Function at 0x100522c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e3703
mov eax, dword fs:[0]
push eax
sub esp, 0x2fc
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x2e8], eax
mov eax, dword [ecx]
push 2
mov dword [ebp - 0x2ec], ecx
mov dword [ebp - 0x2c4], ebx
mov dword [ecx + 4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x2fc], edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
test edi, edi
je 0x10052bfd
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x2b4], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10052bfd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x2ac]
cmp ecx, eax
je 0x100523fc
test ecx, ecx
je 0x100523fc
cmp ecx, 4
je 0x100523fc
push ecx
push 0
push 0x410
call fcn.100d080e
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x2d0], esi
mov byte [ebp - 4], 1
test esi, esi
jne 0x1005239d
mov byte [ebp - 4], al
jmp 0x100523fc
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0
push eax
push esi
mov dword [ebp - 0x2e4], 0
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x100523ed
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x100523ed
cmp dword [ebp - 0x2e4], 0
je 0x1005241e
cmp dword [ebp - 0x2dc], 0
jne 0x10052427
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0
call fcn.10032a20
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x2b4]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10052353
mov bl, 1
jmp 0x10052bff
cmp dword [ebp - 0x2dc], 0
jne 0x100523ed
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], 0
push 0
push eax
call fcn.100dd9d6
push 0x104
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.100ca740
add esp, 0x18
test al, al
je 0x10052476
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x290]
push 0x104
push eax
call dword [0x100ef38c]
add esp, 0xc
mov ecx, dword [ebp - 0x2ec]
lea eax, [ebp - 0x2b4]
push eax
call fcn.10054b30
push dword [ebp - 0x2ac]
push dword [ebp - 0x2e8]
call fcn.10051f20
add esp, 8
test al, al
jne 0x100524d5
push 0x100efbd8
lea ecx, [ebp - 0x12c]
call fcn.10005540
mov ecx, dword [ebp - 0x2e8]
lea eax, [ebp - 0x12c]
push eax
mov byte [ebp - 4], 2
call fcn.1003d660
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.1006b340
push esi
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2b8], 0
push eax
lea eax, [ebp - 0x2b8]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x2d8], xmm0
call fcn.10051bb0
add esp, 0xc
test al, al
jne 0x10052541
push dword [ebp - 0x2d4]
lea eax, [ebp - 0x12c]
push dword [ebp - 0x2d8]
push str.ARG_GET_ERROR:_d:_p
push eax
call fcn.1009f310
add esp, 0x10
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.1003d660
lea ecx, [ebp - 0x12c]
call fcn.1006b340
jmp 0x10052bbe
mov ebx, dword [ebp - 0x2b8]
lea eax, [ebp - 0x308]
push ebx
push eax
call fcn.10054400
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x2e0], eax
lea eax, [ebp - 0x290]
push eax
push ebx
movq qword [ebp - 0x2f8], xmm0
call dword [0x100ef3a8]
add esp, 0x10
test eax, eax
je 0x1005259b
lea edx, [ebp - 0x290]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10052587
sub edx, ecx
mov dword [ebp - 0x2c8], edx
jmp 0x100528a3
mov ebx, dword [0x100ef3a4]
xor eax, eax
mov dword [ebp - 0x2c8], eax
lea eax, [ebp - 0x290]
push 0x5c
push eax
call ebx
add esp, 8
test eax, eax
lea eax, [ebp - 0x290]
je 0x100525ce
push 0x5c
push eax
call ebx
add esp, 8
lea ebx, [eax + 1]
jmp 0x100525f3
push 0x2f
push eax
call ebx
add esp, 8
test eax, eax
je 0x100525ed
lea eax, [ebp - 0x290]
push 0x2f
push eax
call ebx
add esp, 8
lea ebx, [eax + 1]
jmp 0x100525f3
lea ebx, [ebp - 0x290]
mov ecx, ebx
mov dword [ebp - 0x2c0], ebx
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10052600
push ebx
push dword [ebp - 0x2b8]
sub ecx, edx
mov dword [ebp - 0x2bc], ecx
call dword [0x100ef3a8]
add esp, 8
mov dword [ebp - 0x2d4], eax
mov ebx, eax
test eax, eax
je 0x10052701
nop
mov ecx, dword [ebp - 0x2bc]
push dword [ebp - 0x2c0]
add ecx, ebx
push ecx
call dword [0x100ef3a8]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x100526dc
push 0x5c
push ebx
call dword [0x100ef3d0]
add esp, 8
test eax, eax
je 0x10052675
push 0x5c
push ebx
call dword [0x100ef3d0]
mov ecx, eax
mov dword [ebp - 0x2cc], ecx
jmp 0x10052696
push 0x2f
push ebx
call dword [0x100ef3d0]
add esp, 8
test eax, eax
je 0x100526e2
push 0x2f
push ebx
call dword [0x100ef3d0]
mov ecx, eax
mov dword [ebp - 0x2cc], eax
add esp, 8
test ecx, ecx
je 0x100526e2
mov eax, dword [ebp - 0x2f8]
test eax, eax
jne 0x100526c1
push 0x20
push ebx
call dword [0x100ef3d0]
add esp, 8
cmp eax, dword [ebp - 0x2cc]
jae 0x10052630
jmp 0x100526e2
cmp eax, 1
jne 0x100526e2
mov eax, dword [ebp - 0x2b8]
add eax, dword [ebp - 0x2e0]
cmp eax, ecx
jae 0x10052630
jmp 0x100526e2
mov ebx, dword [ebp - 0x2d4]
test ebx, ebx
je 0x10052701
mov edx, ebx
mov ebx, dword [ebp - 0x2b8]
sub edx, ebx
add edx, dword [ebp - 0x2bc]
mov dword [ebp - 0x2c8], edx
jmp 0x100528a3
mov ebx, dword [ebp - 0x2c0]
lea ecx, [ebx + 1]
lea ebx, [ebx]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x10052710
sub ebx, ecx
inc ebx
push str.dbglistprocesses:basicName
push ebx
call fcn.100cac00
push ebx
push 0
push eax
mov dword [ebp - 0x2cc], eax
call fcn.100dd9d6
mov ebx, dword [ebp - 0x2c0]
add esp, 0x14
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10052742
sub ecx, edx
push 0xffffffffffffffff
push ebx
mov ebx, dword [ebp - 0x2cc]
lea eax, [ecx + 1]
push eax
push ebx
call dword [0x100ef3a0]
push 0x2e
push ebx
call dword [0x100ef3a4]
add esp, 0x18
test eax, eax
je 0x10052772
mov byte [eax], 0
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10052777
push ebx
push dword [ebp - 0x2b8]
sub ecx, edx
mov dword [ebp - 0x2c0], ecx
call dword [0x100ef3a8]
add esp, 8
mov dword [ebp - 0x2d4], eax
mov ebx, eax
test eax, eax
je 0x1005287c
jmp 0x100527b0
mov ecx, dword [ebp - 0x2c0]
push dword [ebp - 0x2cc]
add ecx, ebx
push ecx
call dword [0x100ef3a8]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1005285c
push 0x5c
push ebx
call dword [0x100ef3d0]
add esp, 8
test eax, eax
je 0x100527f5
push 0x5c
push ebx
call dword [0x100ef3d0]
mov ecx, eax
mov dword [ebp - 0x2bc], ecx
jmp 0x10052816
push 0x2f
push ebx
call dword [0x100ef3d0]
add esp, 8
test eax, eax
je 0x10052862
push 0x2f
push ebx
call dword [0x100ef3d0]
mov ecx, eax
mov dword [ebp - 0x2bc], eax
add esp, 8
test ecx, ecx
je 0x10052862
mov eax, dword [ebp - 0x2f8]
test eax, eax
jne 0x10052841
push 0x20
push ebx
call dword [0x100ef3d0]
add esp, 8
cmp eax, dword [ebp - 0x2bc]
jae 0x100527b0
jmp 0x10052862
cmp eax, 1
jne 0x10052862
mov eax, dword [ebp - 0x2b8]
add eax, dword [ebp - 0x2e0]
cmp eax, ecx
jae 0x100527b0
jmp 0x10052862
mov ebx, dword [ebp - 0x2d4]
test ebx, ebx
je 0x1005287c
mov edx, dword [ebp - 0x2c0]
sub edx, dword [ebp - 0x2b8]
add edx, ebx
mov dword [ebp - 0x2c8], edx
jmp 0x10052882
mov edx, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x2cc]
test eax, eax
je 0x1005289d
push 0
push eax
call fcn.100cacb0
mov edx, dword [ebp - 0x2c8]
add esp, 8
mov ebx, dword [ebp - 0x2b8]
mov eax, dword [ebp - 0x2f8]
cmp eax, 3
ja case.default.0x100528b2
jmp dword [eax*4 + 0x10052c4c]
inc edx
mov dword [ebp - 0x130], 0xf
add edx, ebx
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
cmp byte [edx], 0
jne 0x100528e0
xor ecx, ecx
jmp 0x100528ee
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100528e5
sub ecx, ebx
push ecx
push edx
lea ecx, [ebp - 0x144]
call fcn.10005f10
mov ecx, dword [ebp - 0x2c4]
lea eax, [ebp - 0x144]
push eax
mov byte [ebp - 4], 4
call fcn.1003d660
