Function at 0x4387a8
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4668d8
mov eax, dword fs:[0]
push eax
mov eax, 0x20c4
call fcn.00456c00
mov eax, dword [0x489870]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
jne 0x4387e8
xor eax, eax
inc eax
jmp 0x438a0d
push 0xffffffffffffffff
push 0x4757d8
lea ecx, [ebp - 0x20b8]
call fcn.0041e875
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20b8]
push esi
call fcn.0041ec0e
push 0xdd
mov esi, str.C:zoomcodeEP_2017Client_srcinstallwindowsNoMSIInstallerZoomProductUtil.cpp
lea ecx, [ebp - 0x20bc]
push esi
push 0
call fcn.0040c17a
xor ebx, ebx
lea ecx, [ebp - 0x20b8]
inc ebx
mov byte [ebp - 4], bl
call fcn.0041e9b0
push eax
push ecx
mov edx, str._CInstallerManager::TerminateApp__the_event_exists__need_terminate_mainboard:
mov ecx, 0x48b250
call fcn.004102a0
pop ecx
mov ecx, eax
call fcn.0040ff5d
lea ecx, [ebp - 0x20bc]
mov byte [ebp - 4], 0
call fcn.0040c319
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x20c0]
push eax
push 0x1000
lea eax, [ebp - 0x1fb0]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x4388c5
push 0xe5
push esi
push ebx
lea ecx, [ebp - 0x20bc]
call fcn.0040c17a
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov edx, str._CInstallerManager::TerminateApp__failed_to_enum_processes__error_code:
mov ecx, 0x48b190
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00406c0b
lea ecx, [ebp - 0x20bc]
call fcn.0040c319
jmp 0x438a00
mov eax, dword [ebp - 0x20c0]
mov esi, ebx
shr eax, 2
xor ebx, ebx
mov dword [ebp - 0x20cc], eax
mov dword [ebp - 0x20bc], esi
test eax, eax
je 0x4389fe
push dword [ebp + ebx*4 - 0x1fb0]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x20c4], eax
test eax, eax
je 0x4389f1
push 5
pop ecx
push 0xf8c
lea eax, [ebp - 0xf9c]
mov esi, str._unknown_
lea edi, [ebp - 0xfb0]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0045a980
mov esi, dword [ebp - 0x20c4]
lea eax, [ebp - 0xfb0]
add esp, 0xc
push 0x7cf
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x20b8]
call fcn.0041e9b0
push eax
lea eax, [ebp - 0xfb0]
push eax
call fcn.0045beee
pop ecx
pop ecx
test eax, eax
je 0x4389eb
mov ecx, dword [ebp + ebx*4 - 0x1fb0]
call fcn.00438a27
test eax, eax
jne 0x4389eb
push 0x10e
push str.C:zoomcodeEP_2017Client_srcinstallwindowsNoMSIInstallerZoomProductUtil.cpp
push 1
lea ecx, [ebp - 0x20c8]
call fcn.0040c17a
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + ebx*4 - 0x1fb0]
mov edx, str._CInstallerManager::TerminateApp__failed_to_kill_processes__PID:
push ecx
mov ecx, 0x48b190
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00406c0b
push ecx
mov edx, 0x477284
mov ecx, eax
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00406c0b
lea ecx, [ebp - 0x20c8]
mov byte [ebp - 4], 0
call fcn.0040c319
xor esi, esi
mov dword [ebp - 0x20bc], esi
jmp 0x4389f1
mov esi, dword [ebp - 0x20bc]
inc ebx
cmp ebx, dword [ebp - 0x20cc]
jb 0x4388e6
mov ebx, esi
lea ecx, [ebp - 0x20b8]
call fcn.0041e913
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455de6
leave
ret