Function at 0x40d850
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x461a58
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47c748]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0x1c], 0
jne 0x40d891
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xd8]
push ecx
jmp 0x40d892
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x485724
mov ecx, 0x485730
mov edi, eax
call fcn.00408290
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx - 0xc]
cmp eax, 4
jle 0x40d8c5
lea edx, [esp + 0x2c]
push edx
mov ecx, 0x485730
call fcn.00408290
push 0x485138
push edi
mov dword [0x485138], 0x428
call sub.KERNEL32.dll_Module32FirstW
or ebp, 0xffffffff
lea ecx, [ecx]
mov eax, 0x485158
lea edx, [eax + 2]
jmp 0x40d8f0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d8f0
sub eax, edx
sar eax, 1
push eax
push 0x485158
mov ecx, 0x48572c
call fcn.00408310
mov edx, dword [0x485730]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40d93a
push esi
mov ecx, 0x485730
call fcn.00408180
mov edx, dword [0x485730]
lea eax, [esi + 1]
push eax
push edx
call fcn.00433ea9
add esp, 8
test esi, esi
jl 0x40daa7
mov eax, dword [0x485730]
cmp esi, dword [eax - 8]
jg 0x40daa7
mov dword [eax - 0xc], esi
mov ecx, dword [0x485730]
mov word [ecx + esi*2], 0
mov edx, dword [0x48572c]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40d997
push esi
mov ecx, 0x48572c
call fcn.00408180
mov edx, dword [0x48572c]
lea eax, [esi + 1]
push eax
push edx
call fcn.00433ea9
add esp, 8
test esi, esi
jl 0x40daa7
mov eax, dword [0x48572c]
cmp esi, dword [eax - 8]
jg 0x40daa7
mov dword [eax - 0xc], esi
mov ecx, dword [0x48572c]
mov word [ecx + esi*2], 0
mov ecx, dword [0x485730]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x40da6f
mov eax, dword [0x48572c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40da09
test dx, dx
je 0x40da05
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40da09
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d9e3
xor eax, eax
jmp 0x40da0d
sbb eax, eax
sbb eax, ebp
test eax, eax
sete al
test al, al
jne 0x40da79
push 0x485138
push edi
mov dword [0x485138], 0x428
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x40d8e0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x40da57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
push 0x80004005
call fcn.00408910
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x48514c]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], ebp
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x40daa3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x40da59
push 0x80070057
call fcn.00408910
int3