cmp dword [ebp - 0x130], 0x10
mov byte [ebp - 4], 1
jb case.default.0x100528b2
push dword [ebp - 0x144]
jmp 0x10052b1f
mov eax, dword [ebp - 0x2e0]
test eax, eax
jne 0x100529a8
add edx, ebx
mov dword [ebp - 0x178], 0xf
mov dword [ebp - 0x17c], eax
mov byte [ebp - 0x18c], al
cmp byte [edx], al
jne 0x10052957
xor ecx, ecx
jmp 0x10052969
mov ecx, edx
lea ebx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10052960
sub ecx, ebx
push ecx
push edx
lea ecx, [ebp - 0x18c]
call fcn.10005f10
mov ecx, dword [ebp - 0x2c4]
lea eax, [ebp - 0x18c]
push eax
mov byte [ebp - 4], 5
call fcn.1003d660
cmp dword [ebp - 0x178], 0x10
mov byte [ebp - 4], 1
jb case.default.0x100528b2
push dword [ebp - 0x18c]
jmp 0x10052b1f
inc eax
mov dword [ebp - 0x148], 0xf
cmp edx, eax
mov dword [ebp - 0x14c], 0
mov byte [ebp - 0x15c], 0
cmova eax, edx
cmp byte [eax + ebx], 0
lea edx, [eax + ebx]
jne 0x100529d6
xor ecx, ecx
jmp 0x100529e9
mov ecx, edx
lea ebx, [ecx + 1]
jmp 0x100529e0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100529e0
sub ecx, ebx
push ecx
push edx
lea ecx, [ebp - 0x15c]
call fcn.10005f10
mov ecx, dword [ebp - 0x2c4]
lea eax, [ebp - 0x15c]
push eax
mov byte [ebp - 4], 6
call fcn.1003d660
cmp dword [ebp - 0x148], 0x10
mov byte [ebp - 4], 1
jb case.default.0x100528b2
push dword [ebp - 0x15c]
jmp 0x10052b1f
add edx, 2
mov dword [ebp - 0x160], 0xf
add edx, ebx
mov dword [ebp - 0x164], 0
mov byte [ebp - 0x174], 0
cmp byte [edx], 0
jne 0x10052a51
xor ecx, ecx
jmp 0x10052a5f
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10052a56
sub ecx, ebx
push ecx
push edx
lea ecx, [ebp - 0x174]
call fcn.10005f10
mov ecx, dword [ebp - 0x2c4]
lea eax, [ebp - 0x174]
push eax
mov byte [ebp - 4], 7
call fcn.1003d660
cmp dword [ebp - 0x160], 0x10
mov byte [ebp - 4], 1
jb case.default.0x100528b2
push dword [ebp - 0x174]
jmp 0x10052b1f
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10052aa3
sub ecx, edx
mov edx, dword [ebp - 0x2c8]
inc edx
add edx, ebx
mov byte [ecx + ebx - 1], al
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], al
cmp byte [edx], al
jne 0x10052adb
xor ecx, ecx
jmp 0x10052ae9
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10052ae0
sub ecx, ebx
push ecx
push edx
lea ecx, [ebp - 0x12c]
call fcn.10005f10
mov ecx, dword [ebp - 0x2c4]
lea eax, [ebp - 0x12c]
push eax
mov byte [ebp - 4], 8
call fcn.1003d660
cmp dword [ebp - 0x118], 0x10
mov byte [ebp - 4], 1
jb case.default.0x100528b2
push dword [ebp - 0x12c]
call fcn.100dd8b4
add esp, 4
mov ecx, dword [ebp - 0x2c4]
mov eax, dword [ecx + 4]
cmp dword [ecx], eax
je 0x10052ba8
add eax, 0xffffffe8
push 0x101a0838
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.1009e6c0
mov ecx, dword [ebp - 0x2c4]
add esp, 0xc
mov dword [ebp - 0x2d4], eax
mov ebx, dword [ecx + 4]
add ebx, 0xffffffe8
cmp ebx, eax
je 0x10052b91
cmp dword [ebx + 0x14], 0x10
jb 0x10052b78
push dword [ebx]
call fcn.100dd8b4
mov eax, dword [ebp - 0x2d4]
add esp, 4
mov dword [ebx + 0x14], 0xf
mov ecx, ebx
mov dword [ebx + 0x10], 0
push eax
mov byte [ebx], 0
call fcn.10008120
cmp dword [ebp - 0x118], 0x10
jb 0x10052ba8
push dword [ebp - 0x12c]
call fcn.100dd8b4
add esp, 4
push 0
push dword [ebp - 0x2b8]
call fcn.100cacb0
mov ebx, dword [ebp - 0x2c4]
add esp, 8
lea eax, [ebp - 0x2bc]
mov byte [ebp - 4], 0
push eax
push esi
mov dword [ebp - 0x2bc], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100523fc
test byte [ebp - 0x2bc], 2
jne 0x100523fc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x10052402
xor bl, bl
test edi, edi
je 0x10052c2b
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d0], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10052c2b
test byte [ebp - 0x2d0], 2
jne 0x10052c2b
push edi
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret