Function at 0x1000b660
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013566
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x10024330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x144], ebx
cmp dword [0x10024800], 1
je 0x1000b6e2
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x124
mov esi, eax
lea eax, [ebp - 0x134]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000b6f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1000ba45
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x13c]
call dword [sym.imp.mfc140.dll_Ordinal_310]
lea ecx, [ebp - 0x13c]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_8672]
push str.smsniff.execharles.execapsa.exeehsniffer.exefiddler.exewireshark.exehttpwatchstudio.exe
lea eax, [ebp - 0x168]
push 0xb
push eax
call fcn.1000b5a0
add esp, 0xc
push dword [eax]
or ebx, 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b934
push 0x10024044
lea eax, [ebp - 0x164]
push 0xb
push eax
call fcn.1000b5a0
add esp, 0xc
push dword [eax]
or ebx, 2
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b934
push 0x10024070
lea eax, [ebp - 0x160]
push 9
push eax
call fcn.1000b5a0
add esp, 0xc
push dword [eax]
or ebx, 4
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b934
push 0x10024094
lea eax, [ebp - 0x15c]
push 0xd
push eax
call fcn.1000b5a0
add esp, 0xc
push dword [eax]
or ebx, 8
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b934
push 0x100240c8
lea eax, [ebp - 0x158]
push 0xb
push eax
call fcn.1000b5a0
add esp, 0xc
push dword [eax]
or ebx, 0x10
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b934
push 0x10024128
lea eax, [ebp - 0x154]
push 0x13
push eax
call fcn.1000b5a0
add esp, 0xc
push dword [eax]
or ebx, 0x20
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b934
push str.httpanalyzerstdv7.exeurlsnooper.exe
lea eax, [ebp - 0x150]
push 0x15
push eax
call fcn.1000b5a0
add esp, 0xc
push dword [eax]
or ebx, 0x40
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b934
push 0x100240f4
lea eax, [ebp - 0x14c]
push 0xd
push eax
call fcn.1000b5a0
add esp, 0xc
push dword [eax]
or ebx, 0x80
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b934
push 0x100241cc
lea eax, [ebp - 0x148]
push 0xe
push eax
call fcn.1000b5a0
add esp, 0xc
push dword [eax]
or ebx, 0x100
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
mov byte [ebp - 0x13d], 0
test eax, eax
jne 0x1000b93b
mov byte [ebp - 0x13d], 1
test ebx, 0x100
je 0x1000b955
lea ecx, [ebp - 0x148]
and ebx, 0xfffffeff
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, bl
jns 0x1000b96b
lea ecx, [ebp - 0x14c]
and ebx, 0xffffff7f
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 0x40
je 0x1000b97f
lea ecx, [ebp - 0x150]
and ebx, 0xffffffbf
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 0x20
je 0x1000b993
lea ecx, [ebp - 0x154]
and ebx, 0xffffffdf
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 0x10
je 0x1000b9a7
lea ecx, [ebp - 0x158]
and ebx, 0xffffffef
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 8
je 0x1000b9bb
lea ecx, [ebp - 0x15c]
and ebx, 0xfffffff7
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 4
je 0x1000b9cf
lea ecx, [ebp - 0x160]
and ebx, 0xfffffffb
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 2
je 0x1000b9e3
lea ecx, [ebp - 0x164]
and ebx, 0xfffffffd
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov dword [ebp - 4], 0
test bl, 1
je 0x1000b9fe
lea ecx, [ebp - 0x168]
and ebx, 0xfffffffe
call dword [sym.imp.mfc140.dll_Ordinal_1044]
cmp byte [ebp - 0x13d], 0
lea ecx, [ebp - 0x13c]
jne 0x1000ba31
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea eax, [ebp - 0x138]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000b6f0
jmp 0x1000ba3c
mov edi, 1
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f7bb
mov esp, ebp
pop ebp
ret