Function at 0x100cc390
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014ee92
mov eax, dword fs:[0]
push eax
sub esp, 0x73c
mov eax, dword [0x1019a128]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.GetLoginInstance
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x684], 0
call fcn.1000ab60
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov dword [ebp - 0x34], 0
xor eax, eax
mov dword [ebp - 0x688], ebx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
push 0xfffe
mov byte [ebp - 4], 1
call fcn.10115c68
add esp, 4
mov esi, eax
push 0xfffe
push 0
push esi
call fcn.10117ff0
add esp, 0xc
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x684], 8
push 0x7fff
push esi
push 0
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x100cc45c
push esi
call fcn.1011582b
add esp, 4
jmp 0x100cca30
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100cc461
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x34]
call fcn.10002060
push esi
mov byte [ebp - 4], 1
call fcn.1011582b
add esp, 4
lea ecx, [ebp - 0x748]
mov edx, 0x10
push str.GetLoginInstance
call fcn.1000aed0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 3
mov al, byte [esi + 0x48]
test al, al
je 0x100cc4d7
mov edx, str.pathCurrentProcess_
mov ecx, esi
call fcn.10020800
mov al, byte [esi + 0x48]
test al, al
je 0x100cc4d7
cmp dword [ebp - 0x20], 8
lea edx, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae edx, dword [ebp - 0x34]
mov ecx, esi
call fcn.10021f70
add esp, 4
lea ecx, [ebp - 0x748]
mov byte [ebp - 4], 1
call fcn.1000ad70
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x68c], eax
cmp eax, 0xffffffff
jne 0x100cc5de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1019ed44]
mov esi, eax
add ecx, dword [0x1019ed48]
je 0x100cc58c
mov dword [ebp - 0x690], 0
call fcn.10010f60
mov dword [ebp - 0x694], eax
lock inc dword [ebp - 0x690]
mov byte [ebp - 4], 4
cmp dword [ebp - 0x694], 0
mov dword [ebp - 0x684], 9
jne 0x100cc55a
call fcn.10010f60
mov dword [ebp - 0x694], eax
lock inc dword [ebp - 0x690]
mov eax, dword [ebp - 0x694]
lea ecx, [ebp - 0x68c]
push esi
push str.CreateToolhelp32Snapshot_error_0x_x
push str.GetLoginInstance
push 0x10000000
push ecx
push 0
push eax
mov dword [ebp - 0x68c], 0x10
call fcn.1000ab20
add esp, 0x1c
mov eax, dword [ebp - 0x684]
test al, 1
je 0x100cca30
and eax, 0xfffffffe
mov dword [ebp - 0x684], eax
or eax, 0xffffffff
mov dword [ebp - 0x694], 0
lock xadd dword [ebp - 0x690], eax
js 0x100cc5d2
nop word [eax + eax]
call fcn.10017ee0
or eax, 0xffffffff
lock xadd dword [ebp - 0x690], eax
jns 0x100cc5c0
lock inc dword [ebp - 0x690]
jmp 0x100cca30
push 0x228
lea eax, [ebp - 0x67c]
push 0
push eax
call fcn.10117ff0
add esp, 0xc
mov dword [ebp - 0x680], 0x22c
lea eax, [ebp - 0x680]
push eax
push dword [ebp - 0x68c]
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x100cc6f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1019ed44]
mov esi, eax
add ecx, dword [0x1019ed48]
je 0x100cc6a6
mov dword [ebp - 0x698], 0
call fcn.10010f60
mov dword [ebp - 0x69c], eax
lock inc dword [ebp - 0x698]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x69c], 0
mov dword [ebp - 0x684], 0xa
jne 0x100cc674
call fcn.10010f60
mov dword [ebp - 0x69c], eax
lock inc dword [ebp - 0x698]
mov eax, dword [ebp - 0x69c]
lea ecx, [ebp - 0x688]
push esi
push str.Process32First_error_0x_x
push str.GetLoginInstance
push 0x10000000
push ecx
push 0
push eax
mov dword [ebp - 0x688], 0x10
call fcn.1000ab20
add esp, 0x1c
mov eax, dword [ebp - 0x684]
test al, 2
je 0x100cca24
and eax, 0xfffffffd
mov dword [ebp - 0x684], eax
or eax, 0xffffffff
mov dword [ebp - 0x69c], 0
lock xadd dword [ebp - 0x698], eax
js 0x100cc6e6
call fcn.10017ee0
or eax, 0xffffffff
lock xadd dword [ebp - 0x698], eax
jns 0x100cc6d4
lock inc dword [ebp - 0x698]
jmp 0x100cca24
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [eax + eax]
cmp dword [ebp - 0x668], ebx
jne 0x100cc8ea
push str.GetLoginInstance
mov edx, 0x10
lea ecx, [ebp - 0x748]
