Function at 0x100464e0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x280c
call fcn.102244a0
mov eax, dword [esp + 0x2810]
push ebx
push ebp
push esi
test eax, eax
push edi
jne 0x10046506
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x280c
ret
mov eax, dword [esp + 0x2824]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1820]
push 0x1000
push edx
mov dword [eax], 0
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x10046539
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x280c
ret
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], 0
shr esi, 2
mov dword [esp + 0x18], esi
je 0x10046790
lea ebp, [esp + 0x181c]
mov eax, dword [ebp]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10046768
lea ecx, [esp + 0x1c]
push 0x400
push ecx
push 0
push ebx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
jne 0x10046596
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10046768
mov edi, str._systemroot
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._systemroot
push edx
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x10046664
lea eax, [esp + 0x141c]
push 0x400
push eax
call fcn.10028cf0
or ecx, 0xffffffff
lea edi, [esp + 0x1424]
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc1c]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._systemroot
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + ecx + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xc1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x101c]
push 0x400
lea edx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x100466a6
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x101c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x2820]
lea ecx, [esp + 0x81c]
push 0x400
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x100466e7
or ecx, 0xffffffff
lea edx, [esp + 0x81c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [esp + 0x101c]
lea edx, [esp + 0x81c]
push ecx
push edx
call esi
add esp, 8
test eax, eax
jne 0x1004675d
lea eax, [esp + 0x41c]
push eax
push ebx
call fcn.10028b80
add esp, 8
test eax, eax
je 0x10046789
lea ecx, [esp + 0x41c]
push str.SYSTEM
push ecx
call esi
add esp, 8
test eax, eax
je 0x1004675d
lea edx, [esp + 0x41c]
push str.LOCAL_SERVICE
push edx
call esi
add esp, 8
test eax, eax
je 0x1004675d
lea eax, [esp + 0x41c]
push str.NETWORK_SERVICE
push eax
call esi
add esp, 8
test eax, eax
jne 0x1004679d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add ebp, 4
inc eax
cmp eax, esi
mov dword [esp + 0x10], eax
jb 0x10046559
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x280c
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x280c
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2824]
pop edi
pop esi
mov edx, dword [esp + ecx*4 + 0x1814]
pop ebp
mov dword [eax], edx
mov eax, 1
pop ebx
add esp, 0x280c
ret