Function at 0x402f30
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41fd30
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x42b74c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x474], ebx
xor eax, eax
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
push edx
push 8
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x470], eax
cmp eax, 0xffffffff
jne 0x402fc0
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.00403180
cmp dword [ebp - 0x18], 8
jb 0x403155
push dword [ebp - 0x2c]
call fcn.00409936
add esp, 4
jmp 0x403155
lea ecx, [ebp - 0x46c]
mov dword [ebp - 0x46c], 0x428
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x403105
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
cmp word [ebp - 0x44c], ax
je 0x403015
lea eax, [ebp - 0x44c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403006
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x44]
call fcn.00402520
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
mov edi, dword [eax + 0x10]
jb 0x403039
mov ecx, dword [eax]
jmp 0x40303b
mov ecx, eax
cmp dword [ebp - 0x30], 8
lea edx, [ebp - 0x44]
mov ebx, dword [ebp - 0x34]
mov esi, edi
cmovae edx, dword [ebp - 0x44]
cmp ebx, edi
cmovb esi, ebx
test esi, esi
jne 0x403063
xor eax, eax
test eax, eax
jne 0x40308b
cmp ebx, edi
jae 0x403082
or eax, 0xffffffff
jmp 0x403089
mov ax, word [edx]
cmp ax, word [ecx]
jne 0x403074
add edx, 2
add ecx, 2
dec esi
jmp 0x403052
movzx eax, word [edx]
cmp ax, word [ecx]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x403056
xor eax, eax
cmp ebx, edi
setne al
test eax, eax
sete al
test al, al
je 0x4030cf
cmp word [ebp - 0x24c], 0
jne 0x4030a0
xor ecx, ecx
jmp 0x4030bf
lea ecx, [ebp - 0x24c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4030b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402520
mov byte [ebp - 4], 0
cmp dword [ebp - 0x30], 8
jb 0x4030e4
push dword [ebp - 0x44]
call fcn.00409936
add esp, 4
lea eax, [ebp - 0x46c]
push eax
push dword [ebp - 0x470]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x402fe0
mov ebx, dword [ebp - 0x474]
push dword [ebp - 0x470]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jae 0x403147
mov eax, dword [ebp - 0x1c]
inc eax
je 0x40314c
add eax, eax
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
call fcn.00409950
mov ecx, dword [ebp - 0x18]
add esp, 0xc
jmp 0x40314c
mov eax, dword [ebp - 0x2c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040993b
mov esp, ebp
pop ebp
ret