call fcn.1000aed0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 6
mov al, byte [esi + 0x48]
test al, al
je 0x100cc751
mov edx, str.pid_
mov ecx, esi
call fcn.10020800
mov al, byte [esi + 0x48]
test al, al
je 0x100cc751
push dword [ebp - 0x678]
mov ecx, esi
call fcn.100201d0
lea ecx, [ebp - 0x748]
mov byte [ebp - 4], 1
call fcn.1000ad70
push dword [ebp - 0x678]
push 0
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x100cc995
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.100cca70
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x18]
push eax
push esi
push 0
push ebx
mov dword [ebp - 0x14], 0x7fff
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea ecx, [ebp - 0x748]
push str.GetLoginInstance
test eax, eax
je 0x100cc85a
mov edx, 0x10
call fcn.1000aed0
add esp, 4
mov edi, eax
mov byte [ebp - 4], 8
mov cl, byte [edi + 0x48]
test cl, cl
je 0x100cc818
mov edx, str.pid_
mov ecx, edi
call fcn.10020800
mov cl, byte [edi + 0x48]
test cl, cl
je 0x100cc818
push dword [ebp - 0x678]
mov ecx, edi
call fcn.100201d0
mov cl, byte [edi + 0x48]
test cl, cl
je 0x100cc818
mov edx, str._path_
mov ecx, edi
call fcn.10020800
mov cl, byte [edi + 0x48]
test cl, cl
je 0x100cc818
mov edx, esi
mov ecx, edi
call fcn.100205a0
lea ecx, [ebp - 0x748]
mov byte [ebp - 4], 7
call fcn.1000ad70
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push esi
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.10123ead
add esp, 8
test eax, eax
jne 0x100cc8c6
test esi, esi
je 0x100cca32
push esi
call fcn.1011582b
add esp, 4
jmp 0x100cca32
mov edx, 8
call fcn.1000aed0
add esp, 4
mov edi, eax
mov byte [ebp - 4], 9
mov al, byte [edi + 0x48]
test al, al
je 0x100cc8a7
mov edx, str.QueryFullProcessImageName_failed_for_pid_
mov ecx, edi
call fcn.10020800
mov al, byte [edi + 0x48]
test al, al
je 0x100cc8a7
push dword [ebp - 0x678]
mov ecx, edi
call fcn.100201d0
mov al, byte [edi + 0x48]
test al, al
je 0x100cc8a7
mov edx, str._err_
mov ecx, edi
call fcn.10020800
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [edi + 0x48], 0
je 0x100cc8bb
push eax
mov ecx, edi
call fcn.100201d0
lea ecx, [ebp - 0x748]
call fcn.1000ad70
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 1
test esi, esi
je 0x100cc8de
push esi
call fcn.1011582b
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 0x688]
push 0x228
lea eax, [ebp - 0x67c]
push 0
push eax
call fcn.10117ff0
add esp, 0xc
mov dword [ebp - 0x680], 0x22c
lea eax, [ebp - 0x680]
push eax
push dword [ebp - 0x68c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100cc700
call edi
mov esi, eax
test esi, esi
je 0x100cc700
cmp esi, 0x12
je 0x100cca24
mov eax, dword [0x1019ed44]
add eax, dword [0x1019ed48]
je 0x100cca11
push ecx
lea ecx, [ebp - 0x1c]
call fcn.10010f30
mov byte [ebp - 4], 0xb
mov ebx, 0xc
mov ecx, eax
mov dword [ebp - 0x684], ebx
call fcn.10010ee0
push esi
push str.Process32Next_error_0x_x
push str.GetLoginInstance
push 0x10000000
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x10
push ecx
push 0
push eax
call fcn.1000ab20
add esp, 0x1c
jmp 0x100cca17
push str.GetLoginInstance
mov edx, 8
lea ecx, [ebp - 0x748]
call fcn.1000aed0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0xa
mov al, byte [esi + 0x48]
test al, al
je 0x100cc9ed
mov edx, str.OpenProcess_failed_for_pid_
mov ecx, esi
call fcn.10020800
mov al, byte [esi + 0x48]
test al, al
je 0x100cc9ed
push dword [ebp - 0x678]
mov ecx, esi
call fcn.100201d0
mov al, byte [esi + 0x48]
test al, al
je 0x100cc9ed
mov edx, str._err_
mov ecx, esi
call fcn.10020800
call edi
cmp byte [esi + 0x48], 0
je 0x100cc9fd
push eax
mov ecx, esi
call fcn.100201d0
lea ecx, [ebp - 0x748]
mov byte [ebp - 4], 1
call fcn.1000ad70
jmp 0x100cc8e4
mov ebx, dword [ebp - 0x684]
test bl, 4
je 0x100cca24
lea ecx, [ebp - 0x1c]
call fcn.10010f00
push dword [ebp - 0x68c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
lea ecx, [ebp - 0x34]
call fcn.10002400
lea ecx, [ebp - 0x450]
call fcn.1000ac70
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101157bc
mov esp, ebp
pop ebp
ret