Function at 0x1004b000
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18e4
call fcn.10039730
mov eax, dword [0x100664a0]
xor eax, ebp
mov dword [ebp - 0x100c], eax
mov dword [ebp - 0x1830], 0
mov ax, word [0x100578ec]
mov word [ebp - 0x1810], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x180e]
push ecx
call fcn.10035ff0
add esp, 0xc
mov dword [ebp - 0x1004], 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 0x1008], eax
lea ecx, [ebp - 0x1828]
call fcn.10004f60
lea ecx, [ebp - 0x1848]
call fcn.10003490
lea eax, [ebp - 0x184c]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x1004b306
mov edx, dword [ebp - 0x184c]
shr edx, 2
mov dword [ebp - 0x182c], edx
mov dword [ebp - 0x1854], 0
jmp 0x1004b0c5
mov eax, dword [ebp - 0x1854]
add eax, 1
mov dword [ebp - 0x1854], eax
mov ecx, dword [ebp - 0x1854]
cmp ecx, dword [ebp - 0x182c]
jae 0x1004b306
mov edx, dword [ebp - 0x1854]
mov eax, dword [ebp + edx*4 - 0x1000]
push eax
push 0
push 0x100410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1004], eax
cmp dword [ebp - 0x1004], 0
je 0x1004b301
push 0x400
lea ecx, [ebp - 0x1810]
push ecx
mov edx, dword [ebp - 0x1004]
push edx
call sub.PSAPI.DLL_GetProcessImageFileNameW
mov dword [ebp - 0x1858], eax
cmp dword [ebp - 0x1858], 0
jbe 0x1004b2ea
xor eax, eax
mov ecx, dword [ebp - 0x1858]
mov word [ebp + ecx*2 - 0x1810], ax
push 0x5c
lea edx, [ebp - 0x1810]
push edx
call fcn.100059d0
add esp, 8
mov dword [ebp - 0x185c], eax
cmp dword [ebp - 0x185c], 0
jne 0x1004b16e
lea eax, [ebp - 0x1810]
mov dword [ebp - 0x185c], eax
jmp 0x1004b17d
mov ecx, dword [ebp - 0x185c]
add ecx, 2
mov dword [ebp - 0x185c], ecx
mov edx, dword [ebp - 0x1008]
push edx
mov eax, dword [ebp - 0x185c]
push eax
call fcn.10037c10
add esp, 8
test eax, eax
jne 0x1004b2ea
mov ecx, dword [ebp - 0x1854]
mov edx, dword [ebp + ecx*4 - 0x1000]
mov dword [ebp - 0x1884], edx
lea eax, [ebp - 0x1894]
push eax
lea ecx, [ebp - 0x1828]
call fcn.10003430
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x188c], ecx
mov dword [ebp - 0x1888], edx
lea eax, [ebp - 0x1884]
push eax
mov ecx, dword [ebp - 0x1888]
push ecx
mov edx, dword [ebp - 0x188c]
push edx
lea eax, [ebp - 0x189c]
push eax
lea ecx, [ebp - 0x1828]
call fcn.10005010
lea ecx, [ebp - 0x1864]
push ecx
lea edx, [ebp - 0x1864]
push edx
lea eax, [ebp - 0x1864]
push eax
lea ecx, [ebp - 0x186c]
push ecx
mov edx, dword [ebp - 0x1004]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x1004b28c
lea eax, [ebp - 0x186c]
push eax
call fcn.1004bc80
add esp, 4
mov dword [ebp - 0x18a8], eax
mov dword [ebp - 0x18a4], edx
lea ecx, [ebp - 0x18b8]
push ecx
lea ecx, [ebp - 0x1848]
call fcn.10003430
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18b0], edx
mov dword [ebp - 0x18ac], eax
lea ecx, [ebp - 0x18a8]
push ecx
mov edx, dword [ebp - 0x18ac]
push edx
mov eax, dword [ebp - 0x18b0]
push eax
lea ecx, [ebp - 0x18c0]
push ecx
lea ecx, [ebp - 0x1848]
call fcn.10003570
jmp 0x1004b2ea
mov dword [ebp - 0x18c8], 0xffffffff
