Function at 0x402951
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x3b8
mov eax, dword [0x40e270]
push ebx
push esi
push edi
mov esi, str.gf.dll
push 0x5c
push esi
mov dword [ebp + 0x6c], eax
mov dword [ebp - 0x1f8], esi
call fcn.00405bf0
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
je 0x40298b
inc eax
mov dword [ebp - 0x208], eax
jmp 0x402997
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x1f8], ebx
push dword [ebp + 0x7c]
push 8
pop esi
push esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x402a34
lea eax, [ebp - 0x1b8]
push eax
push edi
mov dword [ebp - 0x1b8], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
jne 0x4029d2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402a34
cmp dword [ebp - 0x1f8], ebx
je 0x4029e9
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x1f8]
jmp 0x4029f6
lea eax, [ebp - 0x198]
push eax
push dword [ebp - 0x208]
call fcn.0040b7da
test eax, eax
pop ecx
pop ecx
je 0x402a12
lea eax, [ebp - 0x1b8]
push eax
push edi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x4029d2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x7c]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x1f4], edi
jne 0x402a3b
xor eax, eax
jmp 0x4034f0
push ebx
push 0x10
push 0x40e148
push dword [ebp - 0x1a0]
mov dword [ebp + 0x7c], ebx
push dword [ebp - 0x1a4]
mov dword [ebp - 0x204], ebx
push edi
mov dword [ebp - 0x208], ebx
call fcn.00402517
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402c0b
push ebx
push 0x10
push 0x40e138
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402517
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402c0b
push ebx
push 0x10
push 0x40e128
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402517
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402bff
push ebx
push 0x10
push 0x40e118
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402517
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402bff
push ebx
push 0x10
push 0x40e108
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402517
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402bf6
push ebx
push 0x10
push 0x40e0f8
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402517
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402bf6
push ebx
push 0x10
push 0x40e0e8
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402517
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402bf6
push ebx
push 0x10
push 0x40e0d8
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402517
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402bf6
push ebx
push 0x10
push 0x40e0c8
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402517
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402bf6
push ebx
push 0x10
push 0x40e0b8
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402517
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
je 0x4034d1
mov dword [ebp + 0x7c], 1
jmp 0x402c1a
mov dword [ebp - 0x204], 1
jmp 0x402c1a
xor eax, eax
inc eax
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x208], eax
push str._GetService_GF_Util__YAJABU_GUID__PA_WPAPAX_Z
push dword [ebp - 0x1a4]
push edi
call fcn.004026e8
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1fc], eax
je 0x4034d1
push 0x1c
lea eax, [ebp - 0x228]
push eax
mov dword [ebp - 0x1f8], ebx
push ebx
jmp 0x402cd1
push dword [ebp - 0x214]
lea eax, [ebp - 0x1ec]
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
push dword [ebp - 0x224]
push str.0x_p__0x_p___u__0x_x_r_n
push eax
call fcn.00405b8b
add esp, 0x18
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 1
push esi
lea eax, [ebp - 0x200]
push eax
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
push dword [ebp - 0x1f4]
call fcn.00402517
mov edi, eax
add esp, 0x18
cmp edi, 0xffffffff
jne 0x402ce5
mov eax, dword [ebp - 0x1f8]
add eax, dword [ebp - 0x21c]
push 0x1c
lea ecx, [ebp - 0x228]
push ecx
mov dword [ebp - 0x1f8], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, 0x1c
je 0x402c51
jmp 0x4034d1
push 4
pop edx
mov ecx, 0x3e8
push 0x20
pop eax
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], ecx
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x30c], ecx
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2c0], ecx
add ecx, 0x1c
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x284], eax
mov eax, 0xfffffe70
push 0x14
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x280], ecx
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x24c], eax
mov eax, 0x3f0
pop ecx
mov dword [ebp - 0x348], 0xfffffff8
mov dword [ebp - 0x344], 0x14
mov dword [ebp - 0x340], 0x10
mov dword [ebp - 0x33c], edx
mov dword [ebp - 0x338], esi
mov dword [ebp - 0x334], ebx
mov dword [ebp - 0x330], esi
mov dword [ebp - 0x324], esi
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x314], ebx
mov dword [ebp - 0x308], esi
mov dword [ebp - 0x304], esi
mov dword [ebp - 0x300], esi
mov dword [ebp - 0x2fc], ebx
mov dword [ebp - 0x2f0], esi
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2e8], ebx
mov dword [ebp - 0x2e4], ebx
mov dword [ebp - 0x2d8], esi
mov dword [ebp - 0x2d4], esi
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2cc], esi
mov dword [ebp - 0x2c8], esi
mov dword [ebp - 0x2bc], esi
mov dword [ebp - 0x2b8], esi
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 0x29c], esi
mov dword [ebp - 0x298], edx
mov dword [ebp - 0x294], 0x1c
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], esi
mov dword [ebp - 0x288], esi
mov dword [ebp - 0x27c], esi
mov dword [ebp - 0x278], 0xc
mov dword [ebp - 0x274], edx
mov dword [ebp - 0x270], 0x1c
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x25c], 0xc
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x254], 0x1c
mov dword [ebp - 0x250], 0x120
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x23c], 0x118
mov dword [ebp - 0x238], 0xfffffe40
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x1f0], ebx
cmp dword [ebp - 0x1f0], 2
mov dword [ebp - 0x1f8], ebx
jne 0x402f2b
push ebx
push 4
