Function at 0x10071088
Capabilities:
Enumerate process modules

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1188
call fcn.10087c20
mov ebx, dword [esp + 0x11a0]
mov eax, dword [0x100c51b8]
xor eax, esp
mov dword [esp + 0x1184], eax
lea eax, [esp + 0x13c]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
xor esi, esi
push 0x1000
push esi
push dword [esp + 0x10]
call fcn.1008c000
add esp, 0xc
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov dword [ecx], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test bl, 1
mov ecx, 0xc5b1c52f
mov edx, 0xa020e4d5
cmove edx, ecx
mov dword [esp + 0x24], edx
test bl, 0x40
mov ecx, 0xcb705401
mov edx, 0xc1fec8e8
cmove edx, ecx
mov dword [esp + 0x20], edx
test bl, 0x10
mov ecx, 0xe923701e
mov edx, 0x6d45d21f
cmove edx, ecx
mov dword [esp + 0x30], edx
test bl, 0x20
mov ecx, 0x5430a268
mov edx, 0x368e9a1
cmove edx, ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 4], eax
mov eax, 0x54efad4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, eax
cmp eax, 0xffd24e82
jle 0x100711ef
cmp ecx, 0x2cb2d817
jg 0x10071232
cmp ecx, 0x11071fdc
jle 0x1007131a
cmp ecx, 0x231626a4
jle 0x100713fe
cmp ecx, 0x231626a5
je 0x10071419
mov eax, ecx
cmp ecx, 0x246ff831
jne 0x1007114e
push 0xf
call ebx
lea eax, [esp + 0x38]
mov edi, esi
mov esi, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ebp, 0x104
push ebp
push 0
push dword [esp + 0x14]
call fcn.1008c000
add esp, 0xc
mov dword [esp], esi
mov esi, edi
mov eax, dword [esp + 0x10]
push ebp
push dword [esp + 4]
push dword [esp + eax*4 + 0x144]
push dword [esp + 0x10]
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
mov eax, 0x2cb2d818
mov ecx, 0x20d7097d
cmove eax, ecx
jmp 0x1007114e
cmp ecx, 0xc1fec8e7
jg 0x10071280
cmp ecx, 0xbd350ee4
jg 0x10071357
cmp ecx, 0x9509cd42
je 0x1007140a
cmp ecx, 0xa020e4d5
je 0x10071440
mov eax, ecx
cmp ecx, 0xb6b0cd61
je 0x1007140a
jmp 0x1007114e
cmp ecx, 0x5430a267
jg 0x10071386
cmp ecx, 0x2cb2d818
je 0x1007144f
cmp ecx, 0x2de9ec63
je 0x1007140a
mov eax, ecx
cmp ecx, 0x4ea032f7
jne 0x1007114e
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], 0
mov eax, 0x11071fdd
jmp 0x1007114e
cmp ecx, 0xd69147f9
jg 0x100713cf
cmp ecx, 0xc1fec8e8
je 0x10071467
cmp ecx, 0xc5b1c52f
je 0x1007152d
mov eax, ecx
cmp ecx, 0xcb705401
jne 0x1007114e
mov ebp, dword [esp]
xor eax, eax
mov dword [esp + 0x116c], eax
mov dword [esp + 0x117c], eax
mov dword [esp + 0x1180], 0xf
mov byte [esp + 0x116c], 0
push ebp
call fcn.1009ee80
add esp, 4
mov edi, esi
lea esi, [esp + 0x116c]
mov ecx, esi
push eax
push ebp
call fcn.10007b00
mov ecx, dword [esp + 0x119c]
push esi
lea eax, [esp + 0x1158]
push eax
call fcn.10072d16
mov ecx, esi
mov esi, edi
call fcn.100087f0
mov eax, dword [esp + 0x24]
jmp 0x1007114e
cmp ecx, 0xffd24e83
je 0x10071539
cmp ecx, 0x368e9a1
je 0x10071547
mov eax, ecx
cmp ecx, 0x54efad4
jne 0x1007114e
cmp dword [esp + 4], 0
mov eax, 0xdc397961
mov ecx, 0x59d172cc
cmove eax, ecx
jmp 0x1007114e
mov eax, dword [esp + 0x2c]
cmp ecx, 0xbd350ee5
je 0x1007114e
cmp ecx, 0xbe9ec968
je 0x10071566
mov eax, ecx
cmp ecx, 0xbea4caca
je 0x1007140a
jmp 0x1007114e
mov eax, dword [esp + 0x30]
cmp ecx, 0x5430a268
je 0x1007114e
cmp ecx, 0x59d172cc
je 0x10071578
mov eax, ecx
cmp ecx, 0x6d45d21f
jne 0x1007114e
push dword [esp]
call fcn.1006f68d
add esp, 4
test eax, eax
mov eax, 0xb6b0cd61
mov ecx, 0xe923701e
cmove eax, ecx
jmp 0x1007114e
cmp ecx, 0xd69147fa
je 0x10071589
cmp ecx, 0xdc397961
je 0x1007159c
mov eax, ecx
cmp ecx, 0xe923701e
jne 0x1007114e
mov eax, dword [esp + 0x20]
jmp 0x1007114e
cmp ecx, 0x20d7097d
jne 0x100715cb
mov esi, 4
mov eax, 0xffd24e83
jmp 0x1007114e
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
shr eax, 2
mov ecx, dword [esp + 0x10]
cmp ecx, eax
mov eax, 0x4ea032f7
mov ecx, 0x246ff831
cmovb eax, ecx
jmp 0x1007114e
mov esi, 2
mov eax, 0xffd24e83
jmp 0x1007114e
mov eax, dword [esp]
cmp byte [eax], 0
mov eax, 0xbd350ee5
mov ecx, 0xbea4caca
cmove eax, ecx
jmp 0x1007114e
mov dword [esp + 0x28], esi
mov esi, 0xf
push esi
call ebx
mov ebp, dword [esp]
xor ebx, ebx
mov dword [esp + 0x116c], ebx
mov dword [esp + 0x117c], ebx
mov dword [esp + 0x1180], esi
mov byte [esp + 0x116c], bl
push ebp
call fcn.1009ee80
add esp, 4
lea edi, [esp + 0x116c]
mov ecx, edi
push eax
push ebp
call fcn.10007b00
push edi
lea edi, [esp + 0x1158]
push edi
call fcn.1005c116
add esp, 8
mov dword [esp + 0x113c], ebx
mov dword [esp + 0x114c], ebx
mov dword [esp + 0x1150], esi
mov byte [esp + 0x113c], bl
mov ecx, edi
call fcn.1000e86e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [esp + 0x1140]
push esi
push eax
call fcn.1007d69c
add esp, 0xc
mov ebp, eax
mov ecx, esi
mov esi, dword [esp + 0x28]
call fcn.100087f0
mov ecx, edi
call fcn.1000e7f4
lea ecx, [esp + 0x116c]
call fcn.100087f0
test ebp, ebp
mov eax, 0x2de9ec63
mov ecx, 0xcb705401
cmove eax, ecx
jmp 0x1007114e
xor esi, esi
mov eax, 0xffd24e83
jmp 0x1007114e
mov eax, dword [esp + 0xc]
cmp esi, 2
mov eax, 0xd69147fa
jmp 0x100715be
push dword [esp]
call fcn.1006f2d5
add esp, 4
test eax, eax
mov eax, 0x9509cd42
mov ecx, 0x5430a268
cmove eax, ecx
jmp 0x1007114e
mov dword [esp + 0x18], 0
mov eax, 0x231626a5
jmp 0x1007114e
mov eax, 0x11071fdd
xor ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
jmp 0x1007114e
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x18], eax
mov eax, 0x231626a5
jmp 0x1007114e
lea eax, [esp + 0x34]
push eax
push 0x1000
lea eax, [esp + 0x144]
push eax
push dword [esp + 0x10]
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
mov eax, 0xbe9ec968
mov ecx, 0x4ea032f7
cmove eax, ecx
jmp 0x1007114e
mov eax, ecx
cmp ecx, 0x11071fdd
jne 0x1007114e
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x1184]
xor ecx, esp
call fcn.100879aa
mov eax, dword [esp + 0x14]
add esp, 0x1188
pop esi
pop edi
pop ebx
pop ebp
ret