Function at 0x40c486
Capabilities:
Enumerate process modules
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad506
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1524
call fcn.00492330
mov eax, dword [0x505ef8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [0x507340]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14c0], eax
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
push 0x12
cdq
pop ecx
idiv ecx
mov edi, dword [ebp + 8]
cmp edx, 0x11
jne 0x40c4f3
xor eax, eax
inc eax
test esi, esi
cmove esi, eax
mov dword [0x507340], esi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x14f4]
call fcn.0042f326
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14bc], ebx
mov dword [ebp - 0x14b8], ebx
mov dword [ebp - 0x14b4], ebx
push 0x4c19b4
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0042f676
sub esp, 0x18
mov ecx, eax
push esp
call fcn.0042fc5e
lea eax, [ebp - 0x14a0]
push eax
call fcn.00437fc7
add esp, 0x1c
push 3
pop eax
mov esi, 0x4c1ac0
push esi
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00430238
test al, al
je 0x40c5a0
push esi
mov ecx, edi
call fcn.0042f676
mov ecx, eax
call fcn.00430218
test al, al
je 0x40c5a0
push esi
mov ecx, edi
call fcn.0042f676
mov ecx, eax
call fcn.0042fb76
mov dword [ebp - 0x1498], eax
test eax, eax
je 0x40c5a0
lea eax, [ebp - 0x1498]
push eax
lea ecx, [ebp - 0x14bc]
call fcn.00411545
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40c741
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c672
push 0x505ab0
lea ecx, [ebp - 0x1490]
call fcn.00408fd9
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1490]
push str.enumModules_CreateToolhelp32Snapshot_process__d
push eax
call fcn.00405092
add esp, 0xc
lea eax, [ebp - 0x1490]
push eax
lea eax, [ebp - 0x1044]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x1504]
mov byte [ebp - 4], 5
call fcn.0042f275
push 0x4c0c00
lea ecx, [ebp - 0x14f4]
mov byte [ebp - 4], 6
call fcn.0042f5f2
lea ecx, [ebp - 0x1504]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x1504]
mov byte [ebp - 4], 5
call fcn.0042f451
lea ecx, [ebp - 0x1044]
call fcn.00401056
mov ecx, dword [ebp - 0x1490]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x14a0]
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x14bc]
call fcn.00409cac
mov byte [ebp - 4], bl
jmp 0x40ce1d
mov edi, 0x22c
push edi
lea eax, [ebp - 0x1290]
push ebx
push eax
call fcn.004913e0
add esp, 0xc
lea eax, [ebp - 0x1290]
push eax
push esi
mov dword [ebp - 0x1290], edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40ccdb
mov edx, dword [0x507340]
push 3
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
pop ecx
idiv ecx
cmp edx, 2
jne 0x40c6c6
inc dword [0x507554]
lea eax, [ebp - 0x126c]
push eax
lea ecx, [ebp - 0x1490]
call fcn.00401b1e
lea ecx, [ebp - 0x1490]
mov byte [ebp - 4], 7
call fcn.00409791
push ebx
push dword [ebp - 0x1490]
lea ecx, [ebp - 0x14a0]
call fcn.004095ae
test eax, eax
js 0x40c70f
lea eax, [ebp - 0x1288]
push eax
lea ecx, [ebp - 0x14bc]
call fcn.00411545
mov ecx, dword [ebp - 0x1490]
push 3
pop eax
lea ecx, [ecx - 0x10]
mov byte [ebp - 4], al
call fcn.00407864
lea eax, [ebp - 0x1290]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40c6a3
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov esi, dword [ebp - 0x14bc]
mov ecx, ebx
mov eax, dword [ebp - 0x14b8]
sub eax, esi
sar eax, 2
mov dword [ebp - 0x1490], ecx
cmp ecx, eax
jae 0x40cc6b
push dword [esi + ecx*4]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x149c], eax
test eax, eax
je 0x40cc5f
push ebx
lea ecx, [ebp - 0x14e4]
call fcn.0042f326
xor eax, eax
push 0x7fe
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push ebx
push eax
mov byte [ebp - 4], 0xb
call fcn.004913e0
add esp, 0xc
lea eax, [ebp - 0x1014]
push 0x800
push eax
push dword [ebp - 0x149c]
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x40c823
push 0x505ab0
lea ecx, [ebp - 0x14d4]
call fcn.00408fd9
mov byte [ebp - 4], 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14d4]
push str.enumModules_GetProcessImageFileName__d
