Function at 0x4208b0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x42e45b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x35c
push ebx
push ebp
push esi
push edi
push 0
mov dword [esp + 0x20], ecx
push 2
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0x128
mov dword [esp + 0x150], 0x224
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x20]
push eax
push esi
mov dword [esp + 0x1c], esi
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x420b57
mov edi, dword [esp + 0x380]
mov ebx, dword [esp + 0x37c]
lea ecx, [esp + 0x44]
push ebx
push ecx
call dword [sym.imp.ntdll.dll__stricmp]
add esp, 8
test eax, eax
jne 0x420b44
mov edx, dword [esp + 0x28]
push edx
push 8
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebp, eax
lea eax, [esp + 0x148]
push eax
push ebp
call sub.KERNEL32.DLL_Module32First
test eax, eax
je 0x420a6e
lea ecx, [esp + 0x268]
push ebx
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x420a54
mov edx, dword [0x436cfc]
mov dword [esp + 0x10], edx
mov ecx, 0x450280
xor eax, eax
test ecx, ecx
mov dword [esp + 0x374], eax
jne 0x420994
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
jmp 0x4209a1
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
push 0x450280
call esi
push 0x450280
push eax
mov ecx, edi
call fcn.00406e80
lea edx, [esp + 0x268]
test edx, edx
jne 0x4209bd
xor eax, eax
jmp 0x4209c7
lea eax, [esp + 0x268]
push eax
call esi
lea ecx, [esp + 0x268]
push ecx
push eax
mov ecx, edi
call fcn.00406e80
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x10]
lea eax, [esp + 0x268]
push edx
push eax
mov dword [esp + 0x20], 1
call fcn.00420ff0
test eax, eax
jne 0x420b7f
mov ecx, 0x4500a4
test ecx, ecx
je 0x420a0d
push 0x4500a4
call esi
push 0x4500a4
push eax
mov ecx, edi
call fcn.00406e80
mov eax, dword [esp + 0x10]
mov ecx, dword [0x436d00]
mov dword [esp + 0x374], 0xffffffff
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x420a54
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x420a54
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0042d5f4
add esp, 4
lea ecx, [esp + 0x148]
push ecx
push ebp
call sub.KERNEL32.DLL_Module32Next
test eax, eax
jne 0x420959
mov esi, dword [esp + 0x14]
test ebp, ebp
je 0x420a79
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x420b44
mov edx, 0x450280
test edx, edx
jne 0x420a92
xor eax, eax
jmp 0x420a9d
push 0x450280
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push 0x450280
push eax
mov ecx, edi
call fcn.00406e80
test ebx, ebx
je 0x420b1f
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov esi, eax
test esi, esi
je 0x420b1f
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
lea ebp, [eax - 0xc]
cmp ecx, 1
jg 0x420b07
mov ecx, dword [eax - 8]
mov edx, dword [eax - 4]
lea ebx, [ecx + esi]
cmp ebx, edx
jg 0x420b00
mov ebx, dword [esp + 0x37c]
push esi
inc edx
push ebx
add ecx, eax
push edx
push ecx
call fcn.00406c30
mov eax, dword [edi]
add esp, 0x10
mov ecx, dword [eax - 8]
add ecx, esi
mov dword [eax - 8], ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
mov byte [ecx + eax], 0
jmp 0x420b1f
mov ebx, dword [esp + 0x37c]
mov edx, dword [eax - 8]
push ebx
push esi
push eax
push edx
mov ecx, edi
call fcn.0040e0f0
test eax, eax
je 0x420b1f
push ebp
call fcn.00407060
mov eax, 0x4500a4
test eax, eax
je 0x420b33
push 0x4500a4
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push 0x4500a4
push eax
mov ecx, edi
call fcn.00406e80
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push esi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x42091e
test esi, esi
je 0x420b62
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x36c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x368
ret 8
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebp
call ebx
mov edx, dword [esp + 0x14]
push edx
call ebx
mov eax, 0x450278
test eax, eax
je 0x420b9f
push 0x450278
call esi
push 0x450278
push eax
mov ecx, edi
call fcn.00406e80
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax - 8]
push ecx
mov ecx, edi
call fcn.00406e80
mov edx, 0x4500a4
test edx, edx
jne 0x420bc9
xor eax, eax
jmp 0x420bd0
push 0x4500a4
call esi
push 0x4500a4
push eax
mov ecx, edi
call fcn.00406e80
mov eax, dword [esp + 0x10]
mov edx, dword [0x436d00]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x420c0c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x420c0c
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0042d5f4
add esp, 4
mov eax, 1
jmp 0x420b64