Function at 0x403cf0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x125c
call fcn.00417ea0
mov eax, dword [0x421004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00405d00
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 3
push 0xffffffffffffffff
push 0x100c
push 0x3e9
push dword [0x4225ec]
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call edi
cmp eax, 0xffffffff
je 0x403f4c
push ebx
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x1254], 0
mov dword [ebp - 0x1248], ecx
lea ecx, [ebp - 0x125c]
push ecx
push eax
push 0x102d
push 0x3e9
push dword [0x4225ec]
mov dword [ebp - 0x1244], 0x104
call esi
push eax
call edi
mov eax, dword [0x4225f0]
xor ebx, ebx
add eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4225f0]
mov esi, dword [edi + 4]
cmp esi, dword [edi + 8]
je 0x403de6
nop word [eax + eax]
mov ebx, dword [esi]
lea ecx, [ebp - 0x108]
mov edx, ebx
call fcn.00404600
test eax, eax
je 0x403de6
add esi, 4
cmp esi, dword [edi + 8]
jne 0x403db0
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004047c0
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x403f4b
push 0x1000
lea eax, [ebp - 0x120c]
push 0
push eax
call fcn.00405d00
add esp, 0xc
lea eax, [ebp - 0x1210]
push eax
push 0x1000
lea eax, [ebp - 0x120c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x403f4b
mov eax, dword [ebp - 0x1210]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x1220], eax
test eax, eax
je 0x403f4b
nop dword [eax + eax]
push dword [ebp + esi*4 - 0x120c]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x403f3e
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00405d00
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
lea edx, [ebp - 0x20c]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x403ea2
sub edx, ecx
lea ecx, [ebp - 0x108]
lea eax, [ecx + 1]
mov dword [ebp - 0x1214], eax
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403ec0
sub ecx, dword [ebp - 0x1214]
cmp edx, ecx
jne 0x403f37
xor eax, eax
test edx, edx
je 0x403ef5
nop word [eax + eax]
mov cl, byte [ebp + eax - 0x20c]
cmp cl, byte [ebp + eax - 0x108]
jne 0x403f37
inc eax
cmp eax, edx
jb 0x403ee0
lea eax, [ebp - 0x1218]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
lea eax, [ebp - 0x121c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [ebp - 0x1218]
cmp eax, dword [ebp - 0x121c]
jne 0x403f37
mov edx, dword [ebp + esi*4 - 0x120c]
mov ecx, edi
push ebx
call fcn.00403270
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 0x1220]
jb 0x403e50
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004047c0
mov esp, ebp
pop ebp
ret