Function at 0x4115d0
Capabilities:
Enumerate processes
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x26c
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.kernel32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
push ebx
push ebx
je 0x411784
mov edi, eax
lea eax, [ebp - 0x254]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [ebp - 0x254], 0x1c
call sub.kernel32.dll_Thread32First
mov ebx, eax
push ecx
push ecx
mov dword [esp + 0x10], str.name
mov dword [esp + 0xc], str.prio
mov dword [esp + 8], 0x43d280
mov dword [esp + 4], str.process
mov dword [esp], str.__8.8s___8.8s__s_____s__all_IDs_are_in_hex__n
call fcn.004218d0
test ebx, ebx
je 0x411768
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
xor ebx, ebx
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x258], eax
jmp 0x4116e9
mov edx, 0x43d271
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x244]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str._t_08lx__4ld_s
call fcn.004218d0
mov eax, dword [ebp - 0x24c]
mov dword [esp], eax
call fcn.004114f0
mov esi, eax
test eax, eax
je 0x411790
mov dword [esp + 4], eax
mov dword [esp], str._ls_n
call fcn.004218d0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LocalFree]
push esi
lea eax, [ebp - 0x254]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.kernel32.dll_Thread32Next
test eax, eax
push ecx
push ecx
je 0x411778
mov ecx, dword [ebp - 0x258]
mov eax, dword [ebp - 0x248]
cmp dword [ecx + 0x20], eax
je 0x4116cd
cmp eax, dword [ebp - 0x25c]
je 0x411746
mov dword [esp], eax
call fcn.00421b80
mov ebx, eax
test eax, eax
je 0x4117c8
mov edx, dword [eax + 0x18]
mov eax, 0x43d265
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x248]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], str._08lx_s__ls_n
call fcn.004218d0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x24c]
cmp eax, dword [0x4ab5d0]
jne 0x411678
mov edx, 0x43d26c
jmp 0x41167d
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x260], eax
lea esi, [esi]
nop
mov dword [esp], edi
mov eax, dword [ebp - 0x260]
call eax
push edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x24c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00422430
test eax, eax
je 0x4117c0
add eax, 0x58
mov dword [esp + 4], eax
mov dword [esp], 0x43ced4
call fcn.004218d0
jmp 0x4116cd
mov eax, 0x43cd00
jmp 0x4117a9
mov dword [esp + 4], 0
mov dword [esp], 2
mov esi, dword [ebp - 0x248]
call sub.kernel32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
push edx
push edx
je 0x411888
lea edx, [ebp - 0x238]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [ebp - 0x238], 0x22c
mov dword [ebp - 0x25c], eax
call sub.kernel32.dll_Process32FirstW
test eax, eax
push ecx
push ecx
je 0x411898
mov dword [ebp - 0x264], ebx
mov ebx, dword [ebp - 0x25c]
jmp 0x411840
lea eax, [ebp - 0x238]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.kernel32.dll_Process32NextW
test eax, eax
push edx
push edx
je 0x411870
cmp esi, dword [ebp - 0x230]
jne 0x411828
mov eax, dword [ebp - 0x25c]
mov ebx, dword [ebp - 0x264]
mov dword [esp], eax
mov eax, dword [ebp - 0x260]
call eax
lea edx, [ebp - 0x214]
push eax
mov eax, 0x43cd00
jmp 0x41171c
mov eax, dword [ebp - 0x25c]
mov ebx, dword [ebp - 0x264]
mov dword [esp], eax
mov eax, dword [ebp - 0x260]
call eax
push eax
mov edx, 0x43d26a
mov eax, 0x43cd00
jmp 0x41171c
mov eax, dword [ebp - 0x25c]
mov dword [esp], eax
mov eax, dword [ebp - 0x260]
call eax
mov edx, 0x43d26a
push eax
mov eax, 0x43cd00
jmp 0x41171c