Function at 0x1000b120
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012f56
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x10023330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x144], ebx
cmp dword [0x10023800], 1
je 0x1000b1a2
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x124
mov esi, eax
lea eax, [ebp - 0x134]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000b1b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1000b505
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x13c]
call dword [sym.imp.mfc140.dll_Ordinal_310]
lea ecx, [ebp - 0x13c]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_8672]
push str.smsniff.execharles.execapsa.exeehsniffer.exefiddler.exewireshark.exehttpwatchstudio.exe
lea eax, [ebp - 0x168]
push 0xb
push eax
call fcn.1000b060
add esp, 0xc
push dword [eax]
or ebx, 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b3f4
push 0x10023044
lea eax, [ebp - 0x164]
push 0xb
push eax
call fcn.1000b060
add esp, 0xc
push dword [eax]
or ebx, 2
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b3f4
push 0x10023070
lea eax, [ebp - 0x160]
push 9
push eax
call fcn.1000b060
add esp, 0xc
push dword [eax]
or ebx, 4
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b3f4
push 0x10023094
lea eax, [ebp - 0x15c]
push 0xd
push eax
call fcn.1000b060
add esp, 0xc
push dword [eax]
or ebx, 8
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b3f4
push 0x100230c8
lea eax, [ebp - 0x158]
push 0xb
push eax
call fcn.1000b060
add esp, 0xc
push dword [eax]
or ebx, 0x10
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b3f4
push 0x10023128
lea eax, [ebp - 0x154]
push 0x13
push eax
call fcn.1000b060
add esp, 0xc
push dword [eax]
or ebx, 0x20
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b3f4
push str.httpanalyzerstdv7.exeurlsnooper.exe
lea eax, [ebp - 0x150]
push 0x15
push eax
call fcn.1000b060
add esp, 0xc
push dword [eax]
or ebx, 0x40
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b3f4
push 0x100230f4
lea eax, [ebp - 0x14c]
push 0xd
push eax
call fcn.1000b060
add esp, 0xc
push dword [eax]
or ebx, 0x80
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x1000b3f4
push 0x100231cc
lea eax, [ebp - 0x148]
push 0xe
push eax
call fcn.1000b060
add esp, 0xc
push dword [eax]
or ebx, 0x100
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x144], ebx
call dword [sym.imp.mfc140.dll_Ordinal_2986]
mov byte [ebp - 0x13d], 0
test eax, eax
jne 0x1000b3fb
mov byte [ebp - 0x13d], 1
test ebx, 0x100
je 0x1000b415
lea ecx, [ebp - 0x148]
and ebx, 0xfffffeff
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, bl
jns 0x1000b42b
lea ecx, [ebp - 0x14c]
and ebx, 0xffffff7f
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 0x40
je 0x1000b43f
lea ecx, [ebp - 0x150]
and ebx, 0xffffffbf
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 0x20
je 0x1000b453
lea ecx, [ebp - 0x154]
and ebx, 0xffffffdf
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 0x10
je 0x1000b467
lea ecx, [ebp - 0x158]
and ebx, 0xffffffef
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 8
je 0x1000b47b
lea ecx, [ebp - 0x15c]
and ebx, 0xfffffff7
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 4
je 0x1000b48f
lea ecx, [ebp - 0x160]
and ebx, 0xfffffffb
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, 2
je 0x1000b4a3
lea ecx, [ebp - 0x164]
and ebx, 0xfffffffd
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov dword [ebp - 4], 0
test bl, 1
je 0x1000b4be
lea ecx, [ebp - 0x168]
and ebx, 0xfffffffe
call dword [sym.imp.mfc140.dll_Ordinal_1044]
cmp byte [ebp - 0x13d], 0
lea ecx, [ebp - 0x13c]
jne 0x1000b4f1
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea eax, [ebp - 0x138]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000b1b0
jmp 0x1000b4fc
mov edi, 1
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f28b
mov esp, ebp
pop ebp
ret