mov dword [ebp - 0x18c4], 0xffffffff
lea edx, [ebp - 0x18d8]
push edx
lea ecx, [ebp - 0x1848]
call fcn.10003430
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x18d0], ecx
mov dword [ebp - 0x18cc], edx
lea eax, [ebp - 0x18c8]
push eax
mov ecx, dword [ebp - 0x18cc]
push ecx
mov edx, dword [ebp - 0x18d0]
push edx
lea eax, [ebp - 0x18e0]
push eax
lea ecx, [ebp - 0x1848]
call fcn.10003570
mov ecx, dword [ebp - 0x1004]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1004], 0
jmp 0x1004b0b6
mov edx, dword [ebp - 0x1008]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002b40
push str.com_anabel_pp_util_SystemActivity_ProcInfo
mov ecx, dword [ebp + 8]
call fcn.10002fe0
mov dword [ebp - 0x1850], eax
cmp dword [ebp - 0x1850], 0
je 0x1004b4ca
push 0x1005791c
push str.name
mov ecx, dword [ebp - 0x1850]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10003020
mov dword [ebp - 0x1874], eax
push 0x10057938
push 0x1005793c
mov edx, dword [ebp - 0x1850]
push edx
mov ecx, dword [ebp + 8]
call fcn.10003020
mov dword [ebp - 0x1878], eax
push 0x10057940
push str.startTime
mov eax, dword [ebp - 0x1850]
push eax
mov ecx, dword [ebp + 8]
call fcn.10003020
mov dword [ebp - 0x1870], eax
cmp dword [ebp - 0x1874], 0
je 0x1004b4ca
cmp dword [ebp - 0x1878], 0
je 0x1004b4ca
cmp dword [ebp - 0x1870], 0
je 0x1004b4ca
push 0
mov ecx, dword [ebp - 0x1850]
push ecx
lea ecx, [ebp - 0x1828]
call fcn.10004ff0
push eax
mov ecx, dword [ebp + 8]
call fcn.100030e0
mov dword [ebp - 0x1830], eax
mov dword [ebp - 0x187c], 0
jmp 0x1004b3fb
mov edx, dword [ebp - 0x187c]
add edx, 1
mov dword [ebp - 0x187c], edx
lea ecx, [ebp - 0x1828]
call fcn.10004ff0
cmp dword [ebp - 0x187c], eax
jae 0x1004b4ca
mov eax, dword [ebp - 0x1850]
push eax
mov ecx, dword [ebp + 8]
call fcn.10003000
mov dword [ebp - 0x1880], eax
cmp dword [ebp - 0x1880], 0
je 0x1004b4c5
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x1874]
push edx
mov eax, dword [ebp - 0x1880]
push eax
mov ecx, dword [ebp + 8]
call fcn.10003050
mov ecx, dword [ebp - 0x187c]
push ecx
lea ecx, [ebp - 0x1828]
call fcn.10003460
mov edx, dword [eax]
push edx
mov eax, dword [ebp - 0x1878]
push eax
mov ecx, dword [ebp - 0x1880]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10004f30
mov edx, dword [ebp - 0x187c]
push edx
lea ecx, [ebp - 0x1848]
call fcn.10003540
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
mov eax, dword [ebp - 0x1870]
push eax
mov ecx, dword [ebp - 0x1880]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10003080
mov edx, dword [ebp - 0x1880]
push edx
mov eax, dword [ebp - 0x187c]
push eax
mov ecx, dword [ebp - 0x1830]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10003110
jmp 0x1004b3ec
mov edx, dword [ebp - 0x1830]
mov dword [ebp - 0x18e4], edx
lea ecx, [ebp - 0x1848]
call fcn.10003500
lea ecx, [ebp - 0x1828]
call fcn.10004fd0
mov eax, dword [ebp - 0x18e4]
mov ecx, dword [ebp - 0x100c]
xor ecx, ebp
call fcn.100350e4
mov esp, ebp
pop ebp
ret 0xc