Function at 0x401e10
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x574
mov eax, dword [0x42fce0]
xor eax, esp
mov dword [esp + 0x570], eax
push ebp
mov ebp, dword [esp + 0x57c]
mov ecx, str.qq.exe
mov eax, ebp
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401e53
test dl, dl
je 0x401e4f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401e53
add eax, 2
add ecx, 2
test dl, dl
jne 0x401e33
xor eax, eax
jmp 0x401e58
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402658
mov ecx, str.tm.exe
mov eax, ebp
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401e87
test dl, dl
je 0x401e83
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401e87
add eax, 2
add ecx, 2
test dl, dl
jne 0x401e67
xor eax, eax
jmp 0x401e8c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402658
push esi
push 0x103
lea eax, [esp + 0x271]
push 0
push eax
mov byte [esp + 0x278], 0
call fcn.00413280
mov ecx, dword [esp + 0x590]
add esp, 0xc
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40263f
lea edx, [esp + 0xc]
push edx
push 4
lea eax, [esp + 0x10]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x401f01
mov edx, dword [esp + 8]
push 0x104
lea ecx, [esp + 0x270]
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x26c]
push eax
call fcn.00424497
lea eax, [esp + 0x270]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401f22
sub eax, edx
je 0x40263f
lea ecx, [esp + 0x26c]
push 0x5c
push ecx
call fcn.00411f40
add esp, 8
test eax, eax
je 0x40263f
push 0x103
lea edx, [esp + 0x479]
push 0
mov byte [eax], 0
push edx
mov byte [esp + 0x480], 0
call fcn.00413280
push str.qq.exe
lea eax, [esp + 0x27c]
push eax
lea ecx, [esp + 0x488]
push str._s_s
push ecx
call fcn.00411f6d
lea edx, [esp + 0x490]
push 0
push edx
call fcn.004120b2
add esp, 0x24
test eax, eax
je 0x40263f
push 0x103
lea eax, [esp + 0x375]
push 0
push eax
mov byte [esp + 0x37c], 0
call fcn.00413280
push str.Common.dll
lea ecx, [esp + 0x27c]
push ecx
lea edx, [esp + 0x384]
push str._s_s
push edx
call fcn.00411f6d
lea eax, [esp + 0x38c]
push 0
push eax
call fcn.004120b2
add esp, 0x24
cmp eax, 0xffffffff
je 0x40263f
push str.KernelUtil.dll
lea ecx, [esp + 0x270]
push ecx
lea edx, [esp + 0x378]
push str._s_s
push edx
call fcn.00411f6d
lea eax, [esp + 0x380]
push 0
push eax
call fcn.004120b2
add esp, 0x18
cmp eax, 0xffffffff
je 0x40263f
push str.AppCom.dll
lea ecx, [esp + 0x270]
push ecx
lea edx, [esp + 0x378]
push str._s_s
push edx
call fcn.00411f6d
lea eax, [esp + 0x380]
push 0
push eax
call fcn.004120b2
add esp, 0x18
cmp eax, 0xffffffff
je 0x40263f
push str.IM.dll
lea ecx, [esp + 0x270]
push ecx
lea edx, [esp + 0x378]
push str._s_s
push edx
call fcn.00411f6d
lea eax, [esp + 0x380]
push 0
push eax
call fcn.004120b2
add esp, 0x18
cmp eax, 0xffffffff
je 0x40263f
mov eax, dword [0x429afc]
mov ecx, dword [str.txplatform.exe]
mov edx, dword [0x429af8]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x23], eax
mov dword [esp + 0x27], eax
mov dword [esp + 0x2b], eax
mov dword [esp + 0x2f], eax
mov dword [esp + 0x33], eax
mov dword [esp + 0x37], eax
mov dword [esp + 0x3b], eax
mov dword [esp + 0x3f], eax
mov word [esp + 0x43], ax
