Function at 0x4c1ce0
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ccaeb
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x50f880]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
mov byte [esp + 0x17], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
push 0x1000
mov dword [esp + 0x64], ebx
call fcn.0044d57b
add esp, 4
mov byte [esp + 0x24], bl
mov ecx, dword [esp + 0x24]
push ecx
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x3c], eax
call fcn.0043b570
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
lea edx, [esp + 0x20]
push edx
push 0x1000
push esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
mov eax, dword [esp + 0x20]
shr eax, 2
xor ecx, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cmp eax, ebx
ja 0x4c1dcc
mov dword [esp + 0x60], 0xffffffff
test edi, edi
je 0x4c1daf
lea ecx, [edi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4c1daf
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
lea eax, [edi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4c1daf
mov edx, dword [edi]
mov eax, dword [edx + 8]
mov ecx, edi
call eax
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0x34]
mov eax, dword [esi + ecx*4]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4c214c
mov edx, dword [0x50f008]
mov eax, dword [edx + 0xc]
mov ecx, 0x50f008
mov byte [esp + 0x17], 1
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x60], 1
mov edx, dword [0x50f008]
mov eax, dword [edx + 0xc]
mov ecx, 0x50f008
call eax
lea edx, [eax + 0x10]
mov dword [esp + 0x18], edx
mov byte [esp + 0x60], 2
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
jge 0x4c1e4a
mov eax, 0x104
lea ecx, [esp + 0x18]
call fcn.0041b590
mov edx, dword [esp + 0x18]
push 0x104
push edx
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ebx, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.00453fa1
add esp, 8
test eax, eax
js 0x4c216b
mov ecx, dword [esp + 0x18]
cmp eax, dword [ecx - 8]
jg 0x4c216b
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov word [edx + eax*2], cx
mov edi, dword [esp + 0x18]
mov ecx, 0x4e9afc
mov eax, edi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c1ec6
test dx, dx
je 0x4c1ec2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c1ec6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c1ea0
xor eax, eax
jmp 0x4c1ecb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x4c1f64
lea eax, [esp + 0x30]
push eax
push 4
lea ecx, [esp + 0x30]
push ecx
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x4c1f60
mov edx, dword [esp + 0x18]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
jge 0x4c1f19
mov eax, 0x104
lea ecx, [esp + 0x18]
call fcn.0041b590
mov edx, dword [esp + 0x18]
push 0x104
push edx
mov edx, dword [esp + 0x30]
push edx
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ebx, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.00453fa1
add esp, 8
test eax, eax
js 0x4c216b
mov ecx, dword [esp + 0x18]
cmp eax, dword [ecx - 8]
jg 0x4c216b
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov word [edx + eax*2], cx
mov edi, dword [esp + 0x18]
mov ecx, 0x4e9b5c
mov eax, edi
jmp 0x4c1f70
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c1f96
test dx, dx
je 0x4c1f92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c1f96
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c1f70
xor eax, eax
jmp 0x4c1f9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x4c2010
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x4c1fca
mov eax, 0x104
lea ecx, [esp + 0x18]
call fcn.0041b590
mov edi, dword [esp + 0x18]
push 0x104
push edi
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
mov ebx, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.00453fa1
add esp, 8
test eax, eax
js 0x4c216b
mov ecx, dword [esp + 0x18]
cmp eax, dword [ecx - 8]
jg 0x4c216b
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov word [edx + eax*2], cx
mov edi, dword [esp + 0x18]
mov ecx, 0x4e9b60
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c203d
test dx, dx
je 0x4c2039
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c203d
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c2017
xor eax, eax
jmp 0x4c2042
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x4c2102
test ebx, ebx
js 0x4c2102
push 0x5c
push edi
call fcn.00454d8b
add esp, 8
test eax, eax
je 0x4c20bd
mov edx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
mov ecx, eax
test ecx, ecx
jle 0x4c20bd
mov eax, dword [edx - 0xc]
sub eax, ecx
lea ecx, [esp + 0x18]
push ecx
dec eax
lea ecx, [esp + 0x30]
call fcn.0041bf30
lea edi, [esp + 0x1c]
mov byte [esp + 0x60], 3
call fcn.0041ad90
mov byte [esp + 0x60], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4c20ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4c20ca
lea eax, [esp + 0x18]
lea edi, [esp + 0x1c]
call fcn.0041ad90
mov edi, dword [ebp + 8]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
call fcn.0040de60
push eax
push edi
lea ebx, [esp + 0x4c]
call fcn.0040e6f0
mov edi, dword [ebp + 0xc]
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.0040de60
push eax
push edi
lea ebx, [esp + 0x54]
call fcn.0040e6f0
mov edi, dword [esp + 0x18]
lea eax, [edi - 0x10]
mov byte [esp + 0x60], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c2123
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x60], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c2148
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x38]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x24]
inc ecx
mov dword [esp + 0x24], ecx
cmp ecx, dword [esp + 0x20]
jb 0x4c1dc8
jmp 0x4c1d79
push 0x80070057
call fcn.0041b5f0
int3