Function at 0x1000555c
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x248
lea ebp, [esp - 4]
mov eax, dword [0x1001e390]
xor eax, ebp
mov dword [ebp + 0x248], eax
push 0x1c
mov eax, 0x10016b57
call fcn.10008caf
mov eax, dword [ebp + 0x254]
mov esi, 0x67d8
push esi
mov dword [ebp - 0x14], eax
call fcn.100086eb
push esi
push 0
push eax
mov dword [ebp - 0x10], eax
call fcn.10008500
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100056b5
lea eax, [ebp]
push eax
push ebx
mov dword [ebp], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x100056b5
mov edi, 0x10021e9c
mov ecx, edi
xor esi, esi
call fcn.10001684
test eax, eax
jbe 0x10005614
push esi
mov ecx, edi
call fcn.1000470c
cmp dword [eax + 0x18], 0x10
jb 0x100055f5
mov eax, dword [eax + 4]
jmp 0x100055f8
add eax, 4
lea ecx, [ebp + 0x24]
push ecx
push eax
call fcn.1000b988
test eax, eax
pop ecx
pop ecx
je 0x10005668
mov ecx, edi
inc esi
call fcn.10001684
cmp esi, eax
jb 0x100055e2
sub esp, 0x1c
lea eax, [ebp + 0x24]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.100018e1
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call fcn.100053e0
add esp, 0x24
xor esi, esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
call fcn.10001684
test eax, eax
jbe 0x10005695
push esi
lea ecx, [ebp - 0x24]
call fcn.1000470c
cmp dword [eax + 0x14], 0
jbe 0x10005688
push esi
lea ecx, [ebp - 0x24]
call fcn.1000470c
cmp dword [eax + 0x18], 0x10
jb 0x10005676
mov eax, dword [eax + 4]
jmp 0x10005679
lea eax, [ebp]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
mov esi, eax
jmp 0x100056ad
add eax, 4
push dword [ebp - 0x14]
push eax
call fcn.1000b75b
test eax, eax
pop ecx
pop ecx
jne 0x100056e3
lea ecx, [ebp - 0x24]
inc esi
call fcn.10001684
cmp esi, eax
jb 0x10005645
lea eax, [ebp]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.10001c5e
test esi, esi
jne 0x100055d5
push dword [ebp - 0x10]
call fcn.100086cd
xor eax, eax
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x248]
xor ecx, ebp
call fcn.10008ca0
add ebp, 0x24c
leave
ret
xor esi, esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], esi
call fcn.10001684
test eax, eax
mov ebx, dword [ebp - 0x10]
jbe 0x1000582b
lea eax, [ebx + 0x248]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0x64
jge 0x1000582b
push esi
lea ecx, [ebp - 0x24]
call fcn.1000470c
push 0x10
pop edi
cmp dword [eax + 0x18], edi
jb 0x10005724
mov eax, dword [eax + 4]
jmp 0x10005727
add eax, 4
push str.Default_IME
push eax
call fcn.1000b988
test eax, eax
pop ecx
pop ecx
je 0x1000581a
push esi
lea ecx, [ebp - 0x24]
call fcn.1000470c
cmp dword [eax + 0x18], edi
jb 0x1000574f
mov eax, dword [eax + 4]
jmp 0x10005752
add eax, 4
push str.MSCTFIME_UI
push eax
call fcn.1000b988
test eax, eax
pop ecx
pop ecx
je 0x1000581a
push esi
lea ecx, [ebp - 0x24]
call fcn.1000470c
cmp dword [eax + 0x18], edi
jb 0x1000577a
mov eax, dword [eax + 4]
jmp 0x1000577d
add eax, 4
push str.HintWnd
push eax
call fcn.1000b988
test eax, eax
pop ecx
pop ecx
je 0x1000581a
push esi
lea ecx, [ebp - 0x24]
call fcn.1000470c
cmp dword [eax + 0x18], edi
jb 0x100057a5
mov eax, dword [eax + 4]
jmp 0x100057a8
add eax, 4
push str.MSCTFIME_UI
push eax
call fcn.1000b988
test eax, eax
pop ecx
pop ecx
je 0x1000581a
push esi
lea ecx, [ebp - 0x24]
call fcn.1000470c
cmp dword [eax + 0x18], edi
jb 0x100057cc
mov eax, dword [eax + 4]
jmp 0x100057cf
add eax, 4
push str.Sogou_TSF_UI
push eax
call fcn.1000b988
test eax, eax
pop ecx
pop ecx
je 0x1000581a
push esi
lea ecx, [ebp - 0x24]
call fcn.1000470c
cmp dword [eax + 0x14], 0
jbe 0x1000581a
push esi
lea ecx, [ebp - 0x24]
call fcn.1000470c
cmp dword [eax + 0x18], edi
jb 0x10005802
mov eax, dword [eax + 4]
jmp 0x10005805
add eax, 4
push eax
push dword [ebp - 0x10]
call fcn.100096a0
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x104
pop ecx
pop ecx
lea ecx, [ebp - 0x24]
inc esi
call fcn.10001684
cmp esi, eax
jb 0x10005704
lea eax, [ebp + 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.100096a0
push 0x103
xor esi, esi
lea eax, [ebp + 0x145]
push esi
push eax
mov byte [ebp + 0x144], 0
call fcn.10008500
lea eax, [ebp + 0x144]
push eax
push dword [ebp + 8]
call fcn.1000467f
lea eax, [ebp + 0x144]
push eax
call fcn.10008dc0
add esp, 0x20
test eax, eax
jne 0x1000588a
lea eax, [ebx + 0x248]
push eax
lea eax, [ebp + 0x144]
push eax
call fcn.100096a0
pop ecx
pop ecx
lea eax, [ebp + 0x144]
push eax
lea eax, [ebx + 0x144]
push eax
call fcn.100096a0
pop ecx
pop ecx
push esi
lea ecx, [ebp + 0x128]
mov dword [ebp + 0x140], 0xf
call fcn.100010fd
lea eax, [ebp + 0x128]
push eax
lea eax, [ebp + 0x144]
push eax
mov byte [ebp - 4], 1
call fcn.1000354c
cmp dword [ebp + 0x13c], esi
pop ecx
pop ecx
jbe 0x100058f4
cmp dword [ebp + 0x140], 0x10
mov eax, dword [ebp + 0x12c]
jae 0x100058eb
lea eax, [ebp + 0x12c]
push eax
push ebx
call fcn.100096a0
pop ecx
pop ecx
push esi
push 1
lea ecx, [ebp + 0x128]
call fcn.100011d7
lea ecx, [ebp - 0x24]
call fcn.10001c5e
mov eax, ebx
jmp 0x100056c0