mov byte [esp + 0x45], al
mov eax, dword [str.txopshow.exe]
mov dword [esp + 0x46], eax
mov al, byte [0x429b10]
mov byte [esp + 0x52], al
xor eax, eax
mov dword [esp + 0x14], ecx
movzx ecx, word [0x429b00]
mov dword [esp + 0x18], edx
movzx edx, byte [0x429b02]
mov dword [esp + 0x53], eax
mov dword [esp + 0x57], eax
mov dword [esp + 0x5b], eax
mov dword [esp + 0x5f], eax
mov dword [esp + 0x63], eax
mov dword [esp + 0x67], eax
mov dword [esp + 0x6b], eax
mov dword [esp + 0x6f], eax
mov dword [esp + 0x73], eax
mov byte [esp + 0x77], al
movzx eax, word [0x429b1c]
mov word [esp + 0x20], cx
mov ecx, dword [0x429b08]
mov byte [esp + 0x22], dl
mov edx, dword [0x429b0c]
mov word [esp + 0x80], ax
xor eax, eax
mov dword [esp + 0x4a], ecx
mov ecx, dword [str.timwp.exe]
mov dword [esp + 0x4e], edx
mov edx, dword [0x429b18]
mov dword [esp + 0x82], eax
mov dword [esp + 0x86], eax
mov dword [esp + 0x8a], eax
mov dword [esp + 0x8e], eax
mov dword [esp + 0x92], eax
mov dword [esp + 0x96], eax
mov dword [esp + 0x9a], eax
mov dword [esp + 0x9e], eax
mov dword [esp + 0xa2], eax
mov dword [esp + 0xa6], eax
mov eax, dword [0x429b28]
mov dword [esp + 0x78], ecx
mov ecx, dword [str.storagetool.exe]
mov dword [esp + 0x7c], edx
mov edx, dword [0x429b24]
mov dword [esp + 0xb2], eax
xor eax, eax
mov dword [esp + 0xaa], ecx
mov ecx, dword [0x429b2c]
mov dword [esp + 0xae], edx
mov edx, dword [str.qqsafeud.exe]
mov dword [esp + 0xba], eax
mov dword [esp + 0xbe], eax
mov dword [esp + 0xc2], eax
mov dword [esp + 0xc6], eax
mov dword [esp + 0xca], eax
mov dword [esp + 0xce], eax
mov dword [esp + 0xd2], eax
mov dword [esp + 0xd6], eax
mov word [esp + 0xda], ax
mov eax, dword [0x429b34]
mov dword [esp + 0xb6], ecx
mov ecx, dword [0x429b38]
push edi
mov dword [esp + 0xe0], edx
mov dword [esp + 0xe4], eax
movzx edx, byte [0x429b3c]
xor eax, eax
mov dword [esp + 0xed], eax
mov dword [esp + 0xf1], eax
mov dword [esp + 0xf5], eax
mov dword [esp + 0xf9], eax
mov dword [esp + 0xfd], eax
mov dword [esp + 0x101], eax
mov dword [esp + 0x105], eax
mov dword [esp + 0x109], eax
mov dword [esp + 0x10d], eax
mov byte [esp + 0x111], al
mov eax, dword [str.qqpi.exe]
mov byte [esp + 0xec], dl
movzx edx, byte [0x429b48]
push 0x29
mov dword [esp + 0x116], eax
mov dword [esp + 0xec], ecx
mov ecx, dword [0x429b44]
lea eax, [esp + 0x11f]
push 0
push eax
mov dword [esp + 0x122], ecx
mov byte [esp + 0x126], dl
call fcn.00413280
mov eax, dword [0x429b54]
mov ecx, dword [str.qqexternal.exe]
mov edx, dword [0x429b50]
mov dword [esp + 0x158], eax
xor eax, eax
mov dword [esp + 0x15f], eax
mov dword [esp + 0x163], eax
mov dword [esp + 0x167], eax
mov dword [esp + 0x16b], eax
mov dword [esp + 0x16f], eax
mov dword [esp + 0x173], eax
mov dword [esp + 0x177], eax
mov dword [esp + 0x17b], eax
mov word [esp + 0x17f], ax
mov byte [esp + 0x181], al
mov eax, dword [str.bugreport.exe]
mov dword [esp + 0x182], eax
movzx eax, word [0x429b68]
mov dword [esp + 0x150], ecx
movzx ecx, word [0x429b58]
mov dword [esp + 0x154], edx
movzx edx, byte [0x429b5a]
mov word [esp + 0x18e], ax
xor eax, eax
mov dword [esp + 0x190], eax
mov dword [esp + 0x194], eax
