Function at 0x10009c00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
test eax, eax
je 0x10009b1f
jne 0x10009b1e
call 0x93048ba6
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
add byte [ebx + edi*8 - 8], dh
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10009b2d
jmp 0x10009b2f
je 0x10009b2a
clc
jae 0x10009b34
jae 0x10009b34
xor eax, 0x49
xor edx, eax
add eax, edx
sub edx, 0x49
push eax
pop edx
xor edx, 0xdb
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x49
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
pushf
push 0xa
jae 0x10009b77
jmp 0x10009b72
call 0x10009b79
jae 0x10009b72
add esp, 4
jmp 0x10009b7e
dec dword [esp]
jno 0x10009b83
jns 0x10009b6e
jp 0x10009b87
add esp, 4
popf
jmp 0x10009b8e
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10009ba7
jne 0x10009ba7
call 0x1fc0cefb
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov dword [ebp - 0x130], 0
push 0x128
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.1004f110
add esp, 0xc
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x12c], 0x128
clc
jae 0x10009bf1
outsb dx, byte [esi]
pop eax
pushf
push 0xa
jae 0x10009bfe
jmp 0x10009bf9
call 0x10009c00
jae 0x10009bf9
add esp, 4
jmp 0x10009c05
dec dword [esp]
jno 0x10009c0a
jns 0x10009bf5
jp 0x10009c0e
add esp, 4
popf
jmp 0x10009c15
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
xor eax, 0x4f
xor edx, eax
add eax, edx
sub edx, 0x4f
push eax
pop edx
xor edx, 0xed
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x4f
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
jl 0x10009c64
jmp 0x10009c66
je 0x10009c61
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10009c80
jne 0x10009c7f
call 0x93048d07
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10009c8e
jne 0x10009c8e
call 0x126a9cfc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x130]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10009ce4
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp + 8]
jne 0x10009ccd
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0x134], ecx
jmp 0x10009ce4
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x130]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10009cb4
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test eax, eax
je 0x10009cfa
jne 0x10009cf9
call 0x93048d81
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
and dword [ebx + edi*8 - 8], esi
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10009d08
jmp 0x10009d0a
je 0x10009d05
clc
jae 0x10009d0f
das
and dword [ebx - 0x2fcca310], eax
xor eax, 0x5c
xor edx, eax
add eax, edx
sub edx, 0x5c
push eax
pop edx
xor edx, 0x114
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x5c
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
pushf
push 0xa
jae 0x10009d52
jmp 0x10009d4d
call 0x10009d54
jae 0x10009d4d
add esp, 4
jmp 0x10009d59
dec dword [esp]
jno 0x10009d5e
jns 0x10009d49
jp 0x10009d62
add esp, 4
popf
jmp 0x10009d69
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10009d82
jne 0x10009d82
call 0x1fc0d0d6
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword [ebp - 0x134]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret