Function at 0x407bb0
Capabilities:
Create thread
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x42d084]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x128
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0041e4d0
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [0x42f690], ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x407c64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
push 0x428310
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_snapshot_processes
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x428338
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x407ce4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
push 0x428360
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_get_first_process
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x428388
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x130], eax
je 0x407d6d
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x407d68
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
push 0x4283b0
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_get_next_process
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x4283d4
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
jmp 0x407ce4
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
push str.PID__u__PPID__u
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x14
mov eax, dword [ebp - 0x120]
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x407e13
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x42840c
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_open_parent_process
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x428434
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
push 0
push 0
mov edx, dword [ebp - 8]
push edx
push 0x407b00
push 0
push 0
call fcn.00415f0e
add esp, 0x18
mov dword [0x42f68c], eax
cmp dword [0x42f68c], 0
jne 0x407e9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x42845c
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_create_helper_child_parent_watcher_thread
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x42849c
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004149ef
mov esp, ebp
pop ebp
ret