Function at 0x10023820
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059c0d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c8
mov eax, dword [0x100764f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3c4], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x12c]
push eax
call fcn.100152a0
mov edi, eax
add esp, 4
lea eax, [esi + 8]
cmp eax, edi
je 0x100238ad
mov ecx, eax
call fcn.10003f80
movups xmm0, xmmword [edi]
movups xmmword [esi + 8], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x18], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x100238e7
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100238dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10024386
push edx
push ecx
call fcn.1003465a
add esp, 8
lea eax, [ebp - 0x12c]
push eax
call fcn.10004a70
mov edi, eax
add esp, 4
lea eax, [esi + 0x20]
cmp eax, edi
je 0x10023928
mov ecx, eax
call fcn.10003f80
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x20], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x30], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10023962
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10023958
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002438b
push edx
push ecx
call fcn.1003465a
add esp, 8
lea eax, [ebp - 0x12c]
push eax
call fcn.100091e0
mov edi, eax
add esp, 4
lea eax, [esi + 0x38]
cmp eax, edi
je 0x100239a3
mov ecx, eax
call fcn.10003f80
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x38], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x48], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x100239dd
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100239d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10024390
push edx
push ecx
call fcn.1003465a
add esp, 8
lea eax, [ebp - 0x12c]
push eax
call fcn.10004c80
mov edi, eax
add esp, 4
lea eax, [esi + 0x50]
cmp eax, edi
je 0x10023a1e
mov ecx, eax
call fcn.10003f80
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x50], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x60], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10023a58
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10023a4e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10024395
push edx
push ecx
call fcn.1003465a
add esp, 8
lea eax, [ebp - 0x12c]
push eax
call fcn.100094e0
mov edi, eax
add esp, 4
lea eax, [esi + 0x68]
cmp eax, edi
je 0x10023a99
mov ecx, eax
call fcn.10003f80
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x68], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x78], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10023ad3
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10023ac9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002439a
push edx
push ecx
call fcn.1003465a
add esp, 8
lea eax, [ebp - 0x12c]
push eax
call fcn.10009050
mov edi, eax
add esp, 4
lea eax, [esi + 0x80]
cmp eax, edi
je 0x10023b1d
mov ecx, eax
call fcn.10003f80
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x80], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x90], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10023b57
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10023b4d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002439f
push edx
push ecx
call fcn.1003465a
add esp, 8
lea eax, [esi + 0x1d0]
lea ecx, [esi + 0x98]
cmp ecx, eax
je 0x10023b7a
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x10023b71
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.10006e60
lea eax, [esi + 0xb4]
mov byte [esi + 0xb0], 1
push eax
call fcn.10014930
mov edx, dword [0x10076008]
add esp, 4
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023ba0
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0xcc]
call fcn.10006e60
xor eax, eax
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 7
mov word [ebp - 0x18c], ax
lea eax, [ebp - 0x18c]
mov byte [ebp - 4], 1
push eax
push 0x1005f52c
push dword [0x10076010]
push SysReAllocString
call fcn.100156a0
add esp, 0x10
test eax, eax
je 0x10023c42
cmp dword [ebp - 0x178], 8
lea eax, [ebp - 0x18c]
lea ecx, [ebp - 0x3cc]
cmovae eax, dword [ebp - 0x18c]
push eax
call fcn.10008440
mov edx, eax
lea edi, [edx + 1]
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10023c20
sub edx, edi
lea ecx, [esi + 0xe4]
push edx
push eax
call fcn.10006e60
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x3c0], eax
mov word [esi + 0xfc], 0
mov edx, dword [str.1.0.0]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023c56
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x100]
call fcn.10006e60
call fcn.10015f80
test eax, eax
setne al
mov byte [esi + 0x118], al
call fcn.10015e70
test eax, eax
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 7
setne al
mov byte [esi + 0x119], al
xor eax, eax
mov word [ebp - 0x174], ax
lea eax, [ebp - 0x174]
mov byte [ebp - 4], 2
push eax
call fcn.10015aa0
cmp dword [ebp - 0x160], 8
lea eax, [ebp - 0x174]
cmovae eax, dword [ebp - 0x174]
push eax
call fcn.1003ef3f
mov dword [esi + 0x11c], eax
xor eax, eax
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 7
mov word [ebp - 0x15c], ax
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 3
push eax
push 0x1005ea44
push str.PowerPoint.ApplicationCurVer
push SysReAllocString
call fcn.100156a0
add esp, 0x18
test eax, eax
je 0x10023d72
cmp dword [ebp - 0x14c], 0
jbe 0x10023d72
cmp dword [ebp - 0x148], 8
lea eax, [ebp - 0x15c]
lea ecx, [ebp - 0x3cc]
cmovae eax, dword [ebp - 0x15c]
push eax
call fcn.10008440
mov edx, eax
lea edi, [edx + 1]
nop word [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10023d50
sub edx, edi
lea ecx, [esi + 0x120]
push edx
push eax
call fcn.10006e60
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x3c0], eax
call fcn.10004a10
test eax, eax
je 0x10023da9
push 0
mov dword [esi + 0x138], eax
call fcn.1003a073
mov ecx, eax
mov dword [ebp - 0x3d0], edx
sub ecx, dword [esi + 0x138]
mov eax, 0xc22e4507
mul ecx
add esp, 4
shr edx, 0x10
mov dword [esi + 0x13c], edx
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.10037070
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10023ea0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x12c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023e00
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.10006e60
push 1
push 1
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 4
push 0x1005f578
push eax
call fcn.10016eb0
lea ecx, [esi + 0x140]
add esp, 0x10
lea eax, [ebp - 0x12c]
cmp ecx, eax
je 0x10023e62
cmp dword [ebp - 0x118], 0x10
push dword [ebp - 0x11c]
cmovae eax, dword [ebp - 0x12c]
push eax
call fcn.10006e60
mov edx, dword [ebp - 0x118]
mov byte [ebp - 4], 3
cmp edx, 0x10
jb 0x10023ea0
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10023e96
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100243a4
push edx
push ecx
call fcn.1003465a
add esp, 8
mov ecx, esi
call fcn.100243d0
mov dword [esi + 0x158], eax
call fcn.10004a40
mov dword [esi + 0x15c], eax
xor eax, eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 7
mov word [ebp - 0x144], ax
lea eax, [ebp - 0x144]
mov byte [ebp - 4], 5
push eax
push 0x1005f57c
push dword [0x10076010]
push SysReAllocString
call fcn.100156a0
add esp, 0x10
test eax, eax
je 0x10023f2b
mov edx, dword [ebp - 0x134]
test edx, edx
je 0x10023f2b
lea ecx, [esi + 0x160]
lea eax, [ebp - 0x144]
cmp ecx, eax
je 0x10023f2b
cmp dword [ebp - 0x130], 8
push edx
cmovae eax, dword [ebp - 0x144]
push eax
call fcn.10006f50
lea eax, [ebp - 0x3bc]
mov dword [ebp - 0x3bc], 0
push eax
push str.aidtasktm
push dword [0x10076010]
push SysReAllocString
call fcn.10015420
add esp, 0x10
test eax, eax
je 0x10023f80
mov eax, dword [ebp - 0x3bc]
push 0
mov dword [esi + 0x178], eax
call fcn.1003a073
add esp, 4
mov dword [ebp - 0x3d0], edx
sub eax, dword [ebp - 0x3bc]
mov dword [esi + 0x17c], eax
lea eax, [ebp - 0x3bc]
push eax
push str.LoadBehavior
push str.SoftwareMicrosoftOfficePowerPointAddinsOfficeTeamAddin.Connect
push SysReAllocString
call fcn.10015420
add esp, 0x10
test eax, eax
je 0x10023fb2
cmp dword [ebp - 0x3bc], 3
sete al
mov byte [esi + 0x180], al
call fcn.10015de0
test eax, eax
setne al
mov byte [esi + 0x194], al
lea eax, [ebp - 0x144]
push eax
push str.Version
