Function at 0x409170
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509f68
mov eax, dword fs:[0]
push eax
mov eax, 0x2034
call fcn.004eaac0
mov eax, dword [0x567680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xffc
lea eax, [ebp - 0x200c]
push 0
push eax
mov dword [ebp - 4], 1
mov byte [ebp - 0x2011], 0
mov dword [ebp - 0x2010], 0
call fcn.004eaaf0
add esp, 0xc
lea eax, [ebp - 0x2020]
push eax
push 0x4000
lea eax, [ebp - 0x2010]
push eax
mov dword [ebp - 0x2020], 0
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x4091fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x2020]
shr eax, 2
xor ecx, ecx
or ebx, 0xffffffff
mov dword [ebp - 0x2020], eax
mov dword [ebp - 0x2034], ecx
test eax, eax
je 0x409636
mov edi, edi
lea eax, [ebp - 0x2010]
push dword [eax + ecx*4]
lea eax, [eax + ecx*4]
push 0
push 0x410
mov dword [ebp - 0x201c], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x2038], esi
test esi, esi
je 0x40960f
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.004eaaf0
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x800
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
mov eax, dword [0x5671f0]
mov ecx, 0x5671f0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2024], esi
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 2
test eax, 0xffff0000
jne 0x4092c7
movzx edi, ax
push 0
push edi
call fcn.00403090
add esp, 8
test eax, eax
je 0x4092f8
push edi
push eax
lea ecx, [ebp - 0x2024]
call fcn.004082e0
jmp 0x4092f2
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4092d0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x2024]
call fcn.0040b9d0
mov esi, dword [ebp - 0x2024]
mov eax, dword [0x5671f0]
push ecx
mov edi, esp
mov ecx, 0x5671f0
mov byte [ebp - 4], 3
mov dword [ebp - 0x2018], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, str.1029343c20233e293e62293429
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x40934e
movzx eax, ax
push 0
push eax
call fcn.00403090
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x40935c
mov edx, str.1029343c20233e293e62293429
movzx eax, dx
push eax
push ecx
mov ecx, edi
call fcn.004082e0
jmp 0x40935c
push 0x1a
push str.1029343c20233e293e62293429
mov ecx, edi
call fcn.0040b9d0
lea eax, [ebp - 0x203c]
push eax
mov byte [ebp - 4], 3
call fcn.004126a0
mov eax, dword [eax]
add esp, 8
test eax, eax
jne 0x40937a
or eax, 0xffffffff
jmp 0x40939c
cmp dword [esi - 0xc], 0
jge 0x409385
or eax, 0xffffffff
jmp 0x40939c
push eax
push esi
call fcn.004ea1ea
add esp, 8
test eax, eax
jne 0x409398
or eax, 0xffffffff
jmp 0x40939c
sub eax, esi
sar eax, 1
mov edx, dword [ebp - 0x203c]
cmp eax, 0xffffffff
setne byte [ebp - 0x2012]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4093c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x2012], 0
je 0x4095dd
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x1010], ax
lea eax, [ebp - 0x100e]
push eax
call fcn.004eaaf0
add esp, 0xc
lea eax, [ebp - 0x1010]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x5671f0]
mov ecx, 0x5671f0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2028], eax
mov eax, dword [0x5671f0]
mov ecx, 0x5671f0
mov byte [ebp - 4], 5
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x202c], eax
mov eax, dword [ebp - 0x201c]
mov byte [ebp - 4], 6
push dword [eax]
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x2028]
push eax
call fcn.00410590
mov eax, dword [0x5671f0]
add esp, 0xc
mov ecx, 0x5671f0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x201c], eax
push dword [ebp - 0x2028]
lea eax, [ebp - 0x201c]
push dword [ebp - 0x202c]
mov byte [ebp - 4], 7
push 0x519984
push eax
call fcn.00405320
mov eax, dword [0x5671f0]
add esp, 0x10
mov ecx, 0x5671f0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2030], eax
mov byte [ebp - 4], 8
call fcn.004e9fd1
push eax
push ecx
mov ecx, esp
push str.1829213c182d3f276928
call fcn.00401c30
lea eax, [ebp - 0x2040]
push eax
call fcn.004126a0
add esp, 8
push dword [eax]
lea eax, [ebp - 0x2030]
push eax
mov byte [ebp - 4], 9
call fcn.00405320
mov edx, dword [ebp - 0x2040]
add edx, 0xfffffff0
add esp, 0xc
mov byte [ebp - 4], 8
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409504
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp - 0x201c]
push 0
push 0
push ecx
add eax, 0xfffffff0
mov edi, esp
push eax
mov dword [ebp - 0x2018], eax
call fcn.00405030
add eax, 0x10
mov dword [edi], eax
add esp, 4
lea eax, [ebp - 0x2030]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00423770
add esp, 0x18
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0x2030]
add edx, 0xfffffff0
mov byte [ebp - 0x2011], 1
mov byte [ebp - 4], 7
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409577
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2018]
mov byte [ebp - 4], 6
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409597
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x202c]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4095ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2028]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4095dd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x2038]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0xfffffff0
mov byte [ebp - 4], 1
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
cmp byte [ebp - 0x2011], 0
jne 0x40962a
test ecx, ecx
jg 0x40960f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x2034]
inc ecx
mov dword [ebp - 0x2034], ecx
cmp ecx, dword [ebp - 0x2020]
jb 0x409220
jmp 0x409636
test ecx, ecx
jg 0x409636
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409656
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 0xc]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x409677
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0x2011]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9514
mov esp, ebp
pop ebp
ret 8