Function at 0x101a0940
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b1a34
mov eax, dword fs:[0]
push eax
sub esp, 0x710
push ebx
push esi
push edi
lea edi, [ebp - 0x4dc]
mov ecx, 0x134
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101e5800]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x70c], 1
mov dword [ebp - 4], 1
mov byte [ebp - 0x715], 0
mov ecx, 0x101f136a
call fcn.1009080a
nop
push 0x48
mov ecx, dword [ebp + 8]
call fcn.10090a3a
mov ecx, dword [ebp + 8]
call fcn.1008ed7f
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x70c]
or eax, 1
mov dword [ebp - 0x70c], eax
lea ecx, [ebp + 0xc]
call fcn.1008e154
movzx eax, al
test eax, eax
jne 0x101a0a27
mov dword [ebp - 0x70c], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x70c]
and eax, 1
je 0x101a0a03
and dword [ebp - 0x70c], 0xfffffffe
mov ecx, dword [ebp + 8]
call fcn.1008f270
nop
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.10090ec7
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x30]
call fcn.1008f64e
nop
mov eax, dword [ebp + 8]
jmp 0x101a0bba
mov dword [ebp - 0x288], 0x224
mov eax, dword [ebp + 0x28]
push eax
push 0x18
call fcn.1008efbe
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xffffffff
je 0x101a0adb
mov dword [ebp - 0x4c0], 0x224
lea eax, [ebp - 0x4c0]
push eax
mov ecx, dword [ebp - 0x294]
push ecx
call fcn.1008f5c7
test eax, eax
je 0x101a0adb
lea ecx, [ebp + 0x30]
call fcn.1009037d
push eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.1008e1d1
add esp, 8
test eax, eax
je 0x101a0aa8
lea ecx, [ebp + 0x30]
call fcn.1009037d
push eax
lea eax, [ebp - 0x3a0]
push eax
call fcn.1008e1d1
add esp, 8
test eax, eax
jne 0x101a0ac4
mov byte [ebp - 0x715], 1
mov ecx, 0x89
lea esi, [ebp - 0x4c0]
lea edi, [ebp - 0x288]
rep movsd dword es:[edi], dword [esi]
jmp 0x101a0adb
lea eax, [ebp - 0x4c0]
push eax
mov ecx, dword [ebp - 0x294]
push ecx
call fcn.100902ab
test eax, eax
jne 0x101a0a70
mov esi, esp
mov eax, dword [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1008fbee
nop
cmp byte [ebp - 0x715], 0
jne 0x101a0b08
push 0x101a0c2d
call fcn.10090756
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x274]
mov dword [eax + 0x38], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x270]
mov dword [eax + 0x40], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov edx, dword [ebp + 8]
add ecx, dword [edx + 0x40]
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x26c]
mov dword [eax + 0x44], ecx
mov byte [ebp - 0x715], 1
lea eax, [ebp - 0x168]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.1008fb67
nop
mov byte [ebp - 0x715], 1
lea eax, [ebp - 0x268]
push eax
mov ecx, dword [ebp + 8]
call fcn.1008fb67
nop
mov dword [ebp - 0x70c], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x70c]
and eax, 1
je 0x101a0b9b
and dword [ebp - 0x70c], 0xfffffffe
mov ecx, dword [ebp + 8]
call fcn.1008f270
nop
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.10090ec7
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x30]
call fcn.1008f64e
nop
mov eax, dword [ebp + 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x101a0bf4]
call fcn.1008f74d
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008f0d1
add esp, 0x71c
cmp ebp, esp
call fcn.1008fbee
mov esp, ebp
pop ebp
ret