Function at 0x43dedf
Capabilities:
Enumerate process modules

Disassembly:
push ebp
push ebx
mov edx, 0x115
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x43dee6
call fcn.0055ab90
mov edx, dword [esp + 0x464]
lea ecx, [esp]
call fcn.004f4000
mov dword [section..data], 0x150005d
mov dword [section..data], 0x1500062
mov dword [esp + 4], 0
mov dword [section..data], 0x1500063
mov dword [esp + 8], 0
mov dword [section..data], 0x1500064
mov edx, 0x6355da
lea ecx, [esp + 0xc]
call fcn.004f4008
mov dword [section..data], 0x1500067
mov dword [esp + 0x14], 0x400
mov dword [section..data], 0x150006f
mov dword [section..data], 0x1500071
mov dword [esp + 0x450], 1
mov dword [section..data], 0x1500072
push dword [esp + 0x460]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 8], eax
mov dword [section..data], 0x1500074
mov ebx, dword [esp + 8]
cmp ebx, 0xffffffff
je 0x43e2f3
mov dword [section..data], 0x1500076
lea ebp, [esp + 0x28]
mov dword [ebp], 0x428
mov dword [section..data], 0x1500078
lea eax, [esp + 0x28]
push eax
push dword [esp + 0xc]
call sub.KERNEL32.dll_Module32FirstW
and eax, eax
je 0x43dfe9
xor eax, eax
jmp 0x43dfee
mov eax, 1
and eax, eax
je 0x43e11f
mov dword [section..data], 0x1500079
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x150007a
mov ebx, dword [esp + 0x24]
cmp ebx, 0x12
jne 0x43e05a
mov dword [section..data], 0x150007b
push 3
mov eax, str.No_running_processes_detected
push eax
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.0043d328
mov dword [section..data], 0x150007d
jmp 0x43e946
mov dword [section..data], 0x150007e
mov dword [section..data], 0x150007f
push edx
call fcn.0055a9f0
pop edx
push eax
push 0
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.Module32First_failed__
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00548d10
pop eax
mov edx, 0x655306
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043ca18
pop eax
mov edx, 0x637c34
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x1500080
mov dword [esp + 0x450], 0
mov dword [section..data], 0x1500081
jmp 0x43e946
mov dword [section..data], 0x1500083
mov dword [section..data], 0x1500085
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
lea ebp, [esp + 0x38]
lea eax, [ebp + 0x20]
push eax
call fcn.0055a830
call fcn.004f4332
add dword [esp], edx
call fcn.005498b0
call fcn.0055ab20
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0xc]
call fcn.005498b0
call fcn.004f4360
mov edx, eax
pop ecx
push ecx
call fcn.004f4360
mov ecx, eax
call fcn.004f4370
je 0x43e1e5
mov dword [section..data], 0x1500086
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
lea ebp, [esp + 0x30]
lea eax, [ebp + 0x220]
push eax
call fcn.0055a830
lea eax, [esp + 0x10]
push eax
call fcn.0055aa30
mov dword [section..data], 0x1500087
jmp 0x43e946
mov dword [section..data], 0x1500088
mov dword [section..data], 0x150008a
lea eax, [esp + 0x28]
push eax
push dword [esp + 0xc]
call sub.KERNEL32.dll_Module32NextW
and eax, eax
je 0x43e2e4
mov dword [section..data], 0x150008b
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
lea ebp, [esp + 0x38]
lea eax, [ebp + 0x20]
push eax
call fcn.0055a830
call fcn.004f4332
add dword [esp], edx
call fcn.005498b0
call fcn.0055ab20
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0xc]
call fcn.005498b0
call fcn.004f4360
mov edx, eax
pop ecx
push ecx
call fcn.004f4360
mov ecx, eax
call fcn.004f4370
je 0x43e2cb
mov dword [section..data], 0x150008c
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
lea ebp, [esp + 0x30]
lea eax, [ebp + 0x220]
push eax
call fcn.0055a830
lea eax, [esp + 0x10]
push eax
call fcn.0055aa30
mov dword [section..data], 0x150008d
jmp 0x43e946
mov dword [section..data], 0x150008e
mov dword [section..data], 0x150008f
jmp 0x43e1ef
mov dword [section..data], 0x1500092
jmp 0x43e932
mov dword [section..data], 0x1500092
mov dword [section..data], 0x1500093
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x1500094
mov dword [esp + 8], 0
mov dword [section..data], 0x1500096
push edx
call fcn.0055a9f0
pop edx
push eax
push 3
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.CreateToolhelp32Snapshot__failed____
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00548d10
pop eax
mov edx, 0x655306
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043ca18
pop eax
mov edx, str.___now_continue_with_OpenProcess_
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x1500098
push dword [esp + 0x460]
push 0
push 0x400
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + 0x18], eax
mov dword [section..data], 0x1500099
cmp dword [esp + 0x18], 0
je 0x43e3e8
xor eax, eax
jmp 0x43e3ed
mov eax, 1
and eax, eax
je 0x43e4b9
mov dword [section..data], 0x150009a
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x150009b
push edx
call fcn.0055a9f0
pop edx
push eax
push 0
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.OpenProcess_failed__
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00548d10
pop eax
