Function at 0x10007230
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100954a4
mov eax, dword fs:[0]
push eax
sub esp, 0x8d4
mov eax, dword [0x100c6394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x714]
push ecx
push eax
mov byte [ebp - 0x70d], 0
mov dword [ebp - 0x714], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100569b0
mov ebx, dword [ebp - 0x714]
add esp, 0xc
mov dword [ebp - 0x718], ebx
push ebx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000742a
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100569b0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10007340
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
lea ecx, [ebp - 0x218]
mov eax, ecx
mov edx, 0x104
sub esi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1000732e
movzx eax, word [esi + ecx]
test ax, ax
je 0x1000732e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10007310
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
jmp 0x100077f1
call fcn.1003e050
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1000773f
push 0x6d
push str.d:jenkins.jenkinsworkspacelib_commonmodeidentifymodeidentifyldsmodeidentifyldsmodeidentifycommon.cpp
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x4cc], 0xf
mov byte [ebp - 0x4e0], al
call fcn.1000a9b0
push 3
push 0x1009de28
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x4b4], 0xf
mov byte [ebp - 0x4c8], 0
call fcn.1000a9b0
mov byte [ebp - 4], 1
call fcn.1003e050
mov edi, eax
lea ecx, [ebp - 0x7b0]
push 0xf8
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x4c8]
push eax
call fcn.10004330
mov esi, eax
push str.GetModuleFileNameEx_Failed
push esi
mov byte [ebp - 4], 2
call fcn.10005560
mov eax, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x7b0]
call fcn.10005880
lea ecx, [ebp - 0x4c8]
call fcn.10004d90
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 4], 0xffffffff
call fcn.10004d90
jmp 0x1000773f
call fcn.1003e050
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x100075c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x6d
push str.d:jenkins.jenkinsworkspacelib_commonmodeidentifymodeidentifyldsmodeidentifyldsmodeidentifycommon.cpp
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x440], 0
mov ebx, eax
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000a9b0
push 3
push 0x1009de28
lea ecx, [ebp - 0x438]
mov dword [ebp - 4], 3
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000a9b0
mov byte [ebp - 4], 4
call fcn.1003e050
mov edi, eax
lea ecx, [ebp - 0x848]
push 0xfb
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.10004330
mov esi, eax
push str.LastError:
push esi
mov byte [ebp - 4], 5
call fcn.10005560
add esp, 8
mov ecx, esi
push ebx
call fcn.100053b0
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x848]
call fcn.10005880
mov edx, dword [ebp - 0x424]
mov byte [ebp - 4], 3
cmp edx, 0x10
jb 0x10007545
mov ecx, dword [ebp - 0x438]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000753b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100079b9
push edx
push ecx
call fcn.1004cc8b
add esp, 8
mov edx, dword [ebp - 0x43c]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x100075a1
mov ecx, dword [ebp - 0x450]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10007597
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100079be
push edx
push ecx
call fcn.1004cc8b
add esp, 8
mov ebx, dword [ebp - 0x718]
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1003e050
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1000773f
push 0x6d
push str.d:jenkins.jenkinsworkspacelib_commonmodeidentifymodeidentifyldsmodeidentifyldsmodeidentifycommon.cpp
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x46c], 0xf
mov byte [ebp - 0x480], al
call fcn.1000a9b0
push 3
push 0x1009de28
lea ecx, [ebp - 0x468]
mov dword [ebp - 4], 6
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
call fcn.1000a9b0
mov byte [ebp - 4], 7
call fcn.1003e050
mov edi, eax
lea ecx, [ebp - 0x8e0]
push 0xfc
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.10004330
mov esi, eax
push str.hproc_is_NULL
push esi
mov byte [ebp - 4], 8
call fcn.10005560
mov eax, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x8e0]
call fcn.10005880
mov edx, dword [ebp - 0x454]
mov byte [ebp - 4], 6
cmp edx, 0x10
jb 0x100076c8
mov ecx, dword [ebp - 0x468]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100076be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100079c3
push edx
push ecx
call fcn.1004cc8b
add esp, 8
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x10007724
mov ecx, dword [ebp - 0x480]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000771a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100079c8
push edx
push ecx
call fcn.1004cc8b
add esp, 8
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0xf
mov byte [ebp - 0x480], 0
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x100077e9
push 0x228
lea eax, [ebp - 0x708]
push edi
push eax
call fcn.100569b0
add esp, 0xc
mov dword [ebp - 0x70c], 0x22c
lea eax, [ebp - 0x70c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x100077e2
cmp dword [ebp - 0x704], ebx
je 0x1000779f
lea eax, [ebp - 0x70c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10007784
jmp 0x100077e2
lea ecx, [ebp - 0x218]
mov edx, 0x104
lea edi, [ebp - 0x6e8]
mov eax, ecx
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x100077d2
movzx eax, word [edi + ecx]
test ax, ax
je 0x100077d2
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x100077b4
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea edi, [ecx + 1]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x10007997
call fcn.1003e050
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10007955
push 0x6d
push str.d:jenkins.jenkinsworkspacelib_commonmodeidentifymodeidentifyldsmodeidentifyldsmodeidentifycommon.cpp
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x49c], 0xf
mov byte [ebp - 0x4b0], al
call fcn.1000a9b0
push 3
push 0x1009de28
lea ecx, [ebp - 0x498]
mov dword [ebp - 4], 9
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x484], 0xf
mov byte [ebp - 0x498], 0
call fcn.1000a9b0
mov byte [ebp - 4], 0xa
call fcn.1003e050
mov edi, eax
lea ecx, [ebp - 0x578]
push 0x1f1
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.10004330
mov esi, eax
push str.wnd_process_name:
push esi
mov byte [ebp - 4], 0xb
call fcn.10005560
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.100029c0
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x578]
call fcn.10005880
mov edx, dword [ebp - 0x484]
cmp edx, 0x10
jb 0x10007900
mov ecx, dword [ebp - 0x498]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100078f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100079cd
push edx
push ecx
call fcn.1004cc8b
add esp, 8
mov edx, dword [ebp - 0x49c]
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x484], 0xf
mov byte [ebp - 0x498], 0
cmp edx, 0x10
jb 0x10007955
mov ecx, dword [ebp - 0x4b0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000794b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100079d2
push edx
push ecx
call fcn.1004cc8b
add esp, 8
mov ecx, str.QQLive.exe
lea eax, [ebp - 0x218]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000798b
test dx, dx
je 0x10007982
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000798b
add eax, 4
add ecx, 4
test dx, dx
jne 0x10007960
xor eax, eax
test eax, eax
sete al
jmp 0x1000799d
sbb eax, eax
or eax, 1
test eax, eax
sete al
jmp 0x1000799d
mov al, byte [ebp - 0x70d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d00a
mov esp, ebp
pop ebp
ret
call fcn.10059b09
call fcn.10059b09
call fcn.10059b09
call fcn.10059b09
call fcn.10059b09
call fcn.10059b09
int3