lea eax, [ebp - 0x1f8]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x402f1e
cmp dword [ebp - 0x1f8], ebx
je 0x402f1e
add edi, 0x2c
jmp 0x402f58
cmp dword [ebp - 0x204], ebx
je 0x402f4b
add edi, 0x18
jmp 0x402f58
cmp dword [ebp - 0x1f0], 1
jne 0x402f4b
cmp dword [ebp + 0x7c], ebx
je 0x402f3e
add edi, 0x30
jmp 0x402f58
cmp dword [ebp - 0x204], ebx
je 0x402f4b
add edi, 0x1c
jmp 0x402f58
mov eax, dword [ebp - 0x1f0]
add edi, dword [ebp + eax*4 - 0x348]
push ebx
push 4
lea eax, [ebp - 0x1f8]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4034d1
mov edi, dword [ebp - 0x1f8]
cmp edi, ebx
je 0x4034d1
cmp dword [ebp - 0x1f0], 3
jne 0x402f98
cmp dword [ebp - 0x204], ebx
je 0x402f98
mov dword [ebp - 0x20c], edi
inc dword [ebp - 0x1f0]
cmp dword [ebp - 0x1f0], 5
jl 0x402ee8
mov dword [ebp - 0x200], edi
mov dword [ebp + 0x7c], ebx
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 9
mov dword [ebp - 0x1f0], ebx
jne 0x402fdf
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403007
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0xb
mov edi, dword [ebp - 0x1f0]
jl 0x402fb4
jmp 0x403009
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403029
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x40308b
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0xb
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x10
mov dword [ebp - 0x1f0], ebx
jne 0x403061
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403089
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x12
mov edi, dword [ebp - 0x1f0]
jl 0x403036
jmp 0x40308b
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4030ab
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x40310d
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x12
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x16
mov dword [ebp - 0x1f0], ebx
jne 0x4030e3
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40310b
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x18
mov edi, dword [ebp - 0x1f0]
jl 0x4030b8
jmp 0x40310d
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40312d
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x40318f
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x18
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x1c
mov dword [ebp - 0x1f0], ebx
jne 0x403165
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40318d
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x1e
mov edi, dword [ebp - 0x1f0]
jl 0x40313a
jmp 0x40318f
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4031af
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x403211
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x1e
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x23
mov dword [ebp - 0x1f0], ebx
jne 0x4031e7
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40320f
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x25
mov edi, dword [ebp - 0x1f0]
jl 0x4031bc
jmp 0x403211
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403231
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x403293
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x25
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x2a
mov dword [ebp - 0x1f0], ebx
jne 0x403269
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0x14]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403291
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x2e
mov edi, dword [ebp - 0x1f0]
jl 0x40323e
jmp 0x403293
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4032b7
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x403339
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x2e
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x33
mov dword [ebp - 0x1f0], ebx
jne 0x4032ef
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0x14]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403315
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x37
mov edi, dword [ebp - 0x1f0]
jl 0x4032c4
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403339
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x4034ce
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403359
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x4033c0
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x37
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
mov dword [ebp - 0x1f0], ebx
call esi
test eax, eax
je 0x40339c
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x3e
mov edi, dword [ebp - 0x1f0]
jl 0x403366
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4033c0
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x4034ce
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4033e0
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x403447
mov edi, dword [ebp - 0x20c]
mov dword [ebp + 0x7c], 0x3e
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
mov dword [ebp - 0x1f0], ebx
call esi
test eax, eax
je 0x403423
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x43
mov edi, dword [ebp - 0x1f0]
jl 0x4033ed
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403447
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x4034ce
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403467
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
jne 0x4034e1
mov eax, dword [ebp - 0x20c]
push 0x43
add eax, 8
pop edi
cmp edi, 0x44
mov dword [ebp + 0x7c], ebx
jne 0x40348a
cmp dword [ebp - 0x208], ebx
je 0x40348a
sub eax, 0x130
jmp 0x403491
add eax, dword [ebp + edi*4 - 0x348]
push ebx
push 4
lea ecx, [ebp + 0x7c]
push ecx
push eax
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4034d1
mov eax, dword [ebp + 0x7c]
inc edi
cmp edi, 0x48
jl 0x403473
push ebx
push 0x10
push dword [ebp + 0x78]
push eax
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4034e1
push dword [ebp + 0x78]
call fcn.004026b8
test eax, eax
pop ecx
je 0x4034e1
xor ebx, ebx
inc ebx
push dword [ebp - 0x1f4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x4034f0
push dword [ebp - 0x1f4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x6c]
pop edi
pop esi
pop ebx
call fcn.00404fd2
add ebp, 0x70
leave
ret 8