Function at 0x4101a0
Capabilities:
Enumerate process modules
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5dd2
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1748
call fcn.004a9180
mov eax, dword [0x51fee0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x1718]
mov dword [ebp - 0x16e8], edi
call fcn.00443cd0
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x16d8], ebx
mov dword [ebp - 0x16c4], eax
mov dword [ebp - 0x16d4], eax
mov dword [ebp - 0x16d0], ebx
push 0x4db31c
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00444250
sub esp, 0x18
mov ecx, eax
push esp
call fcn.00444a40
lea eax, [ebp - 0x16dc]
push eax
call fcn.0044ff60
add esp, 0x1c
push 0x4db428
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.004452a0
test al, al
je 0x4102a7
push 0x4db428
mov ecx, esi
call fcn.00444250
mov ecx, eax
call fcn.00445270
test al, al
je 0x4102a7
push 0x4db428
mov ecx, esi
call fcn.00444250
mov ecx, eax
call fcn.00444940
mov esi, eax
test esi, esi
je 0x4102a7
push 1
lea ecx, [ebp - 0x16d8]
call fcn.0040c3e0
mov edi, dword [ebp - 0x16d4]
test edi, edi
je 0x410299
mov dword [edi], esi
add edi, 4
mov dword [ebp - 0x16d4], edi
jmp 0x41071a
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x16bc], esi
cmp esi, 0xffffffff
jne 0x4103b6
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x16cc], eax
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x16cc]
push str.enumModules_CreateToolhelp32Snapshot_process__d
push eax
call fcn.004060e0
add esp, 0xc
lea eax, [ebp - 0x16cc]
push eax
lea eax, [ebp - 0x1064]
push eax
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x1728]
mov byte [ebp - 4], 5
call fcn.00443bf0
push 0x4da4ec
lea ecx, [ebp - 0x1718]
mov byte [ebp - 4], 6
call fcn.00444170
lea ecx, [ebp - 0x1728]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x1728]
mov byte [ebp - 4], 5
call fcn.00443ee0
cmp dword [ebp - 0x1050], 0x10
jb 0x410364
push dword [ebp - 0x1064]
call fcn.004a6c2e
add esp, 4
mov edx, dword [ebp - 0x16cc]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lea ecx, [edx + 0xc]
mov byte [ebp - 4], 3
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41038a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x16dc]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4103ad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x410e02
push 0x22c
lea eax, [ebp - 0x1290]
push 0
push eax
call fcn.004a8550
add esp, 0xc
lea eax, [ebp - 0x1290]
push eax
push esi
mov dword [ebp - 0x1290], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x410e78
mov esi, dword [0x521340]
lea ecx, [esi + 2]
lea eax, [esi + 1]
imul ecx, eax
imul ecx, esi
and ecx, 0x8000000f
jns 0x41040a
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 0xd
jne 0x410450
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x2f4]
mov esi, 4
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a63b0
add esp, 4
push eax
call fcn.004a8200
add esp, 4
lea ecx, [ecx]
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x16c0], esi
lea eax, [ebp - 0x126c]
mov byte [ebp - 4], 7
test eax, 0xffff0000
jne 0x410498
movzx edi, ax
push 0
push edi
call fcn.00403bc0
add esp, 8
test eax, eax
je 0x4104c9
push edi
push eax
lea ecx, [ebp - 0x16c0]
call fcn.004075c0
jmp 0x4104c3
lea ecx, [ebp - 0x126c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4104a1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x126c]
push eax
lea ecx, [ebp - 0x16c0]
call fcn.004097a0
mov esi, dword [ebp - 0x16c0]
mov byte [ebp - 4], 8
call fcn.00417820
test al, al
jne 0x41051a
mov edi, dword [0x521340]
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub edi, ecx
xor ecx, ecx
lea eax, [edi + 0x2f4]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a63b0
add esp, 4
push eax
call fcn.004a8200
add esp, 4
mov edi, dword [esi - 0xc]
test edi, edi
jns 0x41052b
push 0x80070057
call fcn.004044c0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x41054e
push edi
lea ecx, [ebp - 0x16c0]
call fcn.00408680
mov esi, dword [ebp - 0x16c0]
lea eax, [edi + 1]
push eax
push esi
call fcn.004a8c86
add esp, 8
cmp edi, dword [esi - 8]
jg 0x410521
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
mov eax, dword [ebp - 0x16dc]
cmp dword [eax - 0xc], 0
jl 0x4106d4
push esi
push eax
call fcn.004a87ef
mov edi, dword [ebp - 0x16c4]
add esp, 8
test eax, eax
je 0x4106da
sub eax, dword [ebp - 0x16dc]
sar eax, 1
js 0x4106da
mov edx, dword [ebp - 0x16d8]
lea eax, [ebp - 0x1288]
cmp eax, edi
jae 0x410654
cmp edx, eax
ja 0x410654
mov ecx, eax
sub ecx, edx
sar ecx, 2
mov dword [ebp - 0x16c8], ecx
cmp edi, ebx
jne 0x410637
mov eax, ebx
sub eax, edi
sar eax, 2
cmp eax, 1
jae 0x410637
sub edi, edx
sar edi, 2
mov eax, 0x3fffffff
sub eax, edi
cmp eax, 1
jae 0x4105f3
push str.vector_T__too_long
call fcn.004a6300
sub ebx, edx
sar ebx, 2
mov ecx, ebx
shr ecx, 1
mov eax, 0x3fffffff
sub eax, ecx
inc edi
cmp eax, ebx
jae 0x41060c
xor ebx, ebx
jmp 0x41060e
add ebx, ecx
cmp ebx, edi
cmovb ebx, edi
push ebx
lea ecx, [ebp - 0x16d8]
call fcn.0040c360
mov ebx, dword [ebp - 0x16d0]
mov edi, dword [ebp - 0x16d4]
mov ecx, dword [ebp - 0x16c8]
mov edx, dword [ebp - 0x16d8]
test edi, edi
je 0x410640
mov eax, dword [edx + ecx*4]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x16c4], edi
mov dword [ebp - 0x16d4], edi
jmp 0x4106da
cmp edi, ebx
jne 0x4106b7
mov eax, ebx
sub eax, edi
sar eax, 2
cmp eax, 1
jae 0x4106b7
sub edi, edx
sar edi, 2
mov eax, 0x3fffffff
sub eax, edi
cmp eax, 1
jae 0x41067f
push str.vector_T__too_long
call fcn.004a6300
sub ebx, edx
sar ebx, 2
mov ecx, ebx
shr ecx, 1
mov eax, 0x3fffffff
sub eax, ecx
inc edi
cmp eax, ebx
jae 0x410698
xor ebx, ebx
jmp 0x41069a
add ebx, ecx
cmp ebx, edi
cmovb ebx, edi
push ebx
lea ecx, [ebp - 0x16d8]
call fcn.0040c360
mov ebx, dword [ebp - 0x16d0]
mov edi, dword [ebp - 0x16d4]
test edi, edi
je 0x4106c3
mov eax, dword [ebp - 0x1288]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x16c4], edi
mov dword [ebp - 0x16d4], edi
jmp 0x4106da
mov edi, dword [ebp - 0x16c4]
add esi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4106f8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x16bc]
lea eax, [ebp - 0x1290]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x410450
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or ebx, 0xffffffff
xor ecx, ecx
mov esi, dword [ebp - 0x16d8]
mov eax, edi
sub eax, esi
sar eax, 2
mov dword [ebp - 0x16cc], ecx
cmp ecx, eax
jae 0x410d7b
push dword [esi + ecx*4]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x16c0], esi
test esi, esi
je 0x410d6f
push 0
lea ecx, [ebp - 0x1708]
call fcn.00443cd0
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push eax
mov byte [ebp - 4], 0xc
call fcn.004a8550
add esp, 0xc
lea eax, [ebp - 0x1014]
push 0x800
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
jne 0x4107e6
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x16c0], eax
mov byte [ebp - 4], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x16c0]
push str.enumModules_GetProcessImageFileName__d
push eax
call fcn.004060e0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x16c0]
jmp 0x410d43
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x16c4], eax
lea eax, [ebp - 0x1014]
mov byte [ebp - 4], 0xe
test eax, 0xffff0000
jne 0x410a13
movzx esi, ax
push 0
push esi
call fcn.00403bc0
add esp, 8
test eax, eax
je 0x410826
push esi
push eax
lea ecx, [ebp - 0x16c4]
call fcn.004075c0
mov esi, dword [ebp - 0x16c0]
lea eax, [ebp - 0x16c4]
push eax
lea eax, [ebp - 0x102c]
push eax
mov byte [ebp - 4], 0xf
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x1738]
mov byte [ebp - 4], 0x10
call fcn.00443bf0
push str.process
lea ecx, [ebp - 0x1708]
mov byte [ebp - 4], 0x11
call fcn.00444170
lea ecx, [ebp - 0x1738]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x1738]
mov byte [ebp - 4], 0x10
call fcn.00443ee0
cmp dword [ebp - 0x1018], 0x10
mov byte [ebp - 4], 0xf
jb 0x4108a2
push dword [ebp - 0x102c]
call fcn.004a6c2e
add esp, 4
mov eax, dword [ebp - 0x16cc]
mov ebx, dword [ebp - 0x16d8]
lea ecx, [ebp - 0x1748]
push dword [ebx + eax*4]
call fcn.00443c30
push 0x4db428
lea ecx, [ebp - 0x1708]
mov byte [ebp - 4], 0x12
call fcn.00444170
lea ecx, [ebp - 0x1748]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x1748]
mov byte [ebp - 4], 0xf
call fcn.00443ee0
push 0
lea ecx, [ebp - 0x1728]
call fcn.00443cd0
mov eax, dword [ebp - 0x16cc]
mov byte [ebp - 4], 0x13
push dword [ebx + eax*4]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x410a47
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x16e0], eax
mov byte [ebp - 4], 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x16e0]
push str.enumModules_CreateToolhelp32Snapshot_moudules__d
