Function at 0x10001030
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10010e80
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x1001c004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
mov esi, dword [ebp + 0x1c]
lea ecx, [ebp + 8]
mov edx, dword [ebp + 8]
lea ebx, [ebp + 8]
cmp esi, 0x10
cmovae eax, edx
cmovae ecx, edx
mov dword [ebp - 0x154], eax
mov eax, dword [ebp + 0x18]
add eax, ecx
cmp esi, 0x10
mov edi, eax
cmovae ebx, edx
xor ecx, ecx
sub edi, ebx
xor esi, esi
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x100010bb
nop
movsx eax, byte [ebx + esi]
push eax
call fcn.10009142
mov ecx, dword [ebp - 0x154]
add esp, 4
mov byte [ecx + esi], al
inc esi
cmp esi, edi
jne 0x100010a0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x158], eax
cmp eax, 0xffffffff
je 0x10001203
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x150], 0x128
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10001203
nop dword [eax]
nop dword [eax + eax]
cmp byte [ebp - 0x12c], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jne 0x1000111f
xor ecx, ecx
jmp 0x10001131
lea ecx, [ebp - 0x12c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001128
sub ecx, edx
push ecx
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001ff0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
lea ebx, [ebp - 0x28]
cmp esi, 0x10
cmovae eax, edx
cmovae ecx, edx
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x18]
add eax, ecx
cmp esi, 0x10
mov edi, eax
cmovae ebx, edx
xor ecx, ecx
sub edi, ebx
xor esi, esi
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x1000119b
nop
movsx eax, byte [ebx + esi]
push eax
call fcn.10009142
mov ecx, dword [ebp - 0x154]
add esp, 4
mov byte [ecx + esi], al
inc esi
cmp esi, edi
jne 0x10001180
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 8]
call fcn.10001c30
test eax, eax
je 0x10001222
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x158]
call dword [sym.imp.KERNEL32.dll_Process32Next]
mov byte [ebp - 4], 0
mov esi, eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x100011fb
mov edx, dword [ebp - 0x28]
inc ecx
cmp ecx, 0x1000
jb 0x100011f2
test dl, 0x1f
jne 0x1000121d
mov eax, dword [edx - 4]
cmp eax, edx
jae 0x1000121d
sub edx, eax
cmp edx, 4
jb 0x1000121d
cmp edx, 0x23
ja 0x1000121d
mov edx, eax
push edx
call fcn.10002a20
add esp, 4
test esi, esi
jne 0x10001100
xor esi, esi
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x1000125f
mov ecx, dword [ebp + 8]
inc eax
cmp eax, 0x1000
jb 0x10001256
test cl, 0x1f
je 0x10001232
call fcn.10008e91
mov esi, dword [ebp - 0x148]
lea ecx, [ebp - 0x28]
call fcn.10001cd0
jmp 0x10001205
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x1000123e
call fcn.10008e91
sub ecx, eax
cmp ecx, 4
jae 0x1000124a
call fcn.10008e91
cmp ecx, 0x23
jbe 0x10001254
call fcn.10008e91
mov ecx, eax
push ecx
call fcn.10002a20
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100029dc
mov esp, ebp
pop ebp
ret