push eax
call fcn.00405092
add esp, 0xc
push dword [ebp - 0x149c]
call edi
mov ecx, dword [ebp - 0x14d4]
lea ecx, [ecx - 0x10]
call fcn.00407864
push 3
pop eax
lea ecx, [ebp - 0x14e4]
mov byte [ebp - 4], al
call fcn.0042f451
jmp 0x40cc5f
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1494]
call fcn.00401b1e
lea eax, [ebp - 0x1494]
push eax
lea eax, [ebp - 0x102c]
push eax
mov byte [ebp - 4], 0xd
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x1534]
mov byte [ebp - 4], 0xe
call fcn.0042f275
push str.process
lea ecx, [ebp - 0x14e4]
mov byte [ebp - 4], 0xf
call fcn.0042f5f2
lea ecx, [ebp - 0x1534]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x1534]
mov byte [ebp - 4], 0xe
call fcn.0042f451
lea ecx, [ebp - 0x102c]
mov byte [ebp - 4], 0xd
call fcn.00401056
mov eax, dword [ebp - 0x1490]
lea ecx, [ebp - 0x1524]
push dword [esi + eax*4]
call fcn.0042f2b1
push 0x4c1ac0
lea ecx, [ebp - 0x14e4]
mov byte [ebp - 4], 0x10
call fcn.0042f5f2
lea ecx, [ebp - 0x1524]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x1524]
mov byte [ebp - 4], 0xd
call fcn.0042f451
push ebx
lea ecx, [ebp - 0x1504]
call fcn.0042f326
mov eax, dword [ebp - 0x1490]
mov byte [ebp - 4], 0x11
push dword [esi + eax*4]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x14a4], esi
cmp esi, 0xffffffff
jne 0x40c9d5
push 0x505ab0
lea ecx, [ebp - 0x14a8]
call fcn.00408fd9
mov byte [ebp - 4], 0x12
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14a8]
push str.enumModules_CreateToolhelp32Snapshot_moudules__d
push eax
call fcn.00405092
add esp, 0xc
lea eax, [ebp - 0x14a8]
push eax
lea eax, [ebp - 0x102c]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x1514]
mov byte [ebp - 4], 0x13
call fcn.0042f275
push 0x4c0c00
lea ecx, [ebp - 0x14e4]
mov byte [ebp - 4], 0x14
call fcn.0042f5f2
lea ecx, [ebp - 0x1514]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x1514]
mov byte [ebp - 4], 0x13
call fcn.0042f451
lea ecx, [ebp - 0x102c]
mov byte [ebp - 4], 0x12
call fcn.00401056
lea eax, [ebp - 0x14e4]
push eax
lea ecx, [ebp - 0x14f4]
call fcn.0042fa35
push dword [ebp - 0x149c]
call edi
mov ecx, dword [ebp - 0x14a8]
lea ecx, [ecx - 0x10]
call fcn.00407864
jmp 0x40cc2b
lea eax, [ebp - 0x148c]
push eax
push esi
mov dword [ebp - 0x148c], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x40cb39
xor eax, eax
push 0x7fe
mov word [ebp - 0x814], ax
lea eax, [ebp - 0x812]
push ebx
push eax
call fcn.004913e0
add esp, 0xc
call fcn.004111f5
test al, al
jne 0x40ca50
push 0x28
call fcn.0048dbeb
pop ecx
mov edi, eax
mov esi, ebx
call fcn.0048f9e0
add eax, dword [0x507340]
mov dword [edi + esi*4], eax
inc esi
cmp esi, 0xa
jl 0x40ca27
mov eax, dword [edi + 0x24]
push edi
mov dword [0x507340], eax
call fcn.0048fbd7
mov esi, dword [ebp - 0x14a4]
pop ecx
push 0x800
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x1470]
push dword [ebp - 0x149c]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x40caa8
push 0x505ab0
lea ecx, [ebp - 0x14b0]
call fcn.00408fd9
mov byte [ebp - 4], 0x15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14b0]
push str.enumModules_GetModuleFileNameEx__d
push eax
call fcn.00405092
mov ecx, dword [ebp - 0x14b0]
add esp, 0xc
jmp 0x40cb13
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x1498]
call fcn.00401b1e
lea eax, [ebp - 0x1498]
push eax
lea eax, [ebp - 0x102c]
push eax
mov byte [ebp - 4], 0x16
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x103c]
mov byte [ebp - 4], 0x17
call fcn.0042f275
push eax
lea ecx, [ebp - 0x1504]
mov byte [ebp - 4], 0x18
call fcn.0042fa35
lea ecx, [ebp - 0x103c]
mov byte [ebp - 4], 0x17
call fcn.0042f451
lea ecx, [ebp - 0x102c]
call fcn.00401056
mov ecx, dword [ebp - 0x1498]
lea ecx, [ecx - 0x10]
mov byte [ebp - 4], 0x11
call fcn.00407864
lea eax, [ebp - 0x148c]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x40c9f4
jmp 0x40cbdb
push 0x505ab0
lea ecx, [ebp - 0x14ac]
call fcn.00408fd9
mov byte [ebp - 4], 0x19
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14ac]
push str.enumModules_CreateToolhelp32Snapshot_moudules__d