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Client
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.100156a0
add esp, 0x10
test eax, eax
je 0x1002400e
lea ecx, [esi + 0x198]
lea eax, [ebp - 0x144]
cmp ecx, eax
je 0x1002400e
cmp dword [ebp - 0x130], 8
push dword [ebp - 0x134]
cmovae eax, dword [ebp - 0x144]
push eax
call fcn.10006f50
lea edi, [esi + 0x1e8]
push edi
push dword [edi + 4]
push dword [edi]
call fcn.1001c760
mov eax, dword [edi]
push 0x228
mov dword [edi + 4], eax
lea eax, [ebp - 0x3b4]
push 0
push eax
call fcn.10037070
add esp, 0x18
mov dword [ebp - 0x3b8], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x3d0], eax
test eax, eax
je 0x10024168
lea ecx, [ebp - 0x3b8]
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x11c], 0
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x118], 7
mov word [ebp - 0x12c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10024096
sub ecx, edx
lea eax, [ebp - 0x394]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.10006f50
mov eax, dword [edi + 4]
mov byte [ebp - 4], 6
cmp dword [edi + 8], eax
je 0x100240ef
movups xmm0, xmmword [ebp - 0x12c]
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov word [ebp - 0x12c], ax
jmp 0x10024104
lea ecx, [ebp - 0x12c]
push ecx
push eax
mov ecx, edi
call fcn.1001c7d0
mov edx, dword [ebp - 0x118]
mov byte [ebp - 4], 5
cmp edx, 8
jb 0x10024142
mov ecx, dword [ebp - 0x12c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10024138
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10024386
push edx
push ecx
call fcn.1003465a
add esp, 8
lea eax, [ebp - 0x3b8]
push eax
push dword [ebp - 0x3d0]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10024070
push dword [ebp - 0x3d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.1001d4b0
cmp dword [esi + 0x200], 0
mov eax, dword [esi + 0x204]
mov edx, dword [ebp - 0x130]
mov dword [esi + 0x1b0], eax
setne al
mov dword [esi + 0x1b4], 0
mov byte [esi + 0x1b8], al
cmp edx, 8
jb 0x100241d5
mov ecx, dword [ebp - 0x144]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100241cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100243a9
push edx
push ecx
call fcn.1003465a
add esp, 8
mov edx, dword [ebp - 0x148]
xor eax, eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 7
mov word [ebp - 0x144], ax
cmp edx, 8
jb 0x10024232
mov ecx, dword [ebp - 0x15c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10024228
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100243ae
push edx
push ecx
call fcn.1003465a
add esp, 8
mov edx, dword [ebp - 0x160]
xor eax, eax
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 7
mov word [ebp - 0x15c], ax
cmp edx, 8
jb 0x1002428f
mov ecx, dword [ebp - 0x174]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10024285
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100243b3
push edx
push ecx
call fcn.1003465a
add esp, 8
mov edx, dword [ebp - 0x178]
xor eax, eax
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 7
mov word [ebp - 0x174], ax
cmp edx, 8
jb 0x100242ec
mov ecx, dword [ebp - 0x18c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100242e2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100243b8
push edx
push ecx
call fcn.1003465a
add esp, 8
mov edi, dword [ebp - 0x3c8]
xor eax, eax
mov edx, dword [ebp - 0x3c0]
xor esi, esi
sub edi, edx
mov dword [ebp - 0x17c], 0
sar edi, 2
mov dword [ebp - 0x178], 7
mov word [ebp - 0x18c], ax
test edi, edi
je 0x10024336
push dword [edx + esi*4]
call fcn.10034671
mov edx, dword [ebp - 0x3c0]
inc esi
add esp, 4
cmp esi, edi
jb 0x10024320
test edx, edx
je 0x10024369
mov ecx, dword [ebp - 0x3c4]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x1002435f
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100243bd
push ecx
push edx
call fcn.1003465a
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10034676
mov esp, ebp
pop ebp
ret
call fcn.10039dac
call fcn.10039dac
call fcn.10039dac
call fcn.10039dac
call fcn.10039dac
call fcn.10039dac
call fcn.10039dac
call fcn.10039dac
call fcn.10039dac
call fcn.10039dac
call fcn.10039dac
call fcn.10039dac
int3