Function at 0x54505830
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x5452fa36
mov eax, dword fs:[0]
push eax
mov eax, 0x2548
call fcn.545173a0
mov eax, dword [0x5454141c]
xor eax, esp
mov dword [esp + 0x2544], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5454141c]
xor eax, esp
push eax
lea eax, [esp + 0x255c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x256c]
mov eax, dword [esi + 4]
push eax
lea ecx, [esp + 0x34]
call fcn.54514f70
lea ecx, [esp + 0x30]
mov dword [esp + 0x2564], 0
call fcn.54514e50
lea ecx, [esp + 0x30]
mov ebp, eax
call fcn.54514e60
mov ebx, dword [esi]
xor esi, esi
push 0x102
lea ecx, [esp + 0x214e]
push esi
push ecx
mov edi, eax
mov byte [esp + 0x23], 0
mov byte [esp + 0x26], 0
mov byte [esp + 0x21], 0
mov byte [esp + 0x22], 0
mov byte [esp + 0x25], 0
mov byte [esp + 0x24], 0
mov word [esp + 0x2154], si
call fcn.54516b80
push 0x102
lea edx, [esp + 0x2056]
push esi
push edx
mov word [esp + 0x205c], si
call fcn.54516b80
mov esi, 1
add esp, 0x18
cmp ebp, esi
jbe 0x545059e4
lea esp, [esp]
mov eax, dword [edi + esi*4]
cmp byte [eax], 0x2d
jne 0x545059b6
movsx ecx, byte [eax + 1]
sub ecx, 0x6b
je 0x5450597a
sub ecx, 1
je 0x54505973
sub ecx, 1
jne 0x545059b6
cmp ebp, 3
jl 0x545059ef
mov al, byte [eax + 2]
cmp al, 0x70
mov byte [esp + 0x1a], 1
je 0x5450595b
cmp al, 0x73
jne 0x545059b6
mov eax, dword [edi + esi*4 + 4]
mov byte [esp + 0x16], 1
mov dword [esp + 0x2c], eax
jmp 0x545059b6
mov ecx, dword [edi + esi*4 + 4]
push ecx
mov byte [esp + 0x19], 1
call fcn.545172d6
add esp, 4
mov dword [esp + 0x1c], eax
jmp 0x545059b6
mov byte [esp + 0x17], 1
jmp 0x545059b6
cmp ebp, 3
jl 0x54505a1b
movsx eax, byte [eax + 2]
sub eax, 0x6e
je 0x545059a9
sub eax, 2
jne 0x545059b6
mov edx, dword [edi + esi*4 + 4]
push edx
mov byte [esp + 0x1d], 1
call fcn.545172d6
add esp, 4
mov dword [esp + 0x1c], eax
jmp 0x545059b6
mov eax, dword [edi + esi*4 + 4]
mov byte [esp + 0x18], 1
mov dword [esp + 0x40], eax
add esi, 1
cmp esi, ebp
jb 0x54505910
cmp byte [esp + 0x17], 0
jne 0x54505a47
cmp byte [esp + 0x15], 0
jne 0x54505a47
cmp byte [esp + 0x16], 0
jne 0x54505a47
cmp byte [esp + 0x19], 0
jne 0x54505a47
cmp byte [esp + 0x18], 0
jne 0x54505a47
push ebx
call fcn.54505810
add esp, 4
jmp 0x545059fd
push str.ps__ms_name_r_nps__mp_pid_r_n
push ebx
call fcn.54516060
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x2564], 0xffffffff
call fcn.54514e30
mov eax, 1
jmp 0x54505dba
push str.ps__kn_name_r_nps__kp_pid_r_n
push ebx
call fcn.54516060
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x2564], 0xffffffff
call fcn.54514e30
mov eax, 1
jmp 0x54505dba
lea ecx, [esp + 0x1b]
call fcn.54507fa0
lea ecx, [esp + 0x24]
push ecx
push 0x1000
lea edx, [esp + 0x104c]
push edx
mov byte [esp + 0x2570], 1
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x54505a97
push str.EnumProcesses___error._r_n
push ebx
call fcn.54516060
add esp, 8
lea ecx, [esp + 0x1b]
mov byte [esp + 0x2564], 0
call sub.ADVAPI32.dll_RevertToSelf
jmp 0x545059fd
xor esi, esi
test dword [esp + 0x24], 0xfffffffc
mov dword [esp + 0x28], esi
jbe 0x54505d93
lea ebp, [esp + 0x1044]
mov eax, dword [ebp]
push eax
push 0
push 0x410
call dword [0x5454285c]
mov edi, eax
test edi, edi
je 0x54505d1d
push 0x1000
lea ecx, [esp + 0x48]
push 0
push ecx
mov dword [esp + 0x2c], 0
call fcn.54516b80
push 0x104
lea edx, [esp + 0x2158]
push 0
push edx
call fcn.54516b80
push 0x104
lea eax, [esp + 0x2060]
push 0
push eax
call fcn.54516b80
push 0x104
lea ecx, [esp + 0x2274]
push 0
push ecx
call fcn.54516b80
push 0x104
lea edx, [esp + 0x2384]
push 0
push edx
call fcn.54516b80
push 0x104
lea eax, [esp + 0x2188]
push eax
lea ecx, [esp + 0x2088]
push ecx
push edi
call fcn.54507370
add esp, 0x4c
lea edx, [esp + 0x20]
push edx
push 0x1000
lea eax, [esp + 0x4c]
push eax
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x54505b9d
mov edx, dword [esp + 0x44]
push 0x104
lea ecx, [esp + 0x2250]
push ecx
push edx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
mov ecx, dword [esp + 0x44]
push 0x104
lea eax, [esp + 0x2354]
push eax
push ecx
push edi
call sub.PSAPI.DLL_GetModuleBaseNameA
cmp byte [esp + 0x19], 0
je 0x54505bb1
mov edx, dword [ebp]
cmp edx, dword [esp + 0x1c]
je 0x54505d38
cmp byte [esp + 0x18], 0
je 0x54505bd5
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x2354]
push ecx
call fcn.545240e4
add esp, 8
test eax, eax
je 0x54505d38
cmp byte [esp + 0x15], 0
je 0x54505bf3
mov edx, dword [esp + 0x1c]
cmp edx, dword [ebp]
jne 0x54505bf3
push str.ModulePath_tBaseAddress_r_n
push ebx
call fcn.54516060
add esp, 8
cmp byte [esp + 0x17], 0
je 0x54505c24
lea eax, [esp + 0x224c]
push eax
mov eax, dword [ebp]
lea ecx, [esp + 0x214c]
push ecx
lea edx, [esp + 0x204c]
push edx
push eax
push str._d_t_s_s_t_s_r_n
push ebx
call fcn.54516060
add esp, 0x18
cmp byte [esp + 0x1a], 0
je 0x54505d16
xor esi, esi
test dword [esp + 0x20], 0xfffffffc
jbe 0x54505d12
nop
cmp byte [esp + 0x16], 0
je 0x54505ca6
mov edx, dword [esp + esi*4 + 0x44]
push 0x104
lea ecx, [esp + 0x2354]
push ecx
push edx
push edi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x54505ca6
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esp + 0x2354]
push ecx
call fcn.545179b0
add esp, 8
test eax, eax
je 0x54505ca6
lea edx, [esp + 0x224c]
push edx
mov edx, dword [ebp]
lea eax, [esp + 0x214c]
push eax
lea ecx, [esp + 0x204c]
push ecx
push edx
push str._d_t_s_s_t_s_r_n
push ebx
call fcn.54516060
add esp, 0x18
cmp byte [esp + 0x15], 0
je 0x54505d00
mov eax, dword [esp + 0x1c]
cmp eax, dword [ebp]
jne 0x54505d12
push 0x104
lea ecx, [esp + 0x2458]
push 0
push ecx
call fcn.54516b80
mov eax, dword [esp + esi*4 + 0x50]
add esp, 0xc
push 0x104
lea edx, [esp + 0x2458]
push edx
push eax
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
mov ecx, dword [esp + esi*4 + 0x44]
push ecx
lea edx, [esp + 0x2458]
push edx
push str._s_t_0x_.8X__r_n
push ebx
call fcn.54516060
add esp, 0x10
mov eax, dword [esp + 0x20]
add esi, 1
shr eax, 2
cmp esi, eax
jb 0x54505c40
mov esi, dword [esp + 0x28]
push edi
call dword [0x54542850]
mov ecx, dword [esp + 0x24]
add esi, 1
shr ecx, 2
add ebp, 4
cmp esi, ecx
mov dword [esp + 0x28], esi
jb 0x54505ab2
jmp 0x54505d93
mov edx, dword [esp + esi*4 + 0x1044]
lea edi, [esp + esi*4 + 0x1044]
push edx
push 0
push 0x411
call dword [0x5454285c]
mov esi, eax
test esi, esi
je 0x54505d8c
push 0
push esi
call dword [0x54542864]
lea eax, [esp + 0x224c]
push eax
mov eax, dword [edi]
lea ecx, [esp + 0x214c]
push ecx
lea edx, [esp + 0x204c]
push edx
push eax
push str._d_t_s_s_t_s_r_n
push ebx
call fcn.54516060
add esp, 0x18
push esi
call dword [0x54542850]
lea ecx, [esp + 0x1b]
mov byte [esp + 0x2564], 0
call sub.ADVAPI32.dll_RevertToSelf
lea ecx, [esp + 0x30]
mov dword [esp + 0x2564], 0xffffffff
call fcn.54514e30
xor eax, eax
mov ecx, dword [esp + 0x255c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2544]
xor ecx, esp
call fcn.54516b6f
add esp, 0x2554
ret