Function at 0x455e90
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1de6
mov eax, dword fs:[0]
push eax
sub esp, 0x680
mov eax, dword [0x677e70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x670], ebx
mov dword [ebp - 0x674], eax
push 0
test ebx, ebx
jne 0x455ef0
push ebx
push 0x42
push 0x5bcb28
call fcn.0043bc90
add esp, 0x10
mov eax, 0x80070057
jmp 0x45629a
test eax, eax
jne 0x455ef9
push eax
push 0x43
jmp 0x455ed9
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x684], edi
cmp edi, 0xffffffff
jne 0x455f2a
push 0
push 0
push 0x46
push 0x5bcb28
call fcn.0043bc90
add esp, 0x10
mov eax, 0x80004005
jmp 0x45629a
push ebx
push 0x5ba1d8
push 0x5b9d0c
call fcn.0043d550
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x455f5d
push 0
push 0
push 0x48
push 0x5bcb28
call fcn.0043bc90
add esp, 0x10
mov eax, esi
jmp 0x45629a
push dword [ebp - 0x674]
push 0x5ba1d8
push 0x5b9d0c
call fcn.0043d550
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x455f95
push 0
push 0
push 0x49
push 0x5bcb28
call fcn.0043bc90
add esp, 0x10
mov eax, esi
jmp 0x45629a
lea ecx, [ebp - 0x67c]
call fcn.00456bf0
push 0x22c
lea eax, [ebp - 0x664]
push 0
push eax
call fcn.0057ee10
add esp, 0xc
mov dword [ebp - 0x664], 0x22c
lea eax, [ebp - 0x664]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x45620b
push dword [ebp - 0x65c]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x680], ebx
cmp ebx, 0xffffffff
je 0x4561d5
push 0x428
lea eax, [ebp - 0x438]
mov byte [ebp - 0x669], 0
push 0
push eax
call fcn.0057ee10
add esp, 0xc
mov dword [ebp - 0x438], 0x428
lea eax, [ebp - 0x438]
push eax
push ebx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x456189
nop dword [eax + eax]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x668]
call fcn.00404ca0
mov eax, dword [ebp - 0x668]
mov esi, dword [eax - 0xc]
test esi, esi
js 0x4561f7
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x456086
push esi
lea ecx, [ebp - 0x668]
call fcn.00404960
mov eax, dword [ebp - 0x668]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00590096
mov eax, dword [ebp - 0x668]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x4561f7
mov edi, dword [ebp + 8]
xor ecx, ecx
mov dword [eax - 0xc], esi
mov eax, dword [ebp - 0x668]
mov word [eax + esi*2], cx
lea eax, [ebp - 0x668]
mov esi, dword [edi + 0x24]
lea ecx, [edi + 0x24]
push eax
call fcn.00417450
mov ecx, dword [edi + 0x24]
cmp eax, ecx
je 0x456114
mov edx, dword [eax + 0x10]
test edx, edx
je 0x4561ed
mov edi, dword [ebp - 0x668]
nop
mov bx, word [edi]
cmp bx, word [edx]
jne 0x456106
test bx, bx
je 0x456102
mov bx, word [edi + 2]
cmp bx, word [edx + 2]
jne 0x456106
add edi, 4
add edx, 4
test bx, bx
jne 0x4560e0
xor edx, edx
jmp 0x45610b
sbb edx, edx
or edx, 1
test edx, edx
sets dl
test dl, dl
je 0x456116
mov eax, ecx
cmp eax, esi
je 0x456142
push dword [ebp - 0x670]
lea eax, [ebp - 0x668]
push eax
push 0
lea eax, [ebp - 0x68c]
push eax
lea ecx, [ebp - 0x67c]
call fcn.00456a50
mov byte [ebp - 0x669], 1
mov ebx, dword [ebp - 0x680]
lea eax, [ebp - 0x438]
push eax
push ebx
call sub.KERNEL32.dll_Module32NextW
mov edx, dword [ebp - 0x668]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x456175
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x456040
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [ebp - 0x684]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x669], 0
je 0x4561d5
lea eax, [ebp - 0x640]
push eax
call esi
mov esi, eax
test esi, esi
je 0x456201
mov eax, dword [ebp - 0x670]
push esi
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xdc]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call ebx
lea eax, [ebp - 0x664]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
jmp 0x455fd3
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x664]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
jmp 0x455fd3
push 0x80004005
call fcn.00404b10
push 0x80070057
call fcn.00404b10
push 0x8007000e
call fcn.00404b10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x67c]
mov eax, dword [ecx]
mov dword [ebp - 0x668], eax
cmp eax, ecx
je 0x45626e
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x45622f
xor esi, esi
jmp 0x456238
push eax
call esi
mov esi, eax
test esi, esi
je 0x456201
mov eax, dword [ebp - 0x674]
push esi
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xdc]
push esi
call ebx
lea ecx, [ebp - 0x668]
call fcn.00409c40
mov eax, dword [ebp - 0x668]
mov ecx, dword [ebp - 0x67c]
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp eax, ecx
jne 0x456224
push ecx
push dword [ecx]
lea eax, [ebp - 0x670]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x67c]
call fcn.004558c0
push dword [ebp - 0x67c]
call fcn.0053e4ac
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret 0xc