Function at 0x401000
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x41bafe
mov eax, dword fs:[0]
push eax
mov eax, 0x1198
call fcn.00419980
mov eax, dword [0x4242c0]
xor eax, esp
mov dword [esp + 0x1194], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4242c0]
xor eax, esp
push eax
lea eax, [esp + 0x11ac]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x11b4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
mov dword [esp + 0x44], ebp
cmp ebp, ebx
jne 0x4010d7
mov byte [esp + 0x11b4], bl
mov esi, 0x10
cmp dword [esp + 0x11d4], esi
jb 0x401098
mov eax, dword [esp + 0x11c0]
push eax
call fcn.0040a02e
add esp, 4
mov edi, 0xf
mov dword [esp + 0x11d4], edi
mov dword [esp + 0x11d0], ebx
mov byte [esp + 0x11c0], bl
mov dword [esp + 0x11b4], 0xffffffff
cmp dword [esp + 0x11f0], esi
jb 0x401500
mov ecx, dword [esp + 0x11dc]
push ecx
jmp 0x4014f8
push ebx
push 0x4202e9
lea ecx, [esp + 0x1074]
mov byte [esp + 0x1e], bl
mov dword [esp + 0x108c], 0xf
mov dword [esp + 0x1088], ebx
mov byte [esp + 0x1078], bl
call fcn.00405790
mov byte [esp + 0x11b4], 2
lea edx, [esp + 0x24]
push edx
push 0x1000
lea eax, [esp + 0x74]
push eax
push ebp
mov byte [esp + 0x25], bl
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x401462
xor esi, esi
test dword [esp + 0x24], 0xfffffffc
mov dword [esp + 0x20], esi
jbe 0x401462
jmp 0x401150
mov edx, dword [esp + esi*4 + 0x6c]
push 0x82
lea ecx, [esp + 0x10a8]
push ecx
push edx
push ebp
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x40136a
mov ebp, 0xf
lea eax, [esp + 0x10a4]
mov dword [esp + 0x10a0], ebp
mov dword [esp + 0x109c], ebx
mov byte [esp + 0x108c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401194
sub eax, edx
push eax
lea eax, [esp + 0x10a8]
push eax
lea ecx, [esp + 0x1090]
call fcn.00405790
mov byte [esp + 0x11b4], 3
lea eax, [esp + 0x10a4]
mov dword [esp + 0x68], ebp
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4011d0
sub eax, edx
push eax
lea ecx, [esp + 0x10a8]
push ecx
lea ecx, [esp + 0x58]
call fcn.00405790
mov byte [esp + 0x11b4], 4
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x4c]
push eax
mov esi, edi
call fcn.00403130
mov byte [esp + 0x11b4], 3
cmp dword [esp + 0x68], 0x10
jb 0x401220
mov ecx, dword [esp + 0x54]
push ecx
call fcn.0040a02e
add esp, 4
mov esi, dword [edi + 0x18]
mov eax, dword [edi]
mov edi, dword [esp + 0x48]
mov dword [esp + 0x68], ebp
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
cmp edi, ebx
je 0x40123d
cmp edi, eax
je 0x401242
call fcn.0040a4d0
mov ebp, dword [esp + 0x4c]
cmp ebp, esi
je 0x40127b
mov byte [esp + 0x16], 1
cmp edi, ebx
jne 0x401421
call fcn.0040a4d0
xor edi, edi
cmp ebp, dword [edi + 0x18]
jne 0x401268
call fcn.0040a4d0
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
push ebx
push eax
lea ecx, [esp + 0x1078]
call fcn.00405d70
mov esi, 0xf
cmp dword [esp + 0x11ec], ebx
je 0x4012e1
lea eax, [esp + 0x10a4]
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4012a0
sub eax, edx
push eax
lea edx, [esp + 0x10a8]
push edx
lea ecx, [esp + 0x30]
call fcn.00405790
mov byte [esp + 0x11b4], 5
or dword [esp + 0x18], 1
lea eax, [esp + 0x28]
lea edx, [esp + 0x11d8]
call fcn.00404f10
mov byte [esp + 0x17], 1
test al, al
jne 0x4012e5
mov byte [esp + 0x17], bl
mov dword [esp + 0x11b4], 3
test byte [esp + 0x18], 1
je 0x40131c
and dword [esp + 0x18], 0xfffffffe
cmp dword [esp + 0x40], 0x10
jb 0x401310
mov eax, dword [esp + 0x2c]
push eax
call fcn.0040a02e
add esp, 4
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp byte [esp + 0x17], bl
je 0x401327
mov byte [esp + 0x15], 1
mov byte [esp + 0x11b4], 2
cmp dword [esp + 0x10a0], 0x10
jb 0x401349
mov ecx, dword [esp + 0x108c]
push ecx
call fcn.0040a02e
add esp, 4
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10a0], esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x109c], ebx
mov byte [esp + 0x108c], bl
mov edx, dword [esp + 0x24]
inc esi
shr edx, 2
mov dword [esp + 0x20], esi
cmp esi, edx
jb 0x401150
cmp byte [esp + 0x15], bl
jne 0x401462
cmp byte [esp + 0x16], bl
je 0x401462
lea eax, [esp + 0x1c]
push eax
push 1
push ebx
push str.SOFTWAREDashlane_internaluser
push 0x80000001
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x401462
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x1074]
push ecx
mov edi, 0xf
lea ecx, [esp + 0x34]
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
call fcn.00405d70
mov byte [esp + 0x11b4], 6
push 0x19
push str._should_not_be_loaded_at
lea eax, [esp + 0x30]
call fcn.004054f0
push ebx
lea edx, [esp + 0x11c0]
mov esi, eax
push edx
or eax, 0xffffffff
call fcn.00405600
push 0x1b
push str._startup___call_GM_96841368
call fcn.004054f0
mov esi, 0x10
cmp dword [eax + 0x18], esi
jb 0x401428
mov eax, dword [eax + 4]
jmp 0x40142b
mov edi, dword [edi]
jmp 0x40125e
add eax, 4
push ebx
push 0x41f724
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [esp + 0x11b4], 2
cmp dword [esp + 0x40], esi
jb 0x401454
mov eax, dword [esp + 0x2c]
push eax
call fcn.0040a02e
add esp, 4
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
jmp 0x40146a
mov esi, 0x10
lea edi, [esi - 1]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x11b4], 1
cmp dword [esp + 0x1084], esi
jb 0x401492
mov ecx, dword [esp + 0x1070]
push ecx
call fcn.0040a02e
add esp, 4
mov dword [esp + 0x1084], edi
mov dword [esp + 0x1080], ebx
mov byte [esp + 0x1070], bl
mov byte [esp + 0x11b4], bl
cmp dword [esp + 0x11d4], esi
jb 0x4014c7
mov edx, dword [esp + 0x11c0]
push edx
call fcn.0040a02e
add esp, 4
mov dword [esp + 0x11d4], edi
mov dword [esp + 0x11d0], ebx
mov byte [esp + 0x11c0], bl
mov dword [esp + 0x11b4], 0xffffffff
cmp dword [esp + 0x11f0], esi
jb 0x401500
mov eax, dword [esp + 0x11dc]
push eax
call fcn.0040a02e
add esp, 4
mov byte [esp + 0x11dc], bl
mov dword [esp + 0x11ec], ebx
mov dword [esp + 0x11f0], edi
mov ecx, dword [esp + 0x11ac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1194]
xor ecx, esp
call fcn.0040a01f
add esp, 0x11a4
ret