Function at 0x1000f390
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x100142b9
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x1001eb78]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
mov eax, dword [0x1001eb78]
xor eax, esp
push eax
lea eax, [esp + 0x174]
mov dword fs:[0], eax
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x18], ebx
cmp dword [0x1001ec80], 1
je 0x1000f41e
push esi
push 2
mov dword [esp + 0x48], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
push 0x124
lea eax, [esp + 0x50]
push esi
push eax
mov dword [esp + 0x28], ebp
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x48]
push ecx
push ebp
mov dword [esp + 0x50], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000f425
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1000f764
mov ebp, 7
lea ebx, [ebx]
lea edx, [esp + 0x6c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_310]
lea ecx, [esp + 0x10]
mov dword [esp + 0x17c], esi
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push str.smsniff.execharles.exehttpwatchstudio.exewireshark.exehttpanalyzerstdv7.exeurlsnooper.execapsa.exeehsniffer.exefiddler.exe
lea eax, [esp + 0x3c]
push 0xb
push eax
call fcn.1000e6f0
add esp, 0xc
or ebx, 1
mov ecx, eax
mov byte [esp + 0x17c], 1
mov dword [esp + 0x18], ebx
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
je 0x1000f66a
push 0x1001e8f4
lea ecx, [esp + 0x34]
push 0xb
push ecx
call fcn.1000e6f0
add esp, 0xc
or ebx, 2
mov ecx, eax
mov dword [esp + 0x17c], 2
mov dword [esp + 0x18], ebx
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
je 0x1000f66a
push 0x1001ea2c
lea edx, [esp + 0x2c]
push 9
push edx
call fcn.1000e6f0
add esp, 0xc
or ebx, 4
mov ecx, eax
mov dword [esp + 0x17c], 3
mov dword [esp + 0x18], ebx
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
je 0x1000f66a
push 0x1001ea50
lea eax, [esp + 0x28]
push 0xd
push eax
call fcn.1000e6f0
add esp, 0xc
or ebx, 8
mov ecx, eax
mov dword [esp + 0x17c], 4
mov dword [esp + 0x18], ebx
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
je 0x1000f66a
push 0x1001ea84
lea ecx, [esp + 0x38]
push 0xb
push ecx
call fcn.1000e6f0
add esp, 0xc
or ebx, 0x10
mov ecx, eax
mov dword [esp + 0x17c], 5
mov dword [esp + 0x18], ebx
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
je 0x1000f66a
push 0x1001e920
lea edx, [esp + 0x24]
push 0x13
push edx
call fcn.1000e6f0
add esp, 0xc
or ebx, 0x20
mov ecx, eax
mov dword [esp + 0x17c], 6
mov dword [esp + 0x18], ebx
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
je 0x1000f66a
push 0x1001e9a0
lea eax, [esp + 0x30]
push 0x15
push eax
call fcn.1000e6f0
push eax
lea ecx, [esp + 0x20]
or ebx, 0x40
push ecx
mov dword [esp + 0x190], ebp
mov dword [esp + 0x2c], ebx
call fcn.10005230
add esp, 0x14
test al, al
jne 0x1000f66a
push 0x1001e96c
lea edx, [esp + 0x48]
push 0xd
push edx
call fcn.1000e6f0
push eax
lea eax, [esp + 0x20]
or ebx, 0x80
push eax
mov dword [esp + 0x190], 8
mov dword [esp + 0x2c], ebx
call fcn.10005230
add esp, 0x14
test al, al
jne 0x1000f66a
push 0x1001e9f4
lea ecx, [esp + 0x40]
push 0xe
push ecx
call fcn.1000e6f0
push eax
lea edx, [esp + 0x20]
push edx
or ebx, 0x100
call fcn.10005230
add esp, 0x14
mov byte [esp + 0x17], 0
test al, al
je 0x1000f66f
mov byte [esp + 0x17], 1
test ebx, 0x100
je 0x1000f687
lea ecx, [esp + 0x3c]
and ebx, 0xfffffeff
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, bl
jns 0x1000f69b
lea ecx, [esp + 0x44]
and ebx, 0xffffff7f
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, 0x40
je 0x1000f6ad
lea ecx, [esp + 0x2c]
and ebx, 0xffffffbf
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, 0x20
je 0x1000f6bf
lea ecx, [esp + 0x20]
and ebx, 0xffffffdf
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, 0x10
je 0x1000f6d1
lea ecx, [esp + 0x34]
and ebx, 0xffffffef
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, 8
je 0x1000f6e3
lea ecx, [esp + 0x24]
and ebx, 0xfffffff7
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, 4
je 0x1000f6f5
lea ecx, [esp + 0x28]
and ebx, 0xfffffffb
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, 2
je 0x1000f707
lea ecx, [esp + 0x30]
and ebx, 0xfffffffd
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x17c], esi
test bl, 1
je 0x1000f720
lea ecx, [esp + 0x38]
and ebx, 0xfffffffe
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp byte [esp + 0x17], 0
lea ecx, [esp + 0x10]
jne 0x1000f78b
mov dword [esp + 0x17c], 0xffffffff
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x48]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000f430
mov esi, dword [esp + 0x40]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [esp + 0x174]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.1001133c
add esp, 0x170
ret
mov esi, 1
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x1000f757