mov edx, 0x655306
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043ca18
pop eax
mov edx, 0x637c34
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x150009c
mov dword [esp + 0x450], 0xfffff7c9
mov dword [section..data], 0x150009d
jmp 0x43e946
mov dword [section..data], 0x150009e
mov dword [section..data], 0x15000a0
mov eax, str.kernel32.dll
push eax
push 0xffffffff
call fcn.00546b1f
mov dword [esp + 0x1c], eax
mov dword [section..data], 0x15000a1
cmp dword [esp + 0x1c], 0
je 0x43e4f6
xor eax, eax
jmp 0x43e4fb
mov eax, 1
and eax, eax
je 0x43e5c7
mov dword [section..data], 0x15000a2
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x15000a3
push edx
call fcn.0055a9f0
pop edx
push eax
push 0
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.OpenLibrary_failed__
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00548d10
pop eax
mov edx, 0x655306
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043ca18
pop eax
mov edx, 0x637c34
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x15000a4
mov dword [esp + 0x450], 0xfffff7c8
mov dword [section..data], 0x15000a5
jmp 0x43e946
mov dword [section..data], 0x15000a6
mov dword [section..data], 0x15000a8
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x1c]
call fcn.00549990
lea eax, [esp + 0x14]
push eax
call fcn.0055aa30
mov dword [section..data], 0x15000a9
mov dword [section..data], 0x15000aa
mov eax, str.QueryFullProcessImageNameW
push eax
push dword [esp + 0x20]
call fcn.00546b79
mov dword [esp + 0x20], eax
mov dword [section..data], 0x15000ab
jmp 0x43e658
mov dword [section..data], 0x15000ad
mov dword [section..data], 0x15000af
cmp dword [esp + 0x20], 0
je 0x43e677
xor eax, eax
jmp 0x43e67c
mov eax, 1
and eax, eax
je 0x43e748
mov dword [section..data], 0x15000b0
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x15000b1
push edx
call fcn.0055a9f0
pop edx
push eax
push 0
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.GetFunction_failed__
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00548d10
pop eax
mov edx, 0x655306
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043ca18
pop eax
mov edx, 0x637c34
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x15000b2
mov dword [esp + 0x450], 0xfffff7c7
mov dword [section..data], 0x15000b3
jmp 0x43e946
mov dword [section..data], 0x15000b4
mov dword [section..data], 0x15000b6
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
push 0
push dword [esp + 0x24]
call dword [esp + 0x30]
mov dword [esp + 4], eax
mov dword [section..data], 0x15000b8
cmp dword [esp + 4], 0
je 0x43e78c
xor eax, eax
jmp 0x43e791
mov eax, 1
and eax, eax
je 0x43e85d
mov dword [section..data], 0x15000b9
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x15000ba
push edx
call fcn.0055a9f0
pop edx
push eax
push 0
push edx
call fcn.0055a9f0
pop edx
push eax
mov edx, str.QueryFullProcessImageName_failed__
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00548d10
pop eax
mov edx, 0x655306
push edx
call fcn.0055aac0
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043ca18
pop eax
mov edx, 0x637c34
push edx
call fcn.0055aac0
call fcn.0055ab20
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004f4332
add dword [esp + 4], edx
call fcn.0043d328
call fcn.004f4350
mov dword [section..data], 0x15000bb
mov dword [esp + 0x450], 0xfffff7c6
mov dword [section..data], 0x15000bc
jmp 0x43e946
mov dword [section..data], 0x15000bd
mov dword [section..data], 0x15000bf
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0x20]
call fcn.0054ca9e
call fcn.004f4332
add dword [esp], edx
call fcn.005498b0
call fcn.0055ab20
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 0xc]
call fcn.005498b0
call fcn.004f4360
mov edx, eax
pop ecx
push ecx
call fcn.004f4360
mov ecx, eax
call fcn.004f4370
je 0x43e902
mov dword [section..data], 0x15000c0
mov edx, dword [esp + 0x10]
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055aac0
lea eax, [esp + 0x10]
push eax
call fcn.0055aa30
mov dword [section..data], 0x15000c1
mov dword [section..data], 0x15000c3
push dword [esp + 0x1c]
call fcn.00546a5f
mov dword [section..data], 0x15000c5
push dword [esp + 0x18]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x15000c7
mov dword [section..data], 0x15000c9
mov dword [section..data], 0x15000cb
cmp dword [esp + 8], 0
je 0x43e96a
mov dword [section..data], 0x15000cc
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x15000cd
mov dword [section..data], 0x15000cf
mov ebx, dword [esp + 0x450]
cmp ebx, 1
jne 0x43e9b6
mov dword [section..data], 0x15000d0
mov edx, dword [esp + 0xc]
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055aac0
mov ebp, dword [esp + 0x46c]
lea eax, [ebp]
push eax
call fcn.0055aa30
mov dword [section..data], 0x15000d1
mov dword [section..data], 0x15000d3
mov eax, dword [esp + 0x450]
jmp 0x43e9df
push dword [esp + 0xc]
call fcn.0055abf0
push dword [esp + 0x10]
call fcn.0055abf0
push dword [esp]
call fcn.0055abf0
add esp, 0x454
pop ebx
pop ebp
ret 0xc