Function at 0x1000cca0
Capabilities:
Enumerate processes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
push esi
push edi
mov dword [ebp - 0x344], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000ccc4
inc ebx
push edi
je 0x1000cd1d
pop eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000cce9
mov eax, dword [ebp - 0x344]
mov dword [eax + 4], 0x1b59
jmp 0x1000cedd
mov dword [ebp - 0x338], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x334]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x338], 0x128
lea ecx, [ebp - 0x338]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000cd3c
sal byte [ebp + 0x1c], 0x8b
test dword [esp + edi*8 + 0x40c7ffff], edi
add al, 0x59
sbb eax, dword [eax]
add byte [ebx - 0xae03b3], cl
adc eax, sym.imp.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x344]
mov dword [eax + 4], 0x1b59
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000cedd
call fcn.1000a410
mov ecx, dword [ebp - 0x344]
call fcn.1000dce0
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xffffffff
jne 0x1000cd6d
mov edx, dword [ebp - 0x344]
mov dword [edx + 4], 0x1b69
jmp 0x1000cedd
mov dword [ebp - 0x210], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x31c]
mov dword [ebp - 0x20c], ecx
mov edx, dword [ebp - 0x330]
mov dword [ebp - 0x210], edx
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
push 0
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.SHELL32.dll_StrRChrA]
test eax, eax
jne 0x1000cde9
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.1000a370
add esp, 8
mov dword [ebp - 0x33c], 0
push 0
lea edx, [ebp - 0x33c]
push edx
push 0x20c
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x340]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0x338]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1000cec6
mov ecx, 0x83
xor eax, eax
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x324]
mov dword [ebp - 0x208], ecx
mov edx, dword [ebp - 0x31c]
mov dword [ebp - 0x20c], edx
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x210], eax
lea ecx, [ebp - 0x314]
push ecx
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.SHELL32.dll_StrRChrA]
test eax, eax
jne 0x1000ce9f
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call fcn.1000a370
add esp, 8
push 0
lea eax, [ebp - 0x33c]
push eax
push 0x20c
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x340]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1000ce15
mov eax, dword [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret