Function at 0x4072ca
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x4255d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 7
pop ebx
mov dword [ebp - 0x464], eax
mov eax, dword [ebp + 0xc]
push ebx
push 0x426360
mov dword [ebp - 0x460], eax
mov byte [ebp - 0x459], 1
call fcn.00406999
push eax
lea esi, [ebp - 0x43c]
call fcn.004012da
push 5
pop edi
push edi
push 0x426370
call fcn.00406999
push eax
lea esi, [ebp - 0x420]
call fcn.004012da
push 6
push 0x42637c
call fcn.00406999
push eax
lea esi, [ebp - 0x404]
call fcn.004012da
push 4
push 0x426388
call fcn.00406999
push eax
lea esi, [ebp - 0x3e8]
call fcn.004012da
push 8
push 0x426390
call fcn.00406999
push eax
lea esi, [ebp - 0x3cc]
call fcn.004012da
push ebx
push 0x4263a0
call fcn.00406999
push eax
lea esi, [ebp - 0x3b0]
call fcn.004012da
push edi
push 0x4263b0
call fcn.00406999
push eax
lea esi, [ebp - 0x394]
call fcn.004012da
push 9
push 0x4263bc
call fcn.00406999
push eax
lea esi, [ebp - 0x378]
call fcn.004012da
push ebx
push 0x4263d0
call fcn.00406999
push eax
lea esi, [ebp - 0x35c]
call fcn.004012da
push edi
push 0x4263e0
call fcn.00406999
push eax
lea esi, [ebp - 0x340]
call fcn.004012da
push 3
push 0x4263ec
call fcn.00406999
push eax
lea esi, [ebp - 0x324]
call fcn.004012da
push 8
push 0x4263f4
call fcn.00406999
push eax
lea esi, [ebp - 0x308]
call fcn.004012da
push edi
push 0x426404
call fcn.00406999
push eax
lea esi, [ebp - 0x2ec]
call fcn.004012da
push ebx
push 0x426410
call fcn.00406999
push eax
lea esi, [ebp - 0x2d0]
call fcn.004012da
push 6
push 0x426420
call fcn.00406999
push eax
lea esi, [ebp - 0x2b4]
call fcn.004012da
push 6
push 0x42642c
call fcn.00406999
push eax
lea esi, [ebp - 0x298]
call fcn.004012da
push edi
push 0x426438
call fcn.00406999
push eax
lea esi, [ebp - 0x27c]
call fcn.004012da
push 6
push 0x426444
call fcn.00406999
push eax
lea esi, [ebp - 0x260]
call fcn.004012da
push ebx
push 0x426450
call fcn.00406999
push eax
lea esi, [ebp - 0x244]
call fcn.004012da
push 4
push 0x426460
call fcn.00406999
push eax
lea esi, [ebp - 0x228]
call fcn.004012da
push dword [ebp - 0x460]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x40759b
lea eax, [ebp - 0x468]
push eax
push 4
lea eax, [ebp - 0x460]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x407594
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x460]
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
lea eax, [ebp - 0x20c]
push eax
lea esi, [ebp - 0x458]
call fcn.004012da
mov edi, dword [ebp - 0x464]
mov esi, eax
call fcn.00401364
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x458]
call fcn.00401451
lea esi, [ebp - 0x43c]
cmp dword [esi + 0x14], 8
mov ecx, dword [esi + 0x10]
jb 0x40756c
mov eax, dword [esi]
jmp 0x40756e
mov eax, esi
push ecx
mov ecx, dword [ebp - 0x464]
push eax
xor eax, eax
call fcn.004013b3
cmp eax, 0xffffffff
jne 0x40758d
inc edi
add esi, 0x1c
cmp edi, 0x14
jl 0x40755f
jmp 0x407594
mov byte [ebp - 0x459], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x13
lea esi, [ebp - 0x20c]
pop edi
push 0
sub esi, 0x1c
push 1
mov ecx, esi
call fcn.00401451
dec edi
jns 0x4075a4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x459]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bad1
leave
ret 8