Function at 0x401340
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1228
call fcn.00402370
mov eax, dword [0x404004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4031e0
lea eax, [ebp - 0x1218]
mov dword [ebp - 0x1218], 0
push str.search_strings.txt
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x4016a9
cmp dword [ebp - 0x1218], eax
je 0x4016a9
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor ebx, ebx
push 4
call edi
mov esi, eax
mov dword [ebp - 0x1220], eax
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0x403200
push dword [ebp - 0x1218]
call fcn.00401080
add esp, 0x14
cmp eax, 1
jne 0x40147d
nop
lea eax, [ebp - 0x104]
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013e0
xor ecx, ecx
sub eax, edx
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call edi
mov edx, eax
lea ecx, [ebp - 0x104]
add esp, 4
mov dword [esi + ebx*4], edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401410
sub ecx, edi
lea eax, [ebp - 0x104]
push eax
lea eax, [ecx + 1]
push eax
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
inc ebx
xor ecx, ecx
mov edx, 4
lea eax, [ebx + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov esi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push 0x403200
push dword [ebp - 0x1218]
call fcn.00401080
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 0x24
cmp eax, 1
je 0x4013d0
mov dword [ebp - 0x1220], esi
push dword [ebp - 0x1218]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x4016bb
push str.Choose_an_option:_n
call fcn.00401050
push str.1._Automatically_find_process_ID_by_name__hl2.exe__n
call fcn.00401050
push str.2._Manually_enter_process_ID_n
call fcn.00401050
lea eax, [ebp - 0x1210]
push eax
push 0x403320
call fcn.004010b0
mov eax, dword [ebp - 0x1210]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub eax, 1
je 0x40150f
sub eax, 1
je 0x4014e6
push str.Invalid_choice._Exiting..._n
jmp 0x4016c0
push str.Enter_the_PID_of_the_process_to_scan:
call fcn.00401050
lea eax, [ebp - 0x120c]
push eax
push 0x403270
call fcn.004010b0
mov edi, dword [ebp - 0x120c]
add esp, 0xc
jmp 0x401608
lea eax, [ebp - 0x120c]
push eax
push 0x1000
lea eax, [ebp - 0x1208]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x40153e
push str.Failed_to_enumerate_processes._n
call fcn.00401050
add esp, 4
jmp 0x401606
mov eax, dword [ebp - 0x120c]
xor edi, edi
shr eax, 2
mov dword [ebp - 0x1228], eax
test eax, eax
je 0x4015f4
nop word [eax + eax]
lea eax, [ebp - 0x1208]
push dword [eax + edi*4]
lea eax, [eax + edi*4]
push 0
push 0x410
mov dword [ebp - 0x1224], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4015e1
lea eax, [ebp - 0x1214]
push eax
push 4
lea eax, [ebp - 0x121c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x4015d6
push 0x104
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x121c]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x4015d6
lea eax, [ebp - 0x208]
push eax
push str.hl2.exe
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x401633
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x4015e7
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebp - 0x1228]
jb 0x401560
push str.hl2.exe
push str.Process_with_name___s__not_found._n
call fcn.00401050
add esp, 8
xor edi, edi
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1224], eax
test eax, eax
jne 0x401646
push edi
push str.Failed_to_open_process_with_ID__lu_n
call fcn.00401050
add esp, 8
jmp 0x4016c8
mov edi, dword [ebp - 0x1224]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
call esi
jmp 0x401608
mov edx, dword [ebp - 0x1220]
push ecx
push ebx
mov ecx, eax
call fcn.004010f0
add esp, 8
push dword [ebp - 0x1224]
call esi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor esi, esi
test ebx, ebx
jle 0x401683
nop dword [eax]
mov eax, dword [ebp - 0x1220]
push dword [eax + esi*4]
call edi
inc esi
add esp, 4
cmp esi, ebx
jl 0x401670
push dword [ebp - 0x1220]
call edi
push str.Program_finished_executing._Console_will_remain_open._n
call fcn.00401050
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
nop
push 0x3e8
call esi
jmp 0x4016a0
push str.search_strings.txt
push str.Failed_to_open_file:__s_n
call fcn.00401050
add esp, 8
push str.No_search_strings_loaded_from_file._Exiting..._n
call fcn.00401050
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004016de
mov esp, ebp
pop ebp
ret