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], eax
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x1ac], eax
mov dword [esp + 0x1b0], eax
movzx eax, word [0x429b74]
mov word [esp + 0x15c], cx
mov ecx, dword [0x429b60]
mov byte [esp + 0x15e], dl
mov edx, dword [0x429b64]
add esp, 0xc
mov dword [esp + 0x17a], ecx
mov ecx, dword [str.auclt.exe]
mov dword [esp + 0x17e], edx
mov edx, dword [0x429b70]
mov word [esp + 0x1b0], ax
xor eax, eax
mov dword [esp + 0x1a8], ecx
mov dword [esp + 0x1ac], edx
mov dword [esp + 0x1b2], eax
mov dword [esp + 0x1b6], eax
mov dword [esp + 0x1ba], eax
mov dword [esp + 0x1be], eax
mov dword [esp + 0x1c2], eax
mov dword [esp + 0x1c6], eax
mov dword [esp + 0x1ca], eax
mov dword [esp + 0x1ce], eax
mov dword [esp + 0x1d2], eax
mov ecx, dword [str.selfupdate.exe]
mov edx, dword [0x429b7c]
mov dword [esp + 0x1d6], eax
mov eax, dword [0x429b80]
mov dword [esp + 0x1e2], eax
xor eax, eax
mov dword [esp + 0x1e9], eax
mov dword [esp + 0x1ed], eax
mov dword [esp + 0x1f1], eax
mov dword [esp + 0x1f5], eax
mov dword [esp + 0x1f9], eax
mov dword [esp + 0x1fd], eax
mov dword [esp + 0x201], eax
mov dword [esp + 0x205], eax
mov word [esp + 0x209], ax
mov byte [esp + 0x20b], al
mov eax, dword [str.tsfscan.exe]
mov dword [esp + 0x1da], ecx
movzx ecx, word [0x429b84]
mov dword [esp + 0x1de], edx
movzx edx, byte [0x429b86]
mov dword [esp + 0x20c], eax
xor eax, eax
mov word [esp + 0x1e6], cx
mov ecx, dword [0x429b8c]
mov byte [esp + 0x1e8], dl
mov edx, dword [0x429b90]
mov dword [esp + 0x218], eax
mov dword [esp + 0x21c], eax
mov dword [esp + 0x220], eax
mov dword [esp + 0x224], eax
mov dword [esp + 0x228], eax
mov dword [esp + 0x22c], eax
mov dword [esp + 0x230], eax
mov dword [esp + 0x234], eax
mov dword [esp + 0x238], eax
mov word [esp + 0x23c], ax
mov eax, dword [str.txupd.exe]
mov dword [esp + 0x210], ecx
mov ecx, dword [0x429b98]
mov dword [esp + 0x214], edx
mov dx, word [0x429b9c]
mov dword [esp + 0x23e], eax
xor eax, eax
mov dword [esp + 0x242], ecx
mov word [esp + 0x246], dx
mov dword [esp + 0x248], eax
mov dword [esp + 0x24c], eax
mov dword [esp + 0x250], eax
mov dword [esp + 0x254], eax
mov dword [esp + 0x258], eax
mov dword [esp + 0x25c], eax
mov dword [esp + 0x260], eax
mov dword [esp + 0x264], eax
mov dword [esp + 0x268], eax
mov dword [esp + 0x26c], eax
xor edi, edi
lea esi, [esp + 0x18]
mov ecx, ebp
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4025f6
test dl, dl
je 0x4025f2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4025f6
add eax, 2
add ecx, 2
test dl, dl
jne 0x4025d6
xor eax, eax
jmp 0x4025fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402625
inc edi
add esi, 0x32
cmp edi, 0xc
jl 0x4025d2
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x570]
xor ecx, esp
call fcn.004116ac
add esp, 0x574
ret
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x570]
xor ecx, esp
call fcn.004116ac
add esp, 0x574
ret
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x570]
xor ecx, esp
call fcn.004116ac
add esp, 0x574
ret
mov ecx, dword [esp + 0x574]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.004116ac
add esp, 0x574
ret