Function at 0x100c5920
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011c6c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x330
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100c5992
push 0x228
lea eax, [ebp - 0x334]
push 0
push eax
call fcn.10074090
add esp, 0xc
mov dword [ebp - 0x338], 0x22c
lea eax, [ebp - 0x338]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x100c59a5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.1001b450
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
nop dword [eax]
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x314]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c59f0
sub ecx, edx
lea eax, [ebp - 0x314]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.1001a860
lea edx, [ebp - 0x34]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.100e5030
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x100c5a5c
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c5a52
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64cc
push edx
push ecx
call fcn.1006fca3
add esp, 8
mov edi, dword [ebp - 0x40]
xor eax, eax
xor esi, esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
test edi, edi
je 0x100c5aaf
nop dword [eax]
cmp dword [ebp - 0x3c], 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
movzx eax, word [eax + esi*2]
push eax
call fcn.1007dcd3
add esp, 4
movzx ecx, ax
cmp dword [ebp - 0x3c], 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
mov word [eax + esi*2], cx
inc esi
cmp esi, edi
jb 0x100c5a80
push dword [ebp - 0x38]
lea eax, [ebp - 0x50]
push eax
push ecx
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001c610
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x100c5b04
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c5afa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64cc
push edx
push ecx
call fcn.1006fca3
add esp, 8
lea eax, [ebp - 0x338]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100c59d0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x18
xor eax, eax
mov dword [ebp - 0x40], 0
push str.g2dJqYtJmU_BKiHLMosd6g
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.1001a860
lea edx, [ebp - 0x50]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x68]
call fcn.100c6c20
mov edx, eax
mov byte [ebp - 4], 5
cmp dword [edx + 0x14], 8
jb 0x100c5b61
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c5b80
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.1001a860
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001a360
mov edx, dword [ebp - 0x20]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
setne bl
cmp edx, 8
jb 0x100c5beb
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c5be1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64cc
push edx
push ecx
call fcn.1006fca3
add esp, 8
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x100c5c29
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c5c1f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64d1
push edx
push ecx
call fcn.1006fca3
add esp, 8
xor eax, eax
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp edx, 8
jb 0x100c5c7a
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c5c70
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64d6
push edx
push ecx
call fcn.1006fca3
add esp, 8
push 0x18
xor eax, eax
movzx edi, bl
push str.gCRuyN7kke1mlI7007HfcA
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x58], 0
add edi, edi
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.1001a860
mov byte [ebp - 4], 6
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x10], 1
call fcn.100c6c20
mov edx, eax
mov dword [ebp - 4], 7
cmp dword [edx + 0x14], 8
mov dword [ebp - 0x10], 3
jb 0x100c5cd3
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x70], 0
xor eax, eax
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c5cf0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x80]
call fcn.1001a860
lea eax, [ebp - 0x80]
mov dword [ebp - 4], 8
push eax
lea eax, [ebp - 0x38]
mov ebx, 7
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c5e2d
push 0x18
xor eax, eax
mov dword [ebp - 0x24], 0
push str.sjFFrtWnK15mlI7007HfcA
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x34], ax
call fcn.1001a860
mov dword [ebp - 4], 9
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x10], 0xf
call fcn.100c6c20
mov dword [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x10], 0x1f
jb 0x100c5d84
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xd4]
call fcn.1001a4c0
lea eax, [ebp - 0xd4]
mov dword [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x84]
mov ebx, 0x3f
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c5e2d
push str.NIfVcoTVJMEp1gPELFqSw
lea ecx, [ebp - 0x50]
call fcn.1001a4c0
mov dword [ebp - 4], 0xc
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x10], 0x7f
call fcn.100c6c20
mov dword [ebp - 4], 0xd
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x10], 0xff
jb 0x100c5dfb
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x104]
call fcn.1001a4c0
lea eax, [ebp - 0x104]
mov ebx, 0x1ff
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001a360
mov byte [ebp - 0x11], 0
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
je 0x100c5e31
mov byte [ebp - 0x11], 1
test ebx, 0x100
je 0x100c5e7f
mov edx, dword [ebp - 0xf0]
and ebx, 0xfffffeff
cmp edx, 8
jb 0x100c5e7f
mov ecx, dword [ebp - 0x104]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c5e75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64db
push edx
push ecx
call fcn.1006fca3
add esp, 8
mov dword [ebp - 4], 0xc
test bl, bl
jns 0x100c5eed
mov edx, dword [ebp - 0xd8]
and ebx, 0xffffff7f
cmp edx, 8
jb 0x100c5ed0
mov ecx, dword [ebp - 0xec]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c5ec6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64e0
push edx
push ecx
call fcn.1006fca3
add esp, 8
xor eax, eax
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 7
