Function at 0x1007f904
Capabilities:
Enumerate processes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x25c
mov esi, dword [esp + 0x270]
mov eax, dword [0x100c51b8]
xor eax, esp
mov dword [esp + 0x258], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp], eax
mov ebp, 0xf0141a6a
cmp ebp, 0x210c614d
jg 0x1007f981
cmp ebp, 0xf0141a69
jg 0x1007f9d2
cmp ebp, 0x804bd52f
je 0x1007fa2e
cmp ebp, 0xdac1b9a1
jne 0x1007fa80
mov ebp, 0x16164c96
lea eax, [esp + 0x14]
push eax
push dword [esp + 4]
call sub.KERNEL32.dll_Process32NextW
mov ebx, eax
jmp 0x1007f93e
cmp ebp, 0x4756e339
jg 0x1007f9fc
cmp ebp, 0x210c614e
je 0x1007fa3c
cmp ebp, 0x27bce022
jne 0x1007f93e
lea ecx, [esp + 0x14]
mov dword [esp + 0x240], ecx
mov eax, dword [esp + 0x240]
mov eax, 0x22c
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], eax
mov ebp, 0x16164c96
push ecx
push dword [esp + 4]
call sub.KERNEL32.dll_Process32FirstW
mov ebx, eax
jmp 0x1007f93e
cmp ebp, 0xf0141a6a
je 0x1007fa56
cmp ebp, 0x16164c96
jne 0x1007f93e
test ebx, ebx
mov ebp, 0x210c614e
mov eax, 0x5be39863
cmove ebp, eax
xor edi, edi
jmp 0x1007f93e
cmp ebp, 0x4756e33a
je 0x1007fa6e
cmp ebp, 0x5be39863
jne 0x1007f93e
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x240]
mov ebp, 0xb8bbaf6b
mov dword [esp + 0xc], edi
jmp 0x1007f93e
mov ebp, 0x5be39863
mov edi, dword [esp + 0x2c]
jmp 0x1007f93e
mov eax, dword [esp + 8]
cmp dword [esp + 0x1c], eax
mov ebp, 0xdac1b9a1
mov eax, 0x804bd52f
cmove ebp, eax
jmp 0x1007f93e
mov eax, dword [esp]
cmp eax, 0xffffffff
mov ebp, 0x27bce022
mov eax, 0x4756e33a
cmove ebp, eax
jmp 0x1007f93e
mov ebp, 0xb8bbaf6b
mov dword [esp + 0xc], 0
jmp 0x1007f93e
cmp ebp, 0xb8bbaf6b
jne 0x1007f93e
lea ecx, [esp + 0x240]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
xor ebp, ebp
mov dword [ecx], ebp
mov dword [ecx + 0x10], ebp
mov dword [ecx + 0x14], 7
mov word [ecx], 0
cmp dword [esp + 0xc], 0
mov eax, 0xfa1f8e39
mov ecx, 0x2415f82e
cmove ecx, eax
mov dword [esp + 8], ecx
mov edi, 0xc46f6de2
cmp edi, 0x2415f82d
jle 0x1007fb1e
cmp edi, 0x58134f36
jg 0x1007fb4f
cmp edi, 0x2415f82e
je 0x1007fbb2
cmp edi, 0x3091e1ea
je 0x1007fbd8
cmp edi, 0x37a951d8
jne 0x1007fac9
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x240]
push eax
push esi
call fcn.1005c1f9
add esp, 8
mov eax, dword [esp]
mov edi, 0x75d7bc6c
jmp 0x1007fac9
cmp edi, 0xca785f00
jg 0x1007fb74
cmp edi, 0xa46dc8fe
je 0x1007fbfe
cmp edi, 0xaf73f5d4
je 0x1007fc18
cmp edi, 0xc46f6de2
jne 0x1007fac9
mov edi, dword [esp + 8]
jmp 0x1007fac9
cmp edi, 0x58134f37
je 0x1007fc2c
cmp edi, 0x65fc2e9b
je 0x1007fc59
cmp edi, 0x75d7bc6c
je 0x1007fba8
jmp 0x1007fac9
cmp edi, 0xca785f01
je 0x1007fc73
cmp edi, 0xfa1f8e39
jne 0x1007fc98
mov dword [esi], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, esi
push ebp
push 0x100be687
call fcn.10007b00
mov edi, 0xd7594904
jmp 0x1007fac9
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp eax, 0xffffffff
mov edi, 0x58134f37
mov eax, 0x3091e1ea
cmove edi, eax
jmp 0x1007fac9
mov dword [esi], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, esi
push ebp
push 0x100be687
call fcn.10007b00
mov edi, 0x75d7bc6c
jmp 0x1007fac9
mov edi, 0xaf73f5d4
lea eax, [esp + 0x14]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Process32NextW
mov ebx, eax
jmp 0x1007fac9
test ebx, ebx
mov edi, 0x65fc2e9b
mov eax, 0x37a951d8
cmove edi, eax
jmp 0x1007fac9
lea ecx, [esp + 0x14]
mov dword [esp], ecx
mov eax, dword [esp]
mov eax, 0x22c
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], eax
mov edi, 0xaf73f5d4
push ecx
push dword [esp + 8]
call sub.KERNEL32.dll_Process32FirstW
mov ebx, eax
jmp 0x1007fac9
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x1c], eax
mov edi, 0xa46dc8fe
mov eax, 0xca785f01
cmove edi, eax
jmp 0x1007fac9
lea edi, [esp + 0x38]
push edi
call fcn.1009f1fa
add esp, 4
lea ecx, [esp + 0x240]
push eax
push edi
call fcn.1001a43a
mov edi, 0x37a951d8
jmp 0x1007fac9
cmp edi, 0xd7594904
jne 0x1007fac9
lea ecx, [esp + 0x240]
call fcn.1000e7f4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.100879aa
mov eax, esi
add esp, 0x25c
pop esi
pop edi
pop ebx
pop ebp
ret