push eax
call fcn.00405092
add esp, 0xc
lea eax, [ebp - 0x14ac]
push eax
lea eax, [ebp - 0x102c]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x14d0]
mov byte [ebp - 4], 0x1a
call fcn.0042f275
push 0x4c0c00
lea ecx, [ebp - 0x14e4]
mov byte [ebp - 4], 0x1b
call fcn.0042f5f2
lea ecx, [ebp - 0x14d0]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x14d0]
mov byte [ebp - 4], 0x1a
call fcn.0042f451
lea ecx, [ebp - 0x102c]
call fcn.00401056
mov ecx, dword [ebp - 0x14ac]
mov byte [ebp - 4], 0x11
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x1504]
call fcn.00430510
test eax, eax
je 0x40cc08
push str.modules
lea ecx, [ebp - 0x14e4]
call fcn.0042f5f2
lea ecx, [ebp - 0x1504]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea eax, [ebp - 0x14e4]
push eax
lea ecx, [ebp - 0x14f4]
call fcn.0042fa35
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push dword [ebp - 0x149c]
call edi
lea ecx, [ebp - 0x1504]
mov byte [ebp - 4], 0xd
call fcn.0042f451
mov ecx, dword [ebp - 0x1494]
lea ecx, [ecx - 0x10]
call fcn.00407864
push 3
pop eax
lea ecx, [ebp - 0x14e4]
mov byte [ebp - 4], al
call fcn.0042f451
mov esi, dword [ebp - 0x14bc]
mov ecx, dword [ebp - 0x1490]
inc ecx
jmp 0x40c749
lea ecx, [ebp - 0x14f4]
call fcn.0042fe3a
test al, al
je 0x40ccbd
push str.empty
lea ecx, [ebp - 0x14d0]
call fcn.0042f2f7
push 0x4c0c00
lea ecx, [ebp - 0x14f4]
mov byte [ebp - 4], 0x1c
call fcn.0042f5f2
lea ecx, [ebp - 0x14d0]
push ecx
mov ecx, eax
call fcn.0042f4ab
push 3
pop eax
lea ecx, [ebp - 0x14d0]
mov byte [ebp - 4], al
call fcn.0042f451
mov ecx, dword [ebp - 0x14a0]
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x14bc]
call fcn.00409cac
jmp 0x40ce1a
push 0x505ab0
lea ecx, [ebp - 0x1494]
call fcn.00408fd9
mov byte [ebp - 4], 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1494]
push str.enumModules_Process32First__d
push eax
call fcn.00405092
add esp, 0xc
lea eax, [ebp - 0x1494]
push eax
lea eax, [ebp - 0x102c]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x14d0]
mov byte [ebp - 4], 9
call fcn.0042f275
push 0x4c0c00
lea ecx, [ebp - 0x14f4]
mov byte [ebp - 4], 0xa
call fcn.0042f5f2
lea ecx, [ebp - 0x14d0]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x14d0]
mov byte [ebp - 4], 9
call fcn.0042f451
lea ecx, [ebp - 0x102c]
call fcn.00401056
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1494]
jmp 0x40c649
mov dword [ebp - 4], ebx
push 8
xor edi, edi
pop esi
inc edi
call fcn.00411254
test al, al
jne 0x40ce32
inc dword [0x507340]
lea ecx, [ebp - 0x1064]
call fcn.00430a82
mov ecx, dword [0x507340]
push 0x18
lea eax, [ecx + 1]
imul eax, ecx
cdq
pop ecx
idiv ecx
mov byte [ebp - 4], 0x21
cmp edx, 9
jne 0x40ce68
push 4
call fcn.0048e498
pop ecx
mov ecx, dword [0x507340]
mov dword [eax], ecx
push 0x505ab0
lea ecx, [ebp - 0x1498]
call fcn.00408fd9
lea eax, [ebp - 0x14f4]
push eax
lea eax, [ebp - 0x102c]
push eax
lea ecx, [ebp - 0x1064]
mov byte [ebp - 4], 0x22
call fcn.00432bf9
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0x23
jb 0x40cea1
mov eax, dword [eax]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401027
lea eax, [ebp - 0x14a4]
push eax
call fcn.00437fc7
add esp, 0x1c
push eax
lea ecx, [ebp - 0x1498]
mov byte [ebp - 4], 0x24
call fcn.00402394
mov ecx, dword [ebp - 0x14a4]
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x102c]
mov byte [ebp - 4], 0x22
call fcn.00401056
mov eax, dword [ebp - 0x14c0]
mov word [eax], si
mov esi, dword [ebp - 0x1498]
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x40cf0a
call fcn.00409bd9
mov ecx, dword [ebp - 0x14c0]
mov dword [ecx + 8], eax
call fcn.00411296
test al, al
jne 0x40cf38
mov ecx, dword [0x507340]
cmp ecx, edi
jle 0x40cf32
mov eax, ecx
cdq
idiv edi
inc edi
add edi, edx
cmp edi, ecx
jl 0x40cf26
mov dword [0x507340], edi
lea ecx, [esi - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x1064]
mov byte [ebp - 4], bl
call fcn.004090f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14f4]
call fcn.0042f451
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048f354
leave
ret