 0x67
push 0x6e
push 0x6f
push 0x44
push 0x75
push 0x68
lea eax, [ebp - 0xb8]
push 0x5a
push eax
call fcn.1007e810
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 2
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x64
push 0x73
push 0x30
push 0x36
lea eax, [ebp - 0xa0]
push 0x33
push eax
call fcn.1007e810
add esp, 0x280
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 3
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x70
push 0x72
push 0x30
push 0x36
lea eax, [ebp - 0x88]
push 0x33
push eax
call fcn.1007e810
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 4
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x65
push 0x72
push 0x6f
push 0x63
push 0x73
push 0x65
push 0x78
lea eax, [ebp - 0x70]
push 0x6b
push eax
call fcn.1007e810
add esp, 0x280
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 5
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x79
push 0x61
push 0x72
push 0x74
push 0x65
push 0x78
lea eax, [ebp - 0x58]
push 0x6b
push eax
call fcn.1007e810
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 6
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x79
push 0x61
push 0x72
push 0x54
push 0x43
push 0x50
push 0x51
lea eax, [ebp - 0x40]
push 0x51
push eax
call fcn.1007e810
add esp, 0x280
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 7
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x65
push 0x78
push 0x65
push 0x2e
push 0x50
push 0x54
push 0x52
push 0x43
push 0x50
push 0x51
lea eax, [ebp - 0x28]
push 0x51
push eax
call fcn.1007e810
push 0x22c
lea eax, [ebp - 0x314]
mov dword [ebp - 4], 0xffffffff
push ebx
push eax
call fcn.1008da10
add esp, 0x14c
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x318], edi
cmp edi, 0xffffffff
je 0x1007d850
mov dword [ebp - 0x314], 0x22c
xor esi, esi
nop dword [eax]
lea eax, [ebp - 0x314]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1007d835
lea eax, [esi + esi*2]
lea edi, [ebp - 0xe8]
lea edi, [edi + eax*8]
nop dword [eax]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x1007d7da
mov eax, dword [edi]
lea ecx, [ebp - 0x2f0]
push ecx
push eax
call fcn.10092559
add esp, 8
test eax, eax
je 0x1007d806
lea eax, [ebp - 0x314]
push eax
push dword [ebp - 0x318]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1007d7d0
jmp 0x1007d82f
cmp esi, 4
jg 0x1007d813
inc ebx
mov esi, 4
jmp 0x1007d82f
cmp esi, 6
jg 0x1007d822
add ebx, 2
mov esi, 6
jmp 0x1007d82f
cmp esi, 8
jg 0x1007d82f
add ebx, 4
mov esi, 8
mov edi, dword [ebp - 0x318]
inc esi
cmp esi, 9
jb 0x1007d7b0
test ebx, ebx
mov eax, 8
push edi
cmove ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push fcn.10002ab0
push 9
push 0x18
lea eax, [ebp - 0xe8]
push eax
call fcn.1008beca
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret