Function at 0x100c6030
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011d212
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x330
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100c60a2
push 0x228
lea eax, [ebp - 0x334]
push 0
push eax
call fcn.100747a0
add esp, 0xc
mov dword [ebp - 0x338], 0x22c
lea eax, [ebp - 0x338]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x100c60b5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.1001b450
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
nop dword [eax]
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x314]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c6100
sub ecx, edx
lea eax, [ebp - 0x314]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.1001a860
lea edx, [ebp - 0x34]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.100e5870
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x100c616c
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6162
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6bdc
push edx
push ecx
call fcn.100703b3
add esp, 8
mov edi, dword [ebp - 0x40]
xor eax, eax
xor esi, esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
test edi, edi
je 0x100c61bf
nop dword [eax]
cmp dword [ebp - 0x3c], 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
movzx eax, word [eax + esi*2]
push eax
call fcn.1007e3e5
add esp, 4
movzx ecx, ax
cmp dword [ebp - 0x3c], 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
mov word [eax + esi*2], cx
inc esi
cmp esi, edi
jb 0x100c6190
push dword [ebp - 0x38]
lea eax, [ebp - 0x50]
push eax
push ecx
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001c610
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x100c6214
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c620a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6bdc
push edx
push ecx
call fcn.100703b3
add esp, 8
lea eax, [ebp - 0x338]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100c60e0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x18
xor eax, eax
mov dword [ebp - 0x40], 0
push str.g2dJqYtJmU_BKiHLMosd6g
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.1001a860
lea edx, [ebp - 0x50]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x68]
call fcn.100c7330
mov edx, eax
mov byte [ebp - 4], 5
cmp dword [edx + 0x14], 8
jb 0x100c6271
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c6290
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.1001a860
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001a360
mov edx, dword [ebp - 0x20]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
setne bl
cmp edx, 8
jb 0x100c62fb
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c62f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6bdc
push edx
push ecx
call fcn.100703b3
add esp, 8
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x100c6339
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c632f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6be1
push edx
push ecx
call fcn.100703b3
add esp, 8
xor eax, eax
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp edx, 8
jb 0x100c638a
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6380
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6be6
push edx
push ecx
call fcn.100703b3
add esp, 8
push 0x18
xor eax, eax
movzx edi, bl
push str.gCRuyN7kke1mlI7007HfcA
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x58], 0
add edi, edi
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.1001a860
mov byte [ebp - 4], 6
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x10], 1
call fcn.100c7330
mov edx, eax
mov dword [ebp - 4], 7
cmp dword [edx + 0x14], 8
mov dword [ebp - 0x10], 3
jb 0x100c63e3
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x70], 0
xor eax, eax
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c6400
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x80]
call fcn.1001a860
lea eax, [ebp - 0x80]
mov dword [ebp - 4], 8
push eax
lea eax, [ebp - 0x38]
mov ebx, 7
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c653d
push 0x18
xor eax, eax
mov dword [ebp - 0x24], 0
push str.sjFFrtWnK15mlI7007HfcA
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x34], ax
call fcn.1001a860
mov dword [ebp - 4], 9
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x10], 0xf
call fcn.100c7330
mov dword [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x10], 0x1f
jb 0x100c6494
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xd4]
call fcn.1001a4c0
lea eax, [ebp - 0xd4]
mov dword [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x84]
mov ebx, 0x3f
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c653d
push str.NIfVcoTVJMEp1gPELFqSw
lea ecx, [ebp - 0x50]
call fcn.1001a4c0
mov dword [ebp - 4], 0xc
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x10], 0x7f
call fcn.100c7330
mov dword [ebp - 4], 0xd
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x10], 0xff
jb 0x100c650b
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x104]
call fcn.1001a4c0
lea eax, [ebp - 0x104]
mov ebx, 0x1ff
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001a360
mov byte [ebp - 0x11], 0
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
je 0x100c6541
mov byte [ebp - 0x11], 1
test ebx, 0x100
je 0x100c658f
mov edx, dword [ebp - 0xf0]
and ebx, 0xfffffeff
cmp edx, 8
jb 0x100c658f
mov ecx, dword [ebp - 0x104]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6585
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6beb
push edx
push ecx
call fcn.100703b3
add esp, 8
mov dword [ebp - 4], 0xc
test bl, bl
jns 0x100c65fd
mov edx, dword [ebp - 0xd8]
and ebx, 0xffffff7f
cmp edx, 8
jb 0x100c65e0
mov ecx, dword [ebp - 0xec]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c65d6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6bf0
push edx
push ecx
call fcn.100703b3
add esp, 8
xor eax, eax
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 7
mov word [ebp - 0xec], ax
mov dword [ebp - 4], 0xb
test bl, 0x40
je 0x100c665a
mov edx, dword [ebp - 0x3c]
and ebx, 0xffffffbf
cmp edx, 8
jb 0x100c6646
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c663c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6bf5
push edx
push ecx
call fcn.100703b3
add esp, 8
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
mov dword [ebp - 4], 0xa
test bl, 0x20
je 0x100c66a9
mov edx, dword [ebp - 0xc0]
and ebx, 0xffffffdf
cmp edx, 8
jb 0x100c66a9
mov ecx, dword [ebp - 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c669f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6bfa
push edx
push ecx
call fcn.100703b3
add esp, 8
mov dword [ebp - 4], 9
test bl, 0x10
je 0x100c6715
mov edx, dword [ebp - 0x90]
and ebx, 0xffffffef
cmp edx, 8
jb 0x100c66f8
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c66ee
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6bff
push edx
push ecx
call fcn.100703b3
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov dword [ebp - 4], 8
test bl, 8
je 0x100c6772
mov edx, dword [ebp - 0x20]
and ebx, 0xfffffff7
cmp edx, 8
jb 0x100c675e
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6754
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6c04
push edx
push ecx
call fcn.100703b3
add esp, 8
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
mov dword [ebp - 4], 7
mov edx, dword [ebp - 0x6c]
cmp edx, 8
jb 0x100c67b3
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c67a9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6c09
push edx
push ecx
call fcn.100703b3
add esp, 8
mov dword [ebp - 4], 6
mov edx, dword [ebp - 0xa8]
cmp edx, 8
jb 0x100c67fa
mov ecx, dword [ebp - 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c67f0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6c0e
push edx
push ecx
call fcn.100703b3
add esp, 8
xor eax, eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 4], eax
and ebx, 0xfffffff8
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xa8], 7
mov word [ebp - 0xbc], ax
cmp edx, 8
jb 0x100c6857
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c684d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6c13
push edx
push ecx
call fcn.100703b3
add esp, 8
mov eax, edi
mov dword [ebp - 0x70], 0
or eax, 1
mov dword [ebp - 0x6c], 7
cmp byte [ebp - 0x11], 0
lea ecx, [ebp - 0x80]
push 0x18
cmove eax, edi
mov esi, ebx
mov dword [ebp - 0x38], eax
xor eax, eax
push str.igE9GT3zhQIp1gPELFqSw
mov word [ebp - 0x80], ax
call fcn.1001a860
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x80]
or ebx, 0x200
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x10], ebx
call fcn.100c7330
mov edx, eax
mov ecx, esi
mov dword [ebp - 4], 0xf
or ecx, 0x600
cmp dword [edx + 0x14], 8
mov dword [ebp - 0x10], ecx
jb 0x100c68c2
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x58], 0
xor eax, eax
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c68e0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x68]
call fcn.1001a860
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x88]
or esi, 0xe00
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esi
mov edi, esi
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c69b9
push 0x18
xor eax, eax
mov dword [ebp - 0x24], 0
push str.l0PF_ifqACrATEfPeOVdg
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.1001a860
mov dword [ebp - 4], 0x11
lea edx, [ebp - 0x34]
or esi, 0x1000
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x10], esi
call fcn.100c7330
mov ecx, edi
mov dword [ebp - 4], 0x12
or ecx, 0x3000
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x10], ecx
jb 0x100c6984
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xd4]
call fcn.1001a4c0
lea eax, [ebp - 0xd4]
mov esi, edi
push eax
lea eax, [ebp - 0x84]
or esi, 0x7000
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001a360
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jne 0x100c69b9
xor bl, bl
jmp 0x100c69bb
mov bl, 1
test esi, 0x4000
je 0x100c6a09
mov edx, dword [ebp - 0xc0]
and esi, 0xffffbfff
cmp edx, 8
jb 0x100c6a09
mov ecx, dword [ebp - 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c69ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6c18
push edx
push ecx
call fcn.100703b3
add esp, 8
test esi, 0x2000
je 0x100c6a74
mov edx, dword [ebp - 0xa8]
and esi, 0xffffdfff
cmp edx, 8
jb 0x100c6a57
mov ecx, dword [ebp - 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6a4d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6c1d
push edx
push ecx
call fcn.100703b3
add esp, 8
xor eax, eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 7
mov word [ebp - 0xbc], ax
test esi, 0x1000
je 0x100c6aca
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x100c6ab6
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6aac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6c22
push edx
push ecx
call fcn.100703b3
add esp, 8
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x100c6b04
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6afa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6c27
push edx
push ecx
call fcn.100703b3
add esp, 8
mov edx, dword [ebp - 0x90]
cmp edx, 8
jb 0x100c6b44
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6b3a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6c2c
push edx
push ecx
call fcn.100703b3
add esp, 8
mov edx, dword [ebp - 0x6c]
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
cmp edx, 8
jb 0x100c6b9b
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100c6b91
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c6c31
push edx
push ecx
call fcn.100703b3
add esp, 8
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
mov esi, dword [ebp - 0x38]
push eax
or esi, 8
test bl, bl
push dword [eax]
cmove esi, dword [ebp - 0x38]
lea eax, [ebp - 0x88]
push eax
call fcn.1001ad40
push 0x28
push dword [ebp - 0x1c]
call fcn.100703b3
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
call fcn.1007e0fa
int3