Function at 0x64841d40
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov eax, 0x2036c
mov ebp, esp
push edi
push esi
push ebx
call fcn.648513a0
xor ebx, ebx
mov dword [esp + 8], 0x20000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x20358]
mov dword [esp], eax
call sub.msvcrt.dll_strncpy
lea eax, [ebp - 0x20358]
mov byte [ebp - 0x359], 0
jmp 0x64841d89
mov byte [eax], 0
add ebx, 1
add eax, 1
mov dword [esp + 4], 9
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x64841d80
mov eax, 1
mov ecx, ebx
shl eax, cl
sub eax, 1
mov dword [ebp - 0x2036c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x134], 0x128
test eax, eax
je 0x64841fab
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20364], 0
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x2036c]
test eax, eax
je 0x64841f65
mov eax, dword [ebp + 8]
test eax, eax
je 0x64841f42
mov dword [ebp - 0x20368], 0
jmp 0x64841e2a
mov eax, dword [ebp + 8]
test eax, eax
jne 0x64841f34
lea eax, [ebp - 0x134]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20364]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
je 0x64841f76
mov eax, dword [ebp - 0x12c]
cmp eax, 4
jbe 0x64841dfc
mov dword [ebp - 0x358], 0x224
mov dword [esp + 4], eax
mov dword [esp], 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x358]
sub esp, 8
mov dword [ebp - 0x20360], eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_Module32First
sub esp, 8
test eax, eax
je 0x64841f95
xor edi, edi
lea eax, [ebp - 0x338]
xor esi, esi
mov dword [esp], eax
lea ebx, [ebp - 0x20358]
call sub.msvcrt.dll__strlwr
jmp 0x64841e93
add esi, 1
lea edx, [ebp - 0x338]
mov dword [esp + 4], ebx
mov dword [esp], edx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x64841eb4
mov eax, 1
mov ecx, esi
shl eax, cl
or edi, eax
mov dword [esp], ebx
mov dword [esp + 4], 0
call sub.msvcrt.dll_strchr
cmp byte [eax + 1], 0
lea ebx, [eax + 1]
jne 0x64841e90
lea eax, [ebp - 0x358]
mov dword [esp + 4], eax
mov edx, dword [ebp - 0x20360]
mov dword [esp], edx
call sub.KERNEL32.dll_Module32Next
sub esp, 8
test eax, eax
jne 0x64841e77
mov ecx, dword [ebp - 0x20360]
mov dword [esp], ecx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
cmp edi, dword [ebp - 0x2036c]
jne 0x64841dfc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x64841f22
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x20368]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp + 8]
add dword [ebp - 0x20368], 1
test eax, eax
je 0x64841e07
mov eax, dword [ebp - 0x20368]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x134]
mov dword [esp + 4], eax
mov edx, dword [ebp - 0x20364]
mov dword [esp], edx
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
jne 0x64841df0
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20368], 0
test edi, edi
jne 0x64841f34
mov edx, dword [ebp - 0x20364]
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x20368]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp - 0x20360]
mov dword [esp], ecx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x64841dfc
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0x20364], eax
jmp 0x64841dd7