Function at 0x430f70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
lea ebp, [esp - 0x824]
sub esp, 0x824
push 0xffffffffffffffff
push 0x47fc53
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2268
call fcn.00468730
mov eax, dword [0x4bb27c]
xor eax, ebp
mov dword [ebp + 0x820], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x82c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
call fcn.00430f10
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.00403120
add eax, 0x10
add esp, 4
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.00430e60
lea eax, [ebp - 0x24]
push eax
push 0x2000
lea ecx, [ebp - 0x2278]
push ecx
mov dword [ebp - 0x24], ebx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x43108b
push str.CNProcess::Attach
lea ecx, [ebp - 0x14]
call fcn.004031f0
push 0x48f7cc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.004031f0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 4], 5
call edi
test eax, eax
jg 0x43103f
call edi
mov esi, eax
jmp 0x43104f
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
push ebx
call edi
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.00435510
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push 0x75
lea edx, [ebp - 0x18]
push edx
push esi
push eax
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 6
call fcn.0041fce0
push 0x4b1c2c
lea eax, [ebp - 0x1d0]
push eax
call fcn.00466ffb
mov edx, dword [0x4be0cc]
mov eax, dword [edx + 0xc]
shr dword [ebp - 0x24], 2
mov ecx, 0x4be0cc
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 7
xor ebx, ebx
jmp 0x4310b0
cmp ebx, dword [ebp - 0x24]
jae 0x4311e7
mov ecx, dword [ebp + ebx*4 - 0x2278]
mov edx, dword [ebp + 0x830]
push ecx
push 0
or edx, 0x410
push edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4311df
lea eax, [ebp - 0x28]
push eax
push 4
lea ecx, [ebp - 0x18]
push ecx
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x43112c
mov eax, dword [ebp - 0x18]
push 0x410
lea edx, [ebp]
push edx
push eax
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
lea eax, [ebp]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x431110
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00403080
lea ecx, [ebp - 0x1c]
call fcn.00430e60
cmp dword [ebp - 0x20], 0
mov edi, eax
je 0x4311d8
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jl 0x4311d8
mov edx, dword [ebp - 0x20]
push edx
push eax
call fcn.004663f8
add esp, 8
test eax, eax
je 0x4311d8
sub eax, dword [edi]
sar eax, 1
js 0x4311d8
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43118c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4311af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x820]
xor ecx, ebp
call fcn.0046605d
add ebp, 0x824
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 1
jmp 0x4310b0
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43120a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43122d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x4311b1