Function at 0x5d38ef
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
je 0x5d37eb
jne 0x5d37eb
aaa
jl 0x5d37f0
jmp 0x5d37f2
je 0x5d37ed
pushf
push 0xa
jae 0x5d37ff
jmp 0x5d37fa
call 0x5d3801
jae 0x5d37fa
add esp, 4
jmp 0x5d3806
dec dword [esp]
jno 0x5d380b
jns 0x5d37f6
jp 0x5d380f
add esp, 4
popf
jmp 0x5d3816
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d382f
div dword [edi]
je 0x5d3834
jne 0x5d3834
call 0x101d6b88
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d384e
jne 0x5d384d
call 0x836128d5
rol byte [ebx + eax*4], 0xf0
add eax, 0x46a006a
xor eax, 3
add eax, 4
xor eax, 5
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
je 0x5d3868
jne 0x5d3868
lcall 0x749a, 0x3eb037c
sti
jl 0x5d386d
jmp 0x5d386f
je 0x5d386a
pushf
push 0xa
jae 0x5d387c
jmp 0x5d3877
call 0x5d387e
jae 0x5d3877
add esp, 4
jmp 0x5d3883
dec dword [esp]
jno 0x5d3888
jns 0x5d3873
jp 0x5d388c
add esp, 4
popf
jmp 0x5d3893
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d38ac
int3
je 0x5d38b1
jne 0x5d38b1
call 0x101d6c05
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d38cb
jne 0x5d38ca
call 0x83612952
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5d38d9
jne 0x5d38d9
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x5d38de
jmp 0x5d38e0
je 0x5d38db
pushf
push 0xa
jae 0x5d38ed
jmp 0x5d38e8
call 0x5d38ef
jae 0x5d38e8
add esp, 4
jmp 0x5d38f4
dec dword [esp]
jno 0x5d38f9
jns 0x5d38e4
jp 0x5d38fd
add esp, 4
popf
jmp 0x5d3904
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d391d
mov eax, dword [0x75037400]
add eax, ebp
je 0x5d3922
jne 0x5d3922
call 0x101d6c76
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d393c
jne 0x5d393b
call 0x836129c3
rol byte [ebx + eax*4], 0xf0
add eax, 0x1cdc45c7
add byte [eax], al
add byte [ebx + eax + 0x75], dh
add dword [ebx + 0x7c], esp
add ebp, ebx
xor eax, 3
add eax, 4
xor eax, 5
mov dword [ebp - 0x24], 0x1c
je 0x5d3951
jne 0x5d3951
arpl word [ebx + eax - 0x15], di
jl 0x5d3956
jmp 0x5d3958
add esp, dword [ebx + 0x74]
sti
je 0x5d3953
pushf
push 0xa
jae 0x5d3965
jmp 0x5d3960
call 0x5d3967
jae 0x5d3960
add esp, 4
jmp 0x5d396c
dec dword [esp]
jno 0x5d3971
jns 0x5d395c
jp 0x5d3975
add esp, 4
popf
jmp 0x5d397c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d3995
jbe 0x5d39f8
je 0x5d399a
jne 0x5d399a
call 0x101d6cee
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d39b4
jne 0x5d39b3
call 0x83612a3b
rol byte [ebx + eax*4], 0xf0
add eax, 0x50dc458d
xor eax, 3
add eax, 4
xor eax, 5
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Thread32First
je 0x5d39cf
jne 0x5d39cf
invalid
jl 0x5d39d4
jmp 0x5d39d6
je 0x5d39d1
pushf
push 0xa
jae 0x5d39e3
jmp 0x5d39de
call 0x5d39e5
jae 0x5d39de
add esp, 4
jmp 0x5d39ea
dec dword [esp]
jno 0x5d39ef
jns 0x5d39da
jp 0x5d39f3
add esp, 4
popf
jmp 0x5d39fa
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d3a13
dec ebx
invalid
je 0x5d3a18
jne 0x5d3a18
call 0x101d6d6c
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d3a32
jne 0x5d3a31
call 0x83612ab9
rol byte [ebx + eax*4], 0xf0
add eax, 0x3be8558b
push ebp
or byte [edi], cl
test esp, ebp
add dword [eax], eax
add byte [ebx + eax + 0x75], dh
add dword [ebx + 0x3eb037c], edi
xor eax, 3
add eax, 4
xor eax, 5
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 8]
jne 0x5d3c33
je 0x5d3a4c
jne 0x5d3a4c
mov ebx, 0x3eb037c
jl 0x5d3a51
jmp 0x5d3a53
mov ebx, 0x9c66fb74
je 0x5d3a4e
pushf
push 0xa
jae 0x5d3a60
jmp 0x5d3a5b
call 0x5d3a62
jae 0x5d3a5b
add esp, 4
jmp 0x5d3a67
dec dword [esp]
jno 0x5d3a6c
jns 0x5d3a57
jp 0x5d3a70
add esp, 4
popf
jmp 0x5d3a77
