Function at 0x41a4e3
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push 0x48
mov eax, 0x45b4ca
call fcn.0043ed72
lea ecx, [ebp - 0x44]
call fcn.0042fd67
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp dword [ebp + 8], ebx
je 0x41a6e6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x41a6e6
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov byte [ebp - 4], 2
xor edi, edi
mov dword [ebp - 0x34], edi
add edi, 0x400
mov dword [ebp - 0x34], edi
lea eax, [ebp - 0x54]
call fcn.0041a9a2
mov esi, edi
shl esi, 2
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 0x54]
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x41a588
mov byte [ebp - 4], 1
cmp dword [ebp - 0x54], ebx
je 0x41a578
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x50]
jae 0x41a56f
inc dword [ebp - 0x20]
jmp 0x41a562
push dword [ebp - 0x54]
call fcn.0043b47d
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.0042fd7d
mov eax, ebx
jmp 0x41a6f1
cmp esi, dword [ebp - 0x2c]
je 0x41a52f
mov edi, dword [ebp - 0x2c]
shr edi, 2
lea eax, [ebp - 0x54]
call fcn.0041a9a2
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x1c], eax
jae 0x41a6c4
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x1c]
lea eax, [eax + ecx*4]
push dword [eax]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 3
cmp edi, ebx
je 0x41a6aa
lea ecx, [ebp - 0x18]
call fcn.004088aa
mov byte [ebp - 4], 4
mov esi, 0x7fff
push esi
lea ecx, [ebp - 0x18]
call fcn.0040d2b4
push esi
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x41a69e
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004053df
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax - 0xc]
push 0x5c
lea esi, [ebp - 0x18]
call fcn.00408788
sub ebx, eax
dec ebx
push ebx
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.004087a9
mov byte [ebp - 4], 5
mov eax, dword [eax]
push dword [ebp + 8]
push eax
call fcn.0043c9b6
pop ecx
pop ecx
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x38]
call fcn.004088d4
test bl, bl
je 0x41a69c
xor esi, esi
inc esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.004088d4
mov byte [ebp - 4], 2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x54], eax
je 0x41a68f
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x50]
jae 0x41a686
inc dword [ebp - 0x24]
jmp 0x41a679
push dword [ebp - 0x54]
call fcn.0043b47d
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.0042fd7d
mov eax, esi
jmp 0x41a6f1
xor ebx, ebx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.004088d4
mov byte [ebp - 4], 2
cmp edi, ebx
je 0x41a6bc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x30], ebx
inc dword [ebp - 0x1c]
jmp 0x41a59e
mov byte [ebp - 4], 1
cmp dword [ebp - 0x54], ebx
je 0x41a6e3
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jae 0x41a6da
inc dword [ebp - 0x28]
jmp 0x41a6d0
push dword [ebp - 0x54]
call fcn.0043b47d
pop ecx
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
call fcn.0042fd7d
xor eax, eax
call fcn.0043ee17
ret