Function at 0x100c3420
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011a59d
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x1014a524]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0x170], 0
call fcn.1000d600
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 0
cmp eax, 4
jb 0x100c357b
lea ecx, [eax - 4]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0xf
cmp eax, ecx
jb 0x100c3719
sub eax, ecx
mov edi, 4
cmp eax, edi
cmovb edi, eax
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
add eax, ecx
mov dword [ebp - 0x174], eax
cmp edi, 0xf
ja 0x100c34d2
push edi
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], edi
push eax
call fcn.100e3330
mov byte [ebp + edi - 0x28], 0
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x28]
jmp 0x100c3524
cmp edi, 0x7fffffff
ja 0x100c371e
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x100c34f2
mov esi, 0x7fffffff
jmp 0x100c34fc
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x28]
call fcn.10013220
push edi
push dword [ebp - 0x174]
mov ebx, eax
mov dword [ebp - 0x18], edi
push ebx
mov dword [ebp - 0x14], esi
call fcn.100e3330
mov byte [ebx + edi], 0
mov dword [ebp - 0x28], ebx
add esp, 0xc
mov dword [ebp - 0x170], 3
cmp esi, 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, ebx
cmp edi, 4
jne 0x100c3581
mov eax, dword [ecx]
mov edx, 0x10126e60
cmp eax, dword [edx]
je 0x100c3566
cmp al, byte [edx]
jne 0x100c356a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100c356a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100c356a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x100c356a
xor eax, eax
jmp 0x100c356f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100c3581
mov byte [ebp - 0x169], al
jmp 0x100c3588
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
mov byte [ebp - 0x169], 1
test byte [ebp - 0x170], 1
je 0x100c35bf
cmp esi, 0x10
jb 0x100c35bf
inc esi
mov eax, ebx
cmp esi, 0x1000
jb 0x100c35b5
mov ebx, dword [ebx - 4]
add esi, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c3723
push esi
push ebx
call fcn.100e1499
add esp, 8
cmp byte [ebp - 0x169], 0
je 0x100c35d7
push 4
push 0x10126e60
lea ecx, [ebp - 0x40]
call fcn.10013460
mov edi, dword [ebp - 0x40]
push 0
push 2
mov dword [ebp - 0x168], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x100c36ca
lea eax, [ebp - 0x168]
push eax
push esi
call sub.KERNEL32.dll_Process32First
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
mov ebx, eax
lea edx, [ebp - 0x144]
cmovae ecx, edi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100c3644
test al, al
je 0x100c3640
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100c3644
add ecx, 2
add edx, 2
test al, al
jne 0x100c3624
xor eax, eax
jmp 0x100c3649
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100c3660
cmp ebx, dword [ebp - 0x160]
je 0x100c3660
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x100c36cc
lea eax, [ebp - 0x168]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x100c36c3
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x144]
cmovae eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100c36a1
test dl, dl
je 0x100c369d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100c36a1
add eax, 2
add ecx, 2
test dl, dl
jne 0x100c3681
xor eax, eax
jmp 0x100c36a6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100c36b2
cmp ebx, dword [ebp - 0x160]
jne 0x100c3655
lea eax, [ebp - 0x168]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100c3671
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x100c36fb
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x100c36f1
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c3723
push ecx
push edi
call fcn.100e1499
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e14ac
mov esp, ebp
pop ebp
ret
call fcn.10013210
call fcn.100131f0
call fcn.100ecb47
int3