Function at 0x10001655
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
push 0xc
call fcn.10008bed
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 0x28
call fcn.10008bed
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
add ebx, 0x24
push ebx
push 0x108
call fcn.10008bed
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x100222a9
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], esp
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop
nop
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001712
push 6
call fcn.10008bf3
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x10001c05
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
push 0x80000301
push 0
push 0x400
push 1
mov ebx, 0x184
call fcn.10009480
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10001762
push ebx
call fcn.10008c05
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 4]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001792
push 6
call fcn.10008bf3
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], esp
push 0x400
push dword [ebp - 0xc]
push 0
push dword [ebp - 0x24]
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
nop
nop
nop
nop
cmp dword [ebp - 0x28], esp
je 0x100017c4
push 6
call fcn.10008bf3
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10001858
mov ebx, dword [ebp - 8]
add ebx, 8
mov dword [ebp - 0x20], ebx
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x100017ed
mov eax, 0x100222a8
push eax
push 1
mov ebx, 0x174
call fcn.100094b0
add esp, 0x10
mov dword [ebp - 0x24], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x10001816
mov eax, 0x100222a8
push eax
push 1
mov ebx, 0x168
call fcn.100095b0
add esp, 0x10
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x1000183c
push ebx
call fcn.10008c05
add esp, 4
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 0x20]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10001852
push ebx
call fcn.10008c05
add esp, 4
pop eax
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov dword [ebp - 0x20], esp
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
nop
nop
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001881
push 6
call fcn.10008bf3
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10001c05
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 0x128
mov dword [ebp - 0x20], esp
mov eax, dword [ebp - 0x18]
push eax
push 0x124
call fcn.10008bed
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop ebx
add ebx, 4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_Process32First]
nop
nop
nop
nop
cmp dword [ebp - 0x20], esp
je 0x1000194a
push 6
call fcn.10008bf3
add esp, 4
push eax
mov ebx, dword [ebp - 0x24]
push ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
push edi
push 1
mov eax, 2
call fcn.10009280
add esp, 4
pop edi
pop ebx
push ebx
push edi
mov edi, dword [edi]
mov ecx, dword [edi]
add edi, 4
test ecx, ecx
je 0x100019db
mov eax, dword [edi]
add edi, 4
dec ecx
je 0x100019d9
imul eax, dword [edi]
jmp 0x100019ce
mov ecx, eax
cmp ecx, 0x100
jle 0x100019e8
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop ebx
add edi, 4
add ebx, 0x100
call fcn.10008c05
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10001be3
mov ebx, dword [ebp - 0x18]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x20]
cmp dword [ebx], eax
jne 0x10001a78
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x18]
add ebx, 0x24
mov dword [ebp - 0x24], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x24]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100095b0
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 0x20]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10001a6d
push ebx
call fcn.10008c05
add esp, 4
pop eax
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
jmp 0x10001be3
mov dword [ebp - 0x20], esp
mov eax, dword [ebp - 0x18]
push eax
push 0x124
call fcn.10008bed
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop ebx
add ebx, 4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_Process32Next]
nop
nop
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001b25
push 6
call fcn.10008bf3
add esp, 4
push eax
mov ebx, dword [ebp - 0x24]
push ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
push edi
push 1
mov eax, 2
call fcn.10009280
add esp, 4
pop edi
pop ebx
push ebx
push edi
mov edi, dword [edi]
mov ecx, dword [edi]
add edi, 4
test ecx, ecx
je 0x10001bb6
mov eax, dword [edi]
add edi, 4
dec ecx
je 0x10001bb4
imul eax, dword [edi]
jmp 0x10001ba9
mov ecx, eax
cmp ecx, 0x100
jle 0x10001bc3
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop ebx
add edi, 4
add ebx, 0x100
call fcn.10008c05
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
jmp 0x10001a03
mov dword [ebp - 0x20], esp
push dword [ebp - 0x14]
call dword [0x10022be4]
nop
nop
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001c05
push 6
call fcn.10008bf3
add esp, 4
mov eax, dword [ebp - 8]
push eax
push 0xc
call fcn.10008bed
add esp, 4
pop esi
mov edi, eax
push eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x10001c38
push eax
mov ebx, eax
call fcn.10001378
inc eax
push eax
call fcn.10008bed
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x10001c57
push eax
mov ebx, eax
call fcn.10001378
inc eax
push eax
call fcn.10008bed
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
pop eax
jmp 0x10001c60
push eax
mov ebx, dword [ebp - 8]
push ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x10001c78
push ebx
call fcn.10008c05
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x10001c8c
push ebx
call fcn.10008c05
add esp, 4
pop ebx
call fcn.10008c05
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10001ca5
push ebx
call fcn.10008c05
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
add ebx, 0x24
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.10008c05
add esp, 4
pop ebx
call fcn.10008c05
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4