Function at 0x10005030
Capabilities:
Enumerate process modules
Enumerate processes
Enumerate threads

Disassembly:
push 0xffffffffffffffff
push 0x1006b6ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x484
push ebp
push esi
push edi
push 0x104
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, eax
add esp, 4
test edx, edx
mov dword [esp + 0x10], edx
je 0x1000542e
mov ecx, 0x41
xor eax, eax
mov edi, edx
lea ebp, [esp + 0x38c]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x38d]
mov byte [esp + 0x38c], al
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x10096da8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
lea ebp, [esp + 0x390]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, str._MC_7
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push 1
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 1
lea ecx, [esp + 0x3a4]
push 0x40000000
push ecx
call fcn.10002dc0
mov ebp, eax
add esp, 0x20
cmp ebp, 0xffffffff
jne 0x10005124
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
jmp 0x1000542e
mov esi, dword [esp + 0x4a0]
mov dword [esp + 0xc], 0xffffffff
push esi
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edx, eax
mov dword [esp + 0xc], edx
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x44]
mov dword [esp + 0x40], 0x128
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x498], 0
push eax
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10005266
mov ecx, dword [esp + 0x48]
test ecx, ecx
jne 0x100051a9
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x40]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10005266
mov ecx, dword [esp + 0x48]
test ecx, ecx
jne 0x100051a9
lea eax, [esp + 0x40]
lea ecx, [esp + 0xc]
push eax
call fcn.10005820
test eax, eax
je 0x10005266
cmp dword [esp + 0x48], esi
je 0x100051ea
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x40]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10005266
mov ecx, dword [esp + 0x48]
test ecx, ecx
jne 0x100051e4
lea eax, [esp + 0x40]
lea ecx, [esp + 0xc]
push eax
call fcn.10005820
test eax, eax
jne 0x100051b1
jmp 0x10005266
lea ecx, [esp + 0x64]
push ecx
push str.Filename:__s_r_n
push ebp
call fcn.100079b0
mov ecx, dword [esp + 0x18]
xor edx, edx
add esp, 0xc
mov dword [esp + 0x18], edx
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], edx
push eax
push ecx
xor esi, esi
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x28], edx
call sub.KERNEL32.dll_Heap32ListFirst
test eax, eax
je 0x1000523c
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push eax
inc esi
call sub.KERNEL32.dll_Heap32ListNext
test eax, eax
jne 0x10005228
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push esi
push ecx
mov ecx, dword [esp + 0x50]
push edx
push eax
push ecx
push str.___PID_d__ParentPID_d__PriorityClass_d__Threads_d__Heaps_d_r_n
push ebp
call fcn.100079b0
mov esi, dword [esp + 0x4bc]
add esp, 0x1c
push str.Size
push str.ImagAddr
push 8
push str.BaseAddr
push 8
push str._r_nModules_Information:_r_n__Usage____s___s____8s__Module_r_n
push ebp
call fcn.100079b0
mov ecx, 0x88
xor eax, eax
lea edi, [esp + 0x188]
add esp, 0x1c
mov dword [esp + 0x168], 0x224
lea edx, [esp + 0x168]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
push edx
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x1000536b
mov eax, dword [esp + 0x178]
cmp eax, 0xffff
jne 0x100052da
push str.__Fixed
push ebp
call fcn.100079b0
add esp, 8
jmp 0x100052e9
push eax
push str.___5d
push ebp
call fcn.100079b0
add esp, 0xc
mov ecx, dword [esp + 0x17c]
mov edx, dword [esp + 0x48]
push ecx
push edx
call fcn.10004bc0
mov ecx, dword [esp + 0x184]
add esp, 8
cmp ecx, eax
jne 0x10005331
mov edx, dword [esp + 0x180]
lea eax, [esp + 0x288]
push eax
push edx
push 0x10096b74
push 8
push ecx
push str.___p__s____8u___s_r_n
push ebp
call fcn.100079b0
add esp, 0x1c
jmp 0x10005351
lea edx, [esp + 0x288]
push edx
mov edx, dword [esp + 0x184]
push edx
push eax
push ecx
push str.___p__p____8u___s_r_n
push ebp
call fcn.100079b0
add esp, 0x18
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x168]
push eax
push ecx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x100052bc
push str._r_nThread_Information:_r_n______TID_____Priority_r_n
push ebp
call fcn.100079b0
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x30]
add esp, 8
mov dword [esp + 0x24], 0x1c
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
push edx
push eax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x10005415
cmp dword [esp + 0x30], esi
jne 0x10005402
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
cmp ecx, 0x10
lea eax, [edx + ecx]
jge 0x100053c1
cmp eax, 0xf
jle 0x100053c1
mov eax, 0xf
cmp ecx, 0xf
jle 0x100053d0
cmp eax, 0x1f
jle 0x100053d0
mov eax, 0x1f
cmp ecx, 0x10
jge 0x100053df
cmp eax, 1
jge 0x100053df
mov eax, 1
cmp ecx, 0xf
jle 0x100053ee
cmp eax, 0x10
jge 0x100053ee
mov eax, 0x10
push eax
mov eax, dword [esp + 0x30]
push eax
push str.___0x_X________2d_r_n
push ebp
call fcn.100079b0
add esp, 0x10
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x24]
push ecx
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100053a1
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1000542a
push eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x490]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x490
ret 4