mov word [ebp - 0xec], ax
mov dword [ebp - 4], 0xb
test bl, 0x40
je 0x100c5f4a
mov edx, dword [ebp - 0x3c]
and ebx, 0xffffffbf
cmp edx, 8
jb 0x100c5f36
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c5f2c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64e5
push edx
push ecx
call fcn.1006fca3
add esp, 8
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
mov dword [ebp - 4], 0xa
test bl, 0x20
je 0x100c5f99
mov edx, dword [ebp - 0xc0]
and ebx, 0xffffffdf
cmp edx, 8
jb 0x100c5f99
mov ecx, dword [ebp - 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c5f8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64ea
push edx
push ecx
call fcn.1006fca3
add esp, 8
mov dword [ebp - 4], 9
test bl, 0x10
je 0x100c6005
mov edx, dword [ebp - 0x90]
and ebx, 0xffffffef
cmp edx, 8
jb 0x100c5fe8
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c5fde
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64ef
push edx
push ecx
call fcn.1006fca3
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov dword [ebp - 4], 8
test bl, 8
je 0x100c6062
mov edx, dword [ebp - 0x20]
and ebx, 0xfffffff7
cmp edx, 8
jb 0x100c604e
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6044
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64f4
push edx
push ecx
call fcn.1006fca3
add esp, 8
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
mov dword [ebp - 4], 7
mov edx, dword [ebp - 0x6c]
cmp edx, 8
jb 0x100c60a3
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6099
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64f9
push edx
push ecx
call fcn.1006fca3
add esp, 8
mov dword [ebp - 4], 6
mov edx, dword [ebp - 0xa8]
cmp edx, 8
jb 0x100c60ea
mov ecx, dword [ebp - 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c60e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c64fe
push edx
push ecx
call fcn.1006fca3
add esp, 8
xor eax, eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 4], eax
and ebx, 0xfffffff8
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xa8], 7
mov word [ebp - 0xbc], ax
cmp edx, 8
jb 0x100c6147
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c613d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6503
push edx
push ecx
call fcn.1006fca3
add esp, 8
mov eax, edi
mov dword [ebp - 0x70], 0
or eax, 1
mov dword [ebp - 0x6c], 7
cmp byte [ebp - 0x11], 0
lea ecx, [ebp - 0x80]
push 0x18
cmove eax, edi
mov esi, ebx
mov dword [ebp - 0x38], eax
xor eax, eax
push str.igE9GT3zhQIp1gPELFqSw
mov word [ebp - 0x80], ax
call fcn.1001a860
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x80]
or ebx, 0x200
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x10], ebx
call fcn.100c6c20
mov edx, eax
mov ecx, esi
mov dword [ebp - 4], 0xf
or ecx, 0x600
cmp dword [edx + 0x14], 8
mov dword [ebp - 0x10], ecx
jb 0x100c61b2
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x58], 0
xor eax, eax
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c61d0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x68]
call fcn.1001a860
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x88]
or esi, 0xe00
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esi
mov edi, esi
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c62a9
push 0x18
xor eax, eax
mov dword [ebp - 0x24], 0
push str.l0PF_ifqACrATEfPeOVdg
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.1001a860
mov dword [ebp - 4], 0x11
lea edx, [ebp - 0x34]
or esi, 0x1000
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x10], esi
call fcn.100c6c20
mov ecx, edi
mov dword [ebp - 4], 0x12
or ecx, 0x3000
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x10], ecx
jb 0x100c6274
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xd4]
call fcn.1001a4c0
lea eax, [ebp - 0xd4]
mov esi, edi
push eax
lea eax, [ebp - 0x84]
or esi, 0x7000
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c62a9
xor bl, bl
jmp 0x100c62ab
mov bl, 1
test esi, 0x4000
je 0x100c62f9
mov edx, dword [ebp - 0xc0]
and esi, 0xffffbfff
cmp edx, 8
jb 0x100c62f9
mov ecx, dword [ebp - 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c62ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6508
push edx
push ecx
call fcn.1006fca3
add esp, 8
test esi, 0x2000
je 0x100c6364
mov edx, dword [ebp - 0xa8]
and esi, 0xffffdfff
cmp edx, 8
jb 0x100c6347
mov ecx, dword [ebp - 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c633d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c650d
push edx
push ecx
call fcn.1006fca3
add esp, 8
xor eax, eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 7
mov word [ebp - 0xbc], ax
test esi, 0x1000
je 0x100c63ba
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x100c63a6
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c639c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6512
push edx
push ecx
call fcn.1006fca3
add esp, 8
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x100c63f4
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c63ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6517
push edx
push ecx
call fcn.1006fca3
add esp, 8
mov edx, dword [ebp - 0x90]
cmp edx, 8
jb 0x100c6434
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c642a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c651c
push edx
push ecx
call fcn.1006fca3
add esp, 8
mov edx, dword [ebp - 0x6c]
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
cmp edx, 8
jb 0x100c648b
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6481
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6521
push edx
push ecx
call fcn.1006fca3
add esp, 8
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
mov esi, dword [ebp - 0x38]
push eax
or esi, 8
test bl, bl
push dword [eax]
cmove esi, dword [ebp - 0x38]
lea eax, [ebp - 0x88]
push eax
call fcn.1001ad40
push 0x28
push dword [ebp - 0x1c]
call fcn.1006fca3
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
call fcn.1007d9e8
int3