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d3a90
jno 0x5d3a4b
je 0x5d3a95
jne 0x5d3a95
call 0x101d6de9
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d3aaf
jne 0x5d3aae
call 0x83612b36
rol byte [ebx + eax*4], 0xf0
add eax, 0x50e4458b
xor eax, 3
add eax, 4
xor eax, 5
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
je 0x5d3ad1
jne 0x5d3ad1
jns 0x5d3b4e
jl 0x5d3ad6
add ebp, ebx
add edi, dword [ecx + 0x74]
sti
jmp 0x5d3ad8
je 0x5d3ad3
pushf
push 0xa
jae 0x5d3ae5
jmp 0x5d3ae0
call 0x5d3ae7
jae 0x5d3ae0
add esp, 4
jmp 0x5d3aec
dec dword [esp]
jno 0x5d3af1
jns 0x5d3adc
jp 0x5d3af5
add esp, 4
popf
jmp 0x5d3afc
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d3b15
inc ecx
jns 0x5d3b8a
je 0x5d3b1a
add esi, dword [ebp + 1]
jne 0x5d3b1a
call 0x101d6e6e
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d3b34
jne 0x5d3b33
call 0x83612bbb
rol byte [ebx + eax*4], 0xf0
add eax, 0x51f84d8b
xor eax, 3
add eax, 4
xor eax, 5
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
je 0x5d3b4c
jne 0x5d3b4c
inc edx
jl 0x5d3b51
jmp 0x5d3b53
je 0x5d3b4e
pushf
push 0xa
jae 0x5d3b60
jmp 0x5d3b5b
call 0x5d3b62
jae 0x5d3b5b
add esp, 4
jmp 0x5d3b67
dec dword [esp]
jno 0x5d3b6c
jns 0x5d3b57
jp 0x5d3b70
add esp, 4
popf
jmp 0x5d3b77
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d3b90
call 0x7560afd5
add eax, ebp
je 0x5d3b95
jne 0x5d3b95
call 0x101d6ee9
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d3baf
jne 0x5d3bae
call 0x83612c36
rol byte [ebx + eax*4], 0xf0
add eax, 0x52f8558b
xor eax, 3
add eax, 4
xor eax, 5
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x5d3bc7
jne 0x5d3bc7
or edi, dword [ebx + eax - 0x15]
add ecx, dword [ebx]
jl 0x5d3bcc
jmp 0x5d3bce
je 0x5d3bc9
pushf
push 0xa
jae 0x5d3bdb
jmp 0x5d3bd6
call 0x5d3bdd
jae 0x5d3bd6
add esp, 4
jmp 0x5d3be2
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x5d3a3b
je 0x5d3c4d
jne 0x5d3c4d
aaa
jl 0x5d3c52
jmp 0x5d3c54
je 0x5d3c4f
pushf
push 0xa
jae 0x5d3c61
jmp 0x5d3c5c
call 0x5d3c63
jae 0x5d3c5c
add esp, 4
jmp 0x5d3c68
dec dword [esp]
jno 0x5d3c6d
jns 0x5d3c58
jp 0x5d3c71
add esp, 4
popf
jmp 0x5d3c78
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d3c91
adc dword [edi], esi
je 0x5d3c96
jne 0x5d3c96
call 0x101d6fea
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d3cb0
jne 0x5d3caf
call 0x83612d37
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5d3cbe
jne 0x5d3cbe
lcall 0x749a, 0x3eb037c
sti
jl 0x5d3cc3
jmp 0x5d3cc5
je 0x5d3cc0
pushf
push 0xa
jae 0x5d3cd2
jmp 0x5d3ccd
call 0x5d3cd4
jae 0x5d3ccd
add esp, 4
jmp 0x5d3cd9
dec dword [esp]
jno 0x5d3cde
jns 0x5d3cc9
jp 0x5d3ce2
add esp, 4
popf
jmp 0x5d3ce9
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d3d02
jecxz 0x5d3c9c
je 0x5d3d07
jne 0x5d3d07
call 0x101d705b
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d3d21
jne 0x5d3d20
call 0x83612da8
rol byte [ebx + eax*4], 0xf0
add eax, 0x52fc558b
xor eax, 3
add eax, 4
xor eax, 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x5d3d39
jne 0x5d3d39
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x5d3d3e
jmp 0x5d3d40
je 0x5d3d3b
pushf
push 0xa
jae 0x5d3d4d
jmp 0x5d3d48
call 0x5d3d4f
jae 0x5d3d48
add esp, 4
jmp 0x5d3d54
dec dword [esp]
jno 0x5d3d59
jns 0x5d3d44
jp 0x5d3d5d
add esp, 4
popf
jmp 0x5d3d64
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d3d7d
mov eax, 0x75037400
add eax, ebp
je 0x5d3d82
jne 0x5d3d82
call 0x101d70d6
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d3d9c
jne 0x5d3d9b
call 0x83612e23
rol byte [ebx + eax*4], 0xf0
add eax, 0xc35de58b
int3
xor eax, 3
add eax, 4
xor eax, 5
mov esp, ebp
pop ebp
ret