Function at 0x1001a420
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x1008bb60]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x144], 0
mov byte [ebp - 0x13c], 0
xor eax, eax
mov word [ebp - 0x13b], ax
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea ecx, [ebp - 0x12c]
push ecx
call fcn.10041d70
add esp, 0xc
push str.360rps.exe
lea ecx, [ebp - 0x14c]
call fcn.10002ce0
push str.zhudongfangyu.exe
lea ecx, [ebp - 0x134]
call fcn.10002ce0
push 0x10073f2c
lea ecx, [ebp - 0x138]
call fcn.10002ce0
push 0x10073f38
lea ecx, [ebp - 0x148]
call fcn.10002ce0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffff
jne 0x1001a514
lea ecx, [ebp - 0x148]
call fcn.100016d0
lea ecx, [ebp - 0x138]
call fcn.100016d0
lea ecx, [ebp - 0x134]
call fcn.100016d0
lea ecx, [ebp - 0x14c]
call fcn.100016d0
jmp 0x1001a795
mov byte [ebp - 0x13c], 0x30
mov byte [ebp - 0x13b], 0x30
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x140]
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1001a6de
lea ecx, [ebp - 0x14c]
push ecx
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x158]
call fcn.10002ce0
or dword [ebp - 0x16c], 1
mov ecx, eax
call fcn.10005ce0
push eax
call fcn.10025ab0
add esp, 8
movzx eax, al
test eax, eax
jne 0x1001a5f8
lea ecx, [ebp - 0x138]
push ecx
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x15c]
call fcn.10002ce0
or dword [ebp - 0x16c], 2
mov ecx, eax
call fcn.10005ce0
push eax
call fcn.10025ab0
add esp, 8
movzx eax, al
test eax, eax
jne 0x1001a5f8
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x160]
call fcn.10002ce0
or dword [ebp - 0x16c], 4
mov ecx, eax
call fcn.10005ce0
push eax
call fcn.10025ab0
add esp, 8
movzx eax, al
test eax, eax
jne 0x1001a5f8
mov dword [ebp - 0x170], 0
jmp 0x1001a602
mov dword [ebp - 0x170], 1
mov cl, byte [ebp - 0x170]
mov byte [ebp - 0x151], cl
mov edx, dword [ebp - 0x16c]
and edx, 4
je 0x1001a62b
and dword [ebp - 0x16c], 0xfffffffb
lea ecx, [ebp - 0x160]
call fcn.100016d0
mov eax, dword [ebp - 0x16c]
and eax, 2
je 0x1001a648
and dword [ebp - 0x16c], 0xfffffffd
lea ecx, [ebp - 0x15c]
call fcn.100016d0
mov ecx, dword [ebp - 0x16c]
and ecx, 1
je 0x1001a665
and dword [ebp - 0x16c], 0xfffffffe
lea ecx, [ebp - 0x158]
call fcn.100016d0
movzx edx, byte [ebp - 0x151]
test edx, edx
je 0x1001a677
mov byte [ebp - 0x13c], 0x31
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x10c]
push ecx
lea ecx, [ebp - 0x168]
call fcn.10002ce0
mov ecx, eax
call fcn.10005ce0
push eax
call fcn.10025ab0
add esp, 8
mov byte [ebp - 0x161], al
lea ecx, [ebp - 0x168]
call fcn.100016d0
movzx edx, byte [ebp - 0x161]
test edx, edx
je 0x1001a6c3
mov byte [ebp - 0x13b], 0x31
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x140]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1001a547
movsx edx, byte [ebp - 0x13c]
cmp edx, 0x31
jne 0x1001a700
movsx eax, byte [ebp - 0x13b]
cmp eax, 0x31
jne 0x1001a700
mov dword [ebp - 0x150], 3
movsx ecx, byte [ebp - 0x13c]
cmp ecx, 0x31
jne 0x1001a722
movsx edx, byte [ebp - 0x13b]
cmp edx, 0x30
jne 0x1001a722
mov dword [ebp - 0x150], 2
movsx eax, byte [ebp - 0x13c]
cmp eax, 0x30
jne 0x1001a744
movsx ecx, byte [ebp - 0x13b]
cmp ecx, 0x31
jne 0x1001a744
mov dword [ebp - 0x150], 1
mov edx, dword [ebp - 0x150]
push edx
push 0x10073f44
mov eax, dword [ebp + 8]
push eax
call fcn.10041cb1
add esp, 0xc
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x148]
call fcn.100016d0
lea ecx, [ebp - 0x138]
call fcn.100016d0
lea ecx, [ebp - 0x134]
call fcn.100016d0
lea ecx, [ebp - 0x14c]
call fcn.100016d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10041acb
mov esp, ebp
pop ebp
ret