Function at 0x410030
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x860
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [ebx + 0x78b8]
je 0x4100c6
cmp dword [ebx + 0x78f4], 0
jne 0x4103cd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov dword [ebx + 0x78f4], 1
mov dword [0x52fdb8], eax
mov eax, dword [ebp + 0x18]
mov dword [0x52fdc0], edx
mov edx, dword [ebp + 0x20]
mov dword [0x52fdb0], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [0x52fdd4], eax
mov eax, dword [ebp + 0x10]
push 0x52fdac
mov dword [0x52fdc8], edx
mov edx, dword [0x52fe14]
mov dword [0x52fdac], 0x30
mov dword [0x52fdd8], ecx
mov ecx, dword [ebx + 0x78f0]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
cmp byte [0x52fdaa], 0
jne 0x4103cd
push esi
push edi
push 0x228
lea eax, [ebp - 0x85c]
push 0
push eax
mov dword [ebp - 0x860], 0x22c
call fcn.004c9b50
push 0x424
lea ecx, [ebp - 0x630]
push 0
push ecx
mov dword [ebp - 0x634], 0x428
call fcn.004c9b50
mov edx, dword [ebp + 0x14]
add esp, 0x18
push edx
push 8
mov dword [ebp + 0x20], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.004c9b50
add esp, 0xc
test edi, edi
je 0x4101f0
cmp edi, 0xffffffff
je 0x4101f0
lea edx, [ebp - 0x634]
push edx
push edi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4101e9
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x62c], eax
jne 0x4101d5
cmp word [ebp - 0x20c], 0
jne 0x4101c3
cmp word [ebp - 0x414], 0
lea esi, [ebp - 0x414]
jne 0x41019b
lea esi, [ebp - 0x614]
push esi
call fcn.004c62f0
add esp, 4
push 0x4e4b38
push eax
call ebx
test eax, eax
jne 0x4101c3
push 0x104
push esi
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp + 0x18]
mov edx, eax
or edx, dword [ebp + 0x1c]
je 0x410241
cmp dword [ebp - 0x618], eax
je 0x410241
lea eax, [ebp - 0x634]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x410170
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 0x20c], 0
jne 0x410284
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x410284
cmp esi, 0xffffffff
je 0x410284
lea eax, [ebp - 0x860]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41027d
mov ecx, dword [ebp + 0x14]
cmp dword [ebp - 0x858], ecx
je 0x410264
lea edx, [ebp - 0x860]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x410223
jmp 0x41027d
cmp word [ebp - 0x414], 0
mov ebx, dword [ebp - 4]
je 0x410259
lea ecx, [ebp - 0x414]
mov dword [ebp + 0x20], ecx
jmp 0x4101e9
lea edx, [ebp - 0x614]
mov dword [ebp + 0x20], edx
jmp 0x4101e9
push 0x104
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x20], 0
jne 0x4102b4
cmp word [ebp - 0x20c], 0
je 0x4102b4
lea edx, [ebp - 0x20c]
push edx
call fcn.004c62c0
push eax
call fcn.00406ee0
add esp, 8
test al, al
je 0x4102b4
mov dword [ebp + 0x20], 0x4e7600
mov eax, dword [ebp + 0x20]
mov byte [0x52fdaa], 1
test eax, eax
je 0x4102d9
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4102c5
sub eax, edx
sar eax, 1
mov dword [ebp + 0x10], eax
jmp 0x4102e0
mov dword [ebp + 0x10], 0
lea eax, [ebx + 0x1b4]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4102f0
sub eax, edx
sar eax, 1
mov ebx, eax
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410310
mov edi, dword [ebp - 4]
sub eax, edx
sar eax, 1
add edi, 0x154
mov edx, eax
mov eax, edi
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410330
mov ecx, dword [ebp + 0x10]
sub eax, esi
sar eax, 1
add eax, edx
add eax, ebx
lea edx, [eax + ecx + 0xff]
push 2
push edx
call fcn.0044c490
mov esi, eax
mov eax, dword [ebp + 0x20]
add esp, 8
test eax, eax
je 0x410368
mov ecx, 0x4e75fc
jmp 0x41036f
mov ecx, 0x4e5034
mov eax, ecx
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 8]
push ecx
push 0x8b
push edx
push eax
mov eax, dword [ebp - 4]
add eax, 0x1b4
push eax
push edi
push str._s_received_wrong_version_packet__n_s_n_nCommandID:__i__Version:__i__ReqVersion:__i__PID:__u_n_s_n_s_n_sPlease_check_installation_files
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [ebp - 4]
push 1
push 0xffffffffffffffff
lea ecx, [edi + 0x4a68]
push ecx
push 0x40
push esi
call fcn.004262f0
add esp, 0x40
push esi
call fcn.0044c4f0
add esp, 4
mov dword [edi + 0x78f4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c