Function at 0x1000596a
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100414a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
xor eax, eax
lea edi, [ebp - 0x1c]
and dword [ebp - 0x3c], eax
pop ecx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
push ecx
push eax
call sub.KERNEL32.dll_Thread32First
mov ebx, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
je 0x10005af0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x10e4ae9c]
cmp eax, ecx
jne 0x100059f5
push ecx
call fcn.10006b2b
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e4aea0]
cmp eax, ecx
jne 0x10005a0c
push ecx
call fcn.10006b2b
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e4aea4]
cmp eax, ecx
jne 0x10005a23
push ecx
call fcn.10006b2b
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e4aea8]
cmp eax, ecx
jne 0x10005a3a
push ecx
call fcn.10006b2b
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e4aeac]
cmp eax, ecx
jne 0x10005a51
push ecx
call fcn.10006b2b
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e4aeb0]
cmp eax, ecx
jne 0x10005a67
push ecx
call fcn.10006b2b
mov ebx, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e4aeb4]
cmp eax, ecx
jne 0x10005a7d
push ecx
call fcn.10006b2b
mov edi, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e4aeb8]
cmp eax, ecx
jne 0x10005a93
push ecx
call fcn.10006b2b
mov esi, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, dword [0x10e4aebc]
cmp eax, ecx
jne 0x10005aa9
push ecx
call fcn.10006b2b
pop ecx
mov dword [ebp - 0x3c], eax
jmp 0x10005aac
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x28], 0
je 0x10005ada
cmp dword [ebp - 0x2c], 0
je 0x10005ada
cmp dword [ebp - 0x30], 0
je 0x10005ada
cmp dword [ebp - 0x34], 0
je 0x10005ada
cmp dword [ebp - 0x38], 0
je 0x10005ada
test ebx, ebx
je 0x10005ada
test edi, edi
je 0x10005ada
test esi, esi
je 0x10005ada
test eax, eax
jne 0x10005b05
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100059db
jmp 0x10005b05
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], 0
je 0x10005b42
cmp dword [ebp - 0x2c], 0
je 0x10005b42
cmp dword [ebp - 0x30], 0
je 0x10005b42
cmp dword [ebp - 0x34], 0
je 0x10005b42
cmp dword [ebp - 0x38], 0
je 0x10005b42
test ebx, ebx
je 0x10005b42
test edi, edi
je 0x10005b42
test esi, esi
je 0x10005b42
cmp dword [ebp - 0x3c], 0
je 0x10005b42
xor eax, eax
jmp 0x10005b45
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f6b
mov esp, ebp
pop ebp
ret