push eax
call fcn.004060e0
add esp, 0xc
lea eax, [ebp - 0x16e0]
push eax
lea eax, [ebp - 0x102c]
push eax
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x1758]
mov byte [ebp - 4], 0x15
call fcn.00443bf0
push 0x4da4ec
lea ecx, [ebp - 0x1708]
mov byte [ebp - 4], 0x16
call fcn.00444170
lea ecx, [ebp - 0x1758]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x1758]
mov byte [ebp - 4], 0x15
call fcn.00443ee0
cmp dword [ebp - 0x1018], 0x10
mov byte [ebp - 4], 0x14
jb 0x4109c0
push dword [ebp - 0x102c]
call fcn.004a6c2e
add esp, 4
lea eax, [ebp - 0x1708]
push eax
lea ecx, [ebp - 0x1718]
call fcn.004447e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x16e0]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0x13
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4109ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1728]
mov byte [ebp - 4], 0xf
call fcn.00443ee0
jmp 0x410d3d
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410a20
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x16c4]
call fcn.004097a0
jmp 0x41082c
lea eax, [ebp - 0x16b8]
push eax
push ebx
mov dword [ebp - 0x16b8], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x410c19
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x814], ax
lea eax, [ebp - 0x812]
push eax
call fcn.004a8550
mov eax, dword [0x521340]
imul eax, eax
cdq
mov ecx, 0x14
idiv ecx
add esp, 0xc
cmp edx, 0x11
jne 0x410aa9
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push 0x800
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x169c]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
jne 0x410b05
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x16c8], eax
mov byte [ebp - 4], 0x17
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x16c8]
push str.enumModules_GetModuleFileNameEx__d
push eax
call fcn.004060e0
mov edx, dword [ebp - 0x16c8]
add esp, 0xc
jmp 0x410bb1
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x16e4], eax
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 0x18
test eax, 0xffff0000
jne 0x410be9
movzx esi, ax
push 0
push esi
call fcn.00403bc0
add esp, 8
test eax, eax
je 0x410b45
push esi
push eax
lea ecx, [ebp - 0x16e4]
call fcn.004075c0
mov esi, dword [ebp - 0x16c0]
lea eax, [ebp - 0x16e4]
push eax
lea eax, [ebp - 0x102c]
push eax
mov byte [ebp - 4], 0x19
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x105c]
mov byte [ebp - 4], 0x1a
call fcn.00443bf0
push eax
lea ecx, [ebp - 0x1728]
mov byte [ebp - 4], 0x1b
call fcn.004447e0
lea ecx, [ebp - 0x105c]
mov byte [ebp - 4], 0x1a
call fcn.00443ee0
cmp dword [ebp - 0x1018], 0x10
jb 0x410bab
push dword [ebp - 0x102c]
call fcn.004a6c2e
add esp, 4
mov edx, dword [ebp - 0x16e4]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
mov byte [ebp - 4], 0x13
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410bcf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x16b8]
push eax
push ebx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x410a66
jmp 0x410ce0
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410bf2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x16e4]
call fcn.004097a0
jmp 0x410b4b
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x16bc], eax
mov byte [ebp - 4], 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x16bc]
push str.enumModules_CreateToolhelp32Snapshot_moudules__d
push eax
call fcn.004060e0
add esp, 0xc
lea eax, [ebp - 0x16bc]
push eax
lea eax, [ebp - 0x102c]
push eax
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x16f8]
mov byte [ebp - 4], 0x1d
call fcn.00443bf0
push 0x4da4ec
lea ecx, [ebp - 0x1708]
mov byte [ebp - 4], 0x1e
call fcn.00444170
lea ecx, [ebp - 0x16f8]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x16f8]
mov byte [ebp - 4], 0x1d
call fcn.00443ee0
cmp dword [ebp - 0x1018], 0x10
jb 0x410cbc
push dword [ebp - 0x102c]
call fcn.004a6c2e
add esp, 4
mov edx, dword [ebp - 0x16bc]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x13
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410ce0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1728]
call fcn.00445740
test eax, eax
je 0x410d0d
push str.modules
lea ecx, [ebp - 0x1708]
call fcn.00444170
lea ecx, [ebp - 0x1728]
push ecx
mov ecx, eax
call fcn.00443f80
lea eax, [ebp - 0x1708]
push eax
lea ecx, [ebp - 0x1718]
call fcn.004447e0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push esi
call ebx
lea ecx, [ebp - 0x1728]
mov byte [ebp - 4], 0xf
call fcn.00443ee0
or ebx, 0xffffffff
mov edx, dword [ebp - 0x16c4]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xc
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410d60
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1708]
mov byte [ebp - 4], 3
call fcn.00443ee0
mov ecx, dword [ebp - 0x16cc]
inc ecx
jmp 0x41071f
lea ecx, [ebp - 0x1718]
call fcn.00444c90
test al, al
je 0x410dcb
push str.empty
lea ecx, [ebp - 0x16f8]
call fcn.00443c90
push 0x4da4ec
lea ecx, [ebp - 0x1718]
mov byte [ebp - 4], 0x1f
call fcn.00444170
lea ecx, [ebp - 0x16f8]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x16f8]
mov byte [ebp - 4], 3
call fcn.00443ee0
mov edx, dword [ebp - 0x16dc]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410dee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x410dfb
push esi
call fcn.004a6c2e
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x104c]
call fcn.00445f40
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
mov byte [ebp - 4], 0x24
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x16bc], esi
lea eax, [ebp - 0x1718]
push eax
lea eax, [ebp - 0x102c]
push eax
lea ecx, [ebp - 0x104c]
mov byte [ebp - 4], 0x25
call fcn.00448e50
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x26
jb 0x410e52
mov edx, dword [edx]
sub esp, 0x18
mov edi, esp
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp byte [edx], 0
jne 0x410fcb
xor ecx, ecx
jmp 0x410fd9
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x16bc], eax
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x16bc]
push str.enumModules_Process32First__d
push eax
call fcn.004060e0
add esp, 0xc
lea eax, [ebp - 0x16bc]
push eax
lea eax, [ebp - 0x102c]
push eax
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x16f8]
mov byte [ebp - 4], 0xa
call fcn.00443bf0
push 0x4da4ec
lea ecx, [ebp - 0x1718]
mov byte [ebp - 4], 0xb
call fcn.00444170
lea ecx, [ebp - 0x16f8]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x16f8]
mov byte [ebp - 4], 0xa
call fcn.00443ee0
cmp dword [ebp - 0x1018], 0x10
jb 0x410f1b
push dword [ebp - 0x102c]
call fcn.004a6c2e
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x16bc]
jmp 0x41036a
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410fd0
sub ecx, ebx
push ecx
push edx
mov ecx, edi
call fcn.00401460
lea eax, [ebp - 0x16c8]
push eax
call fcn.0044ff60
add esp, 0x1c
mov eax, dword [eax]
lea ebx, [esi - 0x10]
lea edi, [eax - 0x10]
mov byte [ebp - 4], 0x27
cmp edi, ebx
je 0x4110ae
cmp dword [ebx + 0xc], 0
jl 0x411099
mov ecx, dword [edi]
cmp ecx, dword [ebx]
jne 0x411099
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x41103a
cmp ecx, dword [edi]
jne 0x41103a
mov esi, edi
mov ecx, 1
lock xadd dword [eax], ecx
jmp 0x411077
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov esi, eax
test esi, esi
jne 0x41104e
call fcn.0040c350
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.004a8205
add esp, 0x10
or eax, 0xffffffff
lea ecx, [ebx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41108e
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0x10
mov dword [ebp - 0x16bc], esi
jmp 0x4110ae
push dword [eax - 0xc]
lea ecx, [ebp - 0x16bc]
push eax
call fcn.004097a0
mov esi, dword [ebp - 0x16bc]
mov edx, dword [ebp - 0x16c8]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0x26
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4110d4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x1018], 0x10
mov byte [ebp - 4], 0x25
jb 0x4110ef
push dword [ebp - 0x102c]
call fcn.004a6c2e
add esp, 4
mov edi, dword [ebp - 0x16e8]
mov eax, 8
mov word [edi], ax
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x411110
call fcn.0040c350
add esi, 0xfffffff0
mov dword [edi + 8], eax
mov byte [ebp - 4], 0x24
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x41112e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x1034], 0x10
mov byte [ebp - 4], 0
mov dword [ebp - 0x104c], 0x4da4e4
jb 0x411153
push dword [ebp - 0x1048]
call fcn.004a6c2e
add esp, 4
lea ecx, [ebp - 0x104c]
mov dword [ebp - 0x1034], 0xf
mov dword [ebp - 0x1038], 0
mov byte [ebp - 0x1048], 0
call fcn.00446040
lea ecx, [ebp - 0x1718]
mov dword [ebp - 4], 0xffffffff
call fcn.00443ee0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret