Function at 0x1000995b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
test eax, eax
je 0x1000989f
jne 0x1000989e
call 0x93048926
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
mov ebx, 0x73f8fb74
add bh, bl
xor eax, 3
add eax, 4
xor eax, 5
jl 0x100098ad
jmp 0x100098af
je 0x100098aa
clc
jae 0x100098b4
sti
mov ebx, 0x8435
add byte [ebx], dh
rol byte [ebx], 1
ret 0xea81
xor eax, 0x84
xor edx, eax
add eax, edx
sub edx, 0x84
push eax
pop edx
xor edx, 0x18c
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x84
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
pushf
push 0xa
jae 0x100098fc
jmp 0x100098f7
call 0x100098fe
jae 0x100098f7
add esp, 4
jmp 0x10009903
dec dword [esp]
jno 0x10009908
jns 0x100098f3
jp 0x1000990c
add esp, 4
popf
jmp 0x10009913
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000992c
jne 0x1000992c
call 0x1fc0cc80
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov dword [ebp - 0x12c], 0x128
clc
jae 0x1000994c
and al, 0xb0
pushf
push 0xa
jae 0x10009959
jmp 0x10009954
call 0x1000995b
jae 0x10009954
add esp, 4
jmp 0x10009960
dec dword [esp]
jno 0x10009965
jns 0x10009950
jp 0x10009969
add esp, 4
popf
jmp 0x10009970
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
xor eax, 0x89
xor edx, eax
add eax, edx
sub edx, 0x89
push eax
pop edx
xor edx, 0x19b
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x89
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
jl 0x100099c4
jmp 0x100099c6
je 0x100099c1
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100099e0
jne 0x100099df
call 0x93048a67
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100099ee
jne 0x100099ee
call 0x126a9a5c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10009adb
mov edx, dword [ebp + 8]
mov dword [ebp - 0x138], edx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
mov dl, byte [ecx]
mov byte [ebp - 0x12d], dl
mov eax, dword [ebp - 0x138]
cmp dl, byte [eax]
jne 0x10009a8b
cmp byte [ebp - 0x12d], 0
je 0x10009a7f
mov ecx, dword [ebp - 0x134]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x12e], dl
mov eax, dword [ebp - 0x138]
cmp dl, byte [eax + 1]
jne 0x10009a8b
add dword [ebp - 0x134], 2
add dword [ebp - 0x138], 2
cmp byte [ebp - 0x12e], 0
jne 0x10009a2d
mov dword [ebp - 0x140], 0
jmp 0x10009a96
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x140], ecx
mov edx, dword [ebp - 0x140]
mov dword [ebp - 0x144], edx
cmp dword [ebp - 0x144], 0
jne 0x10009ac0
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x124]
jmp 0x10009aea
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x13c]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10009a18
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret