Function at 0x10021950
Capabilities:
Enumerate processes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1007b706
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x234
test eax, eax
push esi
jne 0x10021afd
mov eax, dword [0x10096acc]
test eax, eax
mov esi, dword [esp + 0x24c]
je 0x10021990
test esi, esi
je 0x10021b58
push 0x104
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100219c8
mov dword [0x10096acc], 0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
add esp, 0x240
ret
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x10098944
call fcn.10005d60
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x10021a05
mov cl, 0x5c
cmp byte [esp + eax + 0xc], cl
je 0x100219f5
dec eax
test eax, eax
jg 0x100219e8
jmp 0x10021a05
lea eax, [esp + eax + 0xd]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
je 0x10021a39
lea edx, [esp + 0xc]
push esi
push edx
call fcn.1006a344
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
sbb eax, eax
inc eax
pop esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
add esp, 0x240
ret
lea eax, [esp + 0xc]
push str.iexplore.exe
push eax
call fcn.1006a344
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add esp, 4
push eax
call esi
test eax, eax
je 0x10021add
lea ecx, [esp + 0xc]
push str.rundll32.exe
push ecx
call fcn.1006a344
add esp, 4
push eax
call esi
test eax, eax
je 0x10021add
lea edx, [esp + 0xc]
push str.ttraveler.exe
push edx
call fcn.1006a344
add esp, 4
push eax
call esi
test eax, eax
je 0x10021add
lea eax, [esp + 0xc]
push 0x1008287c
push eax
call fcn.1006a344
add esp, 4
push eax
call esi
test eax, eax
je 0x10021add
lea ecx, [esp + 0xc]
push str.max.exe
push ecx
call fcn.1006a344
add esp, 4
push eax
call esi
test eax, eax
je 0x10021add
lea edx, [esp + 0xc]
push str.regsvr32.exe
push edx
call fcn.1006a344
add esp, 4
push eax
call esi
test eax, eax
jne 0x100219a6
mov eax, 1
mov dword [0x10096acc], eax
pop esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
add esp, 0x240
ret
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10021b55
lea eax, [esp + 0x114]
push eax
push esi
mov dword [esp + 0x11c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10021b4e
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
cmp dword [esp + 0x11c], eax
je 0x10021b6e
lea ecx, [esp + 0x114]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10021b31
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
add esp, 0x240
ret
lea edx, [esp + 0x138]
push edx
lea ecx, [esp + 0xc]
call fcn.10005e50
lea ecx, [esp + 8]
mov dword [esp + 0x244], 2
call fcn.10008d70
push 0x5c
lea ecx, [esp + 0xc]
call fcn.10008480
test eax, eax
jl 0x10021bd6
mov ecx, dword [esp + 8]
mov ecx, dword [ecx - 0xc]
sub ecx, eax
dec ecx
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
call fcn.10008dd0
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x248], 3
call fcn.10004aa0
lea ecx, [esp + 0xc]
call fcn.100034a0
mov eax, dword [esp + 8]
push str.iexplore.exe
push eax
call fcn.10068d19
add esp, 8
test eax, eax
je 0x10021c3b
lea ecx, [esp + 8]
push str.regsvr32.exe
push ecx
call fcn.10002c20
add esp, 8
test al, al
jne 0x10021c3b
lea edx, [esp + 8]
push str.explorer.exe
push edx
call fcn.10002c20
add esp, 8
test al, al
je 0x10021c2d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 8]
call fcn.100034a0
jmp 0x10021b55
lea ecx, [esp + 8]
call fcn.100034a0
jmp 0x10021b4e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 8]
call fcn.100034a0
mov ecx, dword [esp + 0x23c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x240
ret