Function at 0x42ac48
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffec8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x1134], eax
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x112c], eax
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1124], eax
xor eax, eax
push ebp
push 0x42af27
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4339c4], 0
jne 0x42acb1
mov dl, 1
mov eax, dword [0x41a680]
call fcn.004038f8
mov dword [0x4339c4], eax
jmp 0x42ad00
mov eax, dword [0x4339c4]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x42acf6
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, dword [0x4339c4]
call fcn.0041bbf4
mov esi, eax
cmp dword [esi + 0x108], 0
je 0x42aceb
mov eax, dword [esi + 0x108]
call fcn.00403928
xor eax, eax
mov dword [esi + 0x108], eax
mov eax, esi
call fcn.00402994
inc ebx
dec edi
jne 0x42acc1
mov eax, dword [0x4339c4]
mov edx, dword [eax]
call dword [edx + 8]
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42af09
lea eax, [ebp - 8]
push eax
push 0x1000
lea eax, [ebp - 0x100c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.psapi.dll_EnumProcessModules
test eax, eax
je 0x42aef1
mov eax, dword [ebp - 8]
shr eax, 2
mov dword [ebp - 8], eax
mov edi, dword [ebp - 8]
dec edi
test edi, edi
jl 0x42aef1
inc edi
lea ebx, [ebp - 0x100c]
lea eax, [ebp - 0x1110]
xor ecx, ecx
mov edx, 0x104
call fcn.0040321c
lea eax, [ebp - 0x111c]
xor ecx, ecx
mov edx, 0xc
call fcn.0040321c
push 0x104
lea eax, [ebp - 0x1110]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.psapi.dll_GetModuleFileNameExA
test eax, eax
jbe 0x42aee7
push 0xc
lea eax, [ebp - 0x111c]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.psapi.dll_GetModuleInformation
test eax, eax
je 0x42aee7
mov eax, 0x10c
call fcn.00402974
mov esi, eax
lea eax, [ebp - 0x1124]
lea edx, [ebp - 0x1110]
mov ecx, 0x104
call fcn.0040494c
mov eax, dword [ebp - 0x1124]
lea edx, [ebp - 0x1120]
call fcn.0040a744
mov edx, dword [ebp - 0x1120]
mov eax, esi
mov ecx, 0xff
call fcn.00404978
mov eax, dword [ebp - 0x111c]
mov dword [esi + 0x100], eax
mov eax, dword [ebp - 0x1118]
mov dword [esi + 0x104], eax
lea eax, [ebp - 0x1130]
lea edx, [ebp - 0x1110]
mov ecx, 0x104
call fcn.0040494c
mov eax, dword [ebp - 0x1130]
lea edx, [ebp - 0x112c]
call fcn.00409c7c
mov eax, dword [ebp - 0x112c]
lea edx, [ebp - 0x1128]
call fcn.0040a77c
mov eax, dword [ebp - 0x1128]
mov edx, 0x42af40
call fcn.00404ae0
je 0x42aed3
lea eax, [ebp - 0x1134]
lea edx, [ebp - 0x1110]
mov ecx, 0x104
call fcn.0040494c
mov edx, dword [ebp - 0x1134]
mov eax, dword [0x429c4c]
call fcn.0042a6a8
cmp edx, 0
jne 0x42ae96
cmp eax, 0
jbe 0x42aed3
jmp 0x42ae98
jle 0x42aed3
mov dl, 1
mov eax, dword [0x429c4c]
call fcn.00429ca0
mov dword [esi + 0x108], eax
lea eax, [ebp - 0x1138]
lea edx, [ebp - 0x1110]
mov ecx, 0x104
call fcn.0040494c
mov edx, dword [ebp - 0x1138]
mov eax, dword [esi + 0x108]
call fcn.0042a8a8
jmp 0x42aedb
xor eax, eax
mov dword [esi + 0x108], eax
mov edx, esi
mov eax, dword [0x4339c4]
call fcn.0041bab8
add ebx, 4
dec edi
jne 0x42ad5c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, 0x42ac20
mov eax, dword [0x4339c4]
call fcn.0041be20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42af2e
lea eax, [ebp - 0x1138]
mov edx, 7
call fcn.00404708
ret