Function at 0x403f61
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c69b
mov eax, dword fs:[0]
push eax
mov eax, 0x1608
call fcn.0040d800
mov eax, dword [0x43b080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 0xc], 0x80000003
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x15c8], eax
je 0x40426d
cmp dword [esi + 0xc], 0x80000004
je 0x404205
cmp byte [ebx + 0x6e], 0
jne 0x4048c5
push eax
push dword [esi + 0xc]
push str.SyringeDebugger::HandleException:_Exception_Code:_0x_08X_at_0x_08X_
call fcn.00401253
add esp, 0xc
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1614]
push eax
call fcn.0040951e
mov ecx, 0x43694d
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x15e4], eax
mov eax, dword [esi + 0x20]
sub eax, 0
je 0x404018
sub eax, 1
je 0x404011
sub eax, 7
jne 0x40401d
mov ecx, str.execute
jmp 0x40401d
mov ecx, str.write_to
jmp 0x40401d
mov ecx, str.read_from
push dword [esi + 0x24]
push ecx
push str._tThe_process_tried_to__s_0x_08X.
call fcn.00401253
add esp, 0xc
cmp dword [ebx + 8], 0xffffffff
je 0x404116
lea eax, [ebp - 0x15d4]
push eax
push 0x1000
lea eax, [ebp - 0x101c]
push eax
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x404116
mov eax, dword [ebp - 0x15d4]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x15e8], eax
test eax, eax
je 0x404116
push 0x104
lea eax, [ebp - 0x1124]
push 0
push eax
call fcn.0040e450
add esp, 0xc
lea eax, [ebp - 0x1124]
push 0x104
push eax
push dword [ebp + esi*4 - 0x101c]
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x404109
xor eax, eax
lea edi, [ebp - 0x1604]
stosd dword es:[edi], eax
push 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1604]
push eax
push dword [ebp + esi*4 - 0x101c]
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x404109
lea eax, [ebp - 0x1124]
push 0x104
push eax
call fcn.00415663
push dword [ebp - 0x1604]
and byte [ebp - 0x1124], 0xdf
lea eax, [ebp - 0x1124]
push eax
push esi
push dword [ebx + 0x10]
push str.Loaded_Module_for___d___d__s____x_
call fcn.00401253
add esp, 0x1c
inc esi
cmp esi, dword [ebp - 0x15e8]
jl 0x404075
lea eax, [ebp - 0x15bc]
mov dword [ebp - 0x15bc], 0x10007
push eax
push dword [ebp - 0x15e4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
call fcn.0040123c
push str.Registers:
call fcn.00401253
pop ecx
push dword [ebp - 0x1514]
push dword [ebp - 0x1510]
push dword [ebp - 0x150c]
push str._tEAX__0x_08X_tECX__0x_08X_tEDX__0x_08X
call fcn.00401253
push dword [ebp - 0x1508]
push dword [ebp - 0x14f8]
push dword [ebp - 0x1518]
push str._tEBX__0x_08X_tESP__0x_08X_tEBP__0x_08X
call fcn.00401253
push dword [ebp - 0x1504]
push dword [ebp - 0x1520]
push dword [ebp - 0x151c]
push str._tESI__0x_08X_tEDI__0x_08X_tEIP__0x_08X
call fcn.00401253
add esp, 0x30
call fcn.0040123c
push str._tStack_dump:
call fcn.00401253
mov esi, dword [ebp - 0x14f8]
pop ecx
lea edi, [esi + 0x400]
jmp 0x4041f3
push 4
lea eax, [ebp - 0x15d4]
mov ecx, ebx
push eax
push esi
call fcn.00403e38
test al, al
je 0x4041e3
push dword [ebp - 0x15d4]
push esi
push str._t0x_08X:_t0x_08X
call fcn.00401253
add esp, 0xc
jmp 0x4041f0
push esi
push str._t0x_08X:_t_could_not_be_read_
call fcn.00401253
pop ecx
pop ecx
add esi, 4
cmp esi, edi
jb 0x4041b8
call fcn.0040123c
mov byte [ebx + 0x6e], 1
jmp 0x4048c5
lea eax, [esi + 8]
mov byte [ebp - 0x15bd], 0xcc
push eax
lea eax, [ebp - 0x1614]
push eax
call fcn.0040951e
push 1
mov ecx, ebx
mov esi, dword [eax]
lea eax, [ebp - 0x15bd]
push eax
push dword [esi + 0x18]
call fcn.00403d70
mov esi, dword [esi + 0x14]
lea eax, [ebp - 0x12ec]
push eax
mov edi, 0x10001
push esi
mov dword [ebp - 0x12ec], edi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
and dword [ebp - 0x122c], 0xfffffeff
lea eax, [ebp - 0x12ec]
push eax
push esi
mov dword [ebp - 0x12ec], edi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
jmp 0x4042b3
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1614]
push eax
call fcn.0040951e
lea ecx, [ebp - 0x12ec]
mov edi, 0x10001
push ecx
mov esi, dword [eax]
add esi, 0x14
mov dword [ebp - 0x15d4], esi
mov eax, dword [esi]
push eax
mov dword [ebp - 0x15f8], eax
mov dword [ebp - 0x12ec], edi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp byte [ebx + 0x18], 0
je 0x4042bd
mov byte [ebx + 0x18], 0
mov eax, 0x10002
jmp 0x4048ca
mov eax, dword [ebp - 0x122c]
test eax, 0x100
je 0x4042ef
and eax, 0xfffffeff
mov byte [ebp - 0x15bd], 0xcc
mov dword [ebp - 0x122c], eax
mov ecx, ebx
push 1
lea eax, [ebp - 0x15bd]
push eax
push dword [esi + 4]
call fcn.00403d70
cmp byte [ebx + 0x6c], 0
jne 0x404474
lea eax, [ebp - 0x15c8]
push eax
lea eax, [ebp - 0x1614]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00409468
push 1
mov ecx, ebx
mov eax, dword [eax]
add eax, 0x14
push eax
push dword [ebp - 0x15c8]
call fcn.00403d70
mov esi, dword [ebx + 0x30]
cmp esi, dword [ebx + 0x28]
jne 0x404334
mov esi, dword [ebx + 0x24]
mov dword [ebx + 0x30], esi
jmp 0x404376
mov eax, dword [esi]
mov ecx, ebx
add eax, 0x204
push 4
push eax
mov eax, dword [ebx + 0x58]
add eax, 0x28
push eax
call fcn.00403e38
mov ecx, dword [esi]
cmp dword [ecx + 0x204], 0
jne 0x40436f
lea eax, [ecx + 0x104]
push eax
lea eax, [ecx + 4]
push eax
push str.SyringeDebugger::HandleException:_Could_not_retrieve_ProcAddress_for:__s____s
call fcn.00401253
add esp, 0xc
add dword [ebx + 0x30], 4
mov esi, dword [ebx + 0x30]
cmp esi, dword [ebx + 0x28]
je 0x404425
mov ecx, dword [ebx + 0x58]
mov eax, dword [esi]
push 0x100
add eax, 4
mov dword [ebp - 0x15cc], ecx
push eax
lea eax, [ecx + 0x30]
mov ecx, ebx
push eax
call fcn.00403d70
mov eax, dword [ebp - 0x15cc]
add eax, 0x130
mov dword [ebp - 0x15d0], eax
mov eax, dword [esi]
add eax, 4
push str.cncnet5.dll
push eax
call fcn.004189cb
pop ecx
pop ecx
mov ecx, ebx
test eax, eax
jne 0x4043dc
mov dword [ebp - 0x1c], 0x4d6c6c44
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x6e6961
push 8
jmp 0x4043e8
mov eax, dword [esi]
push 0x100
add eax, 0x104
push eax
push dword [ebp - 0x15d0]
call fcn.00403d70
cmp byte [0x43cbe9], 0
mov eax, dword [ebp - 0x15cc]
mov dword [ebp - 0x1234], eax
je 0x40443d
mov ecx, dword [esi]
lea eax, [ecx + 4]
push eax
lea eax, [ecx + 0x104]
push eax
push str.SyringeDebugger::HandleException:_Executing_LoadLibraryFunc__proc_:__s___Lib_:_s_
call fcn.00401253
add esp, 0xc
jmp 0x40443d
push str.SyringeDebugger::HandleException:_Finished_retrieving_proc_addresses.
call fcn.00401253
mov eax, dword [ebx + 0x4c]
pop ecx
mov byte [ebx + 0x6c], 1
mov dword [ebp - 0x1234], eax
or dword [ebp - 0x122c], 0x100
lea eax, [ebp - 0x12ec]
push eax
push dword [ebp - 0x15f8]
mov dword [ebp - 0x12ec], edi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov ecx, dword [ebp - 0x15d4]
mov eax, dword [ebp - 0x15c8]
mov dword [ecx + 4], eax
jmp 0x4042b3
mov eax, dword [ebp - 0x15c8]
cmp eax, dword [ebx + 0x4c]
jne 0x4048ac
cmp byte [ebx + 0x6d], 0
jne 0x40484d
push str.SyringeDebugger::HandleException:_Creating_code_hooks.
call fcn.00401253
pop ecx
xor eax, eax
xor ecx, ecx
and dword [ebp - 0x15ec], eax
mov dword [ebp - 0x15c4], eax
mov dword [ebp - 0x15f4], eax
mov dword [ebp - 0x15f0], ecx
and dword [ebp - 4], ecx
xor edx, edx
and dword [ebp - 0x15fc], eax
mov dword [ebp - 0x15d0], edx
mov dword [ebp - 0x1604], edx
mov dword [ebp - 0x1600], eax
mov byte [ebp - 4], 1
mov esi, dword [ebx + 0x1c]
mov esi, dword [esi]
mov dword [ebp - 0x15e8], esi
mov dword [ebp - 0x15e4], esi
cmp byte [esi + 0xd], dl
jne 0x404819
xor edi, edi
cmp edi, ecx
cmovne ecx, edi
cmp edx, eax
mov dword [ebp - 0x15e0], ecx
cmovne eax, edx
mov dword [ebp - 0x15f0], ecx
mov dword [ebp - 0x15dc], eax
mov dword [ebp - 0x1600], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4047e1
cmp eax, dword [ebx + 0x4c]
je 0x4047e1
mov eax, dword [esi + 0x18]
xor ecx, ecx
xor edi, edi
cmp eax, dword [esi + 0x1c]
je 0x4047db
cmp dword [eax + 0x204], 0
mov edx, edi
je 0x40454e
mov edi, dword [eax + 0x208]
inc ecx
cmp edx, edi
cmovae edi, edx
add eax, 0x20c
cmp eax, dword [esi + 0x1c]
jne 0x404537
mov dword [ebp - 0x15cc], ecx
mov dword [ebp - 0x15d8], edi
test ecx, ecx
je 0x4047db
imul eax, ecx, 0x24
lea ecx, [ebp - 0x15f4]
add eax, 5
add eax, edi
push eax
mov dword [ebp - 0x15e0], eax
call fcn.00407473
push dword [ebp - 0x15e0]
mov eax, dword [ebp - 0x15f4]
mov dword [ebp - 0x160c], eax
mov dword [ebp - 0x15c4], eax
lea eax, [ebp - 0x1614]
push ecx
push eax
mov ecx, ebx
call fcn.00403ebb
lea ecx, [esi + 0x24]
push eax
call fcn.00402e9b
lea ecx, [ebp - 0x1614]
call fcn.004012de
xor dl, dl
xor ecx, ecx
mov byte [ebp - 0x15bd], dl
mov dword [ebp - 0x15dc], ecx
jmp 0x4045d9
mov dl, byte [ebp - 0x15bd]
mov eax, dword [esi + 0x18]
add eax, ecx
mov dword [ebp - 0x1608], eax
cmp dword [eax + 0x204], 0
je 0x4046e2
lea ecx, [eax + 0x208]
mov dword [ebp - 0x18], ecx
test dl, dl
jne 0x404660
mov edx, dword [ecx]
test edx, edx
je 0x404660
push edx
lea ecx, [ebp - 0x1604]
call fcn.00407473
push edi
mov edi, dword [ebp - 0x1604]
mov ecx, ebx
push edi
push dword [esi + 0x10]
mov dword [ebp - 0x15d0], edi
call fcn.00403e38
mov al, byte [edi]
cmp al, 0xe8
je 0x404636
cmp al, 0xe9
je 0x404636
cmp al, 0x7e
jne 0x404657
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1608]
add eax, 0x104
push eax
push dword [esi + 0x10]
push str.SyringeDebugger::HandleException:Hook_at__0x_x___s____d__Possibly_destroying_jmp_or_call
call fcn.00401253
add esp, 0x10
mov byte [ebp - 0x15bd], 1
jmp 0x40467d
cmp dword [ecx], 0
jne 0x40467d
push 0
add eax, 0x104
push eax
push dword [esi + 0x10]
push str.SyringeDebugger::HandleException:Hook_at__0x_x___s____d__cannot_be_identified_because_it_0_overriden_jmp_or_call
call fcn.00401253
add esp, 0x10
mov edi, dword [ebp - 0x15c4]
mov esi, 0x4378f4
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x15c4]
mov ecx, edi
mov esi, dword [ebp - 0x15e8]
sub ecx, dword [ebp - 0x160c]
mov eax, dword [esi + 0x10]
mov dword [edi + 3], eax
mov eax, dword [ebp - 0x1608]
mov edx, dword [eax + 0x204]
mov eax, dword [esi + 0x24]
add eax, 0xd
mov byte [edi + 8], 0xe8
add eax, ecx
sub edx, eax
mov dword [edi + 9], edx
mov edx, dword [ebp - 0x15c4]
mov edi, dword [ebp - 0x15d8]
add edx, 0x21
mov ecx, dword [ebp - 0x15dc]
mov dword [ebp - 0x15c4], edx
jmp 0x4046e8
mov edx, dword [ebp - 0x15c4]
add ecx, 0x20c
sub dword [ebp - 0x15cc], 1
mov dword [ebp - 0x15dc], ecx
jne 0x4045d3
mov edi, dword [ebp - 0x1600]
mov eax, dword [ebp - 0x15d0]
mov dword [ebp - 0x15dc], edi
cmp eax, edi
je 0x40472c
sub edi, eax
push edi
push eax
push edx
call fcn.0040ded0
mov edx, dword [ebp - 0x15c4]
add esp, 0xc
add edx, edi
mov eax, dword [ebp - 0x15d8]
mov edi, dword [ebp - 0x160c]
push 5
pop ecx
cmp eax, ecx
cmovb eax, ecx
mov ecx, dword [esi + 0x10]
add ecx, eax
mov dword [ebp - 0x15d8], eax
mov eax, dword [esi + 0x24]
sub eax, edi
mov byte [edx], 0xe9
add eax, 5
add eax, edx
sub ecx, eax
mov dword [edx + 1], ecx
mov ecx, ebx
mov eax, dword [ebp - 0x15f0]
sub eax, edi
push eax
push edi
push dword [esi + 0x24]
call fcn.00403d70
mov edi, dword [ebp - 0x15e0]
lea ecx, [ebp - 0x15f4]
push edi
call fcn.00407473
push edi
push dword [ebp - 0x15f4]
mov ecx, ebx
push dword [esi + 0x24]
call fcn.00403e38
mov edi, dword [esi + 0x10]
mov esi, dword [esi + 0x24]
push ecx
push dword [ebp - 0x15d8]
lea eax, [edi + 5]
lea ecx, [ebp - 0x15f4]
sub esi, eax
call fcn.004074be
mov ecx, dword [ebp - 0x15f4]
mov dword [ebp - 0x15c4], ecx
mov byte [ecx], 0xe9
mov dword [ecx + 1], esi
mov eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x15e0], eax
sub eax, ecx
push eax
push ecx
push edi
mov ecx, ebx
call fcn.00403d70
mov edi, dword [ebp - 0x15c4]
lea ecx, [ebp - 0x15e4]
call fcn.004085cb
mov esi, dword [ebp - 0x15e4]
mov eax, dword [ebp - 0x15dc]
mov ecx, dword [ebp - 0x15e0]
mov edx, dword [ebp - 0x15d0]
cmp byte [esi + 0xd], 0
mov dword [ebp - 0x15e8], esi
je 0x4044f1
mov edi, 0x10001
mov eax, dword [0x43cc10]
test eax, eax
je 0x404829
push eax
call fcn.00411916
pop ecx
lea ecx, [ebp - 0x1604]
mov byte [ebx + 0x6d], 1
call fcn.00405e0f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15f4]
call fcn.00405e0f
mov esi, dword [ebp - 0x15d4]
lea eax, [ebp - 0x15c8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00409468
push 1
mov ecx, ebx
mov eax, dword [eax]
add eax, 0x14
push eax
push dword [ebp - 0x15c8]
call fcn.00403d70
or dword [ebp - 0x122c], 0x100
lea eax, [ebp - 0x12ec]
dec dword [ebp - 0x1234]
push eax
push dword [ebp - 0x15f8]
mov dword [ebp - 0x12ec], edi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x15c8]
mov dword [esi + 4], eax
jmp 0x4042b3
lea eax, [ebp - 0x12ec]
mov dword [ebp - 0x12ec], edi
push eax
push dword [ebp - 0x15f8]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, 0x80010001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040c9a4
leave
ret 4