Function at 0x10008200
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x598
push ebx
push esi
push edi
push 0x428
xor edi, edi
lea eax, [ebp - 0x594]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x94]
push ecx
mov esi, 4
push esi
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
push 0x18
push 0x10014548
mov eax, 0x10014544
mov dword [ebp - 0x594], 0x428
call fcn.10006880
xor eax, eax
lea edx, [ebp - 0x18]
push edx
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
push 0x12
push 0x10014564
mov eax, 0x10014560
call fcn.10006880
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x16
push 0x1001457c
mov eax, 0x10014578
call fcn.10006880
xor eax, eax
lea ecx, [ebp - 0xc8]
push ecx
push esi
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
push 0x1c
push 0x10014598
mov eax, 0x10014594
call fcn.10006880
add esp, 0x4c
xor eax, eax
lea edx, [ebp - 0x60]
push edx
push esi
push 0x1a
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x48], ax
push 0x100145b8
mov eax, 0x100145b4
call fcn.10006880
xor eax, eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x7c]
push eax
push esi
push 0x1a
push 0x100145d8
mov eax, 0x100145d4
call fcn.10006880
xor eax, eax
lea ecx, [ebp - 0x44]
push ecx
push esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
push 0x14
push 0x100145f8
mov eax, 0x100145f4
call fcn.10006880
xor eax, eax
lea edx, [ebp - 0xac]
push edx
push esi
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
push 0x18
push 0x10014610
mov eax, 0x1001460c
call fcn.10006880
xor eax, eax
add esp, 0x40
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov word [ebp - 0xf4], ax
lea eax, [ebp - 0x118]
push eax
push esi
push 0x26
push 0x1001462c
mov eax, 0x10014628
call fcn.10006880
xor eax, eax
lea ecx, [ebp - 0xf0]
push ecx
push esi
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov word [ebp - 0xcc], ax
push 0x26
push 0x10014658
mov eax, 0x10014654
call fcn.10006880
lea edx, [ebp - 0x94]
mov dword [ebp - 0x16c], edx
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0xc8]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x154], edx
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x7c]
lea edx, [ebp - 0x44]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x13c], edx
lea eax, [ebp - 0xac]
lea ecx, [ebp - 0x118]
lea edx, [ebp - 0xf0]
add esp, 0x20
mov dword [ebp - 0x168], esi
mov dword [ebp - 0x160], esi
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x150], esi
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x124], edx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1000855d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
jne 0x1000854e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x64
jb 0x10008525
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x594]
push eax
push ebx
mov dword [ebp - 0x594], 0x428
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1000860d
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
xor esi, esi
jmp 0x10008590
mov ecx, dword [ebp + esi*8 - 0x16c]
push ecx
lea edx, [ebp - 0x574]
push edx
call edi
add esp, 8
test eax, eax
je 0x100085b0
inc esi
cmp esi, 0xa
jb 0x10008590
jmp 0x100085bc
mov ecx, dword [ebp + esi*8 - 0x168]
mov eax, dword [ebp + 8]
or dword [eax], ecx
lea edx, [ebp - 0x594]
push edx
push ebx
mov dword [ebp - 0x594], 0x428
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x10008583
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor esi, esi
mov eax, dword [ebp + esi*8 - 0x16c]
push eax
call edi
test eax, eax
jne 0x100085fc
inc esi
cmp esi, 0xa
jb 0x100085e6
jmp 0x10008608
mov ecx, dword [ebp + esi*8 - 0x168]
mov eax, dword [ebp + 8]
or dword [eax], ecx
mov edi, 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret