Function at 0x419938
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a056
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x36c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
xor edx, edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov byte [eax], dl
mov byte [ecx], dl
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x419996
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x370], 0x128
lea eax, [ebp - 0x370]
push eax
mov edx, dword [ebp - 0x18]
push edx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x419f3d
lea ecx, [ebp - 0x34c]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4199d7
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4199c0
add eax, 0xffffffff
mov dword [ebp - 0x14], eax
test eax, eax
je 0x419f1b
lea ecx, [ebp - 0x34c]
movsx edx, byte [ecx]
cmp edx, 0x41
jl 0x4199f8
cmp edx, 0x5a
jg 0x4199f8
add edx, 0x20
movsx edx, dl
mov byte [ecx], dl
add ecx, 1
cmp edx, 0x2e
jne 0x419a0e
mov byte [ecx - 1], 0
mov eax, 1
add eax, 0xffffffff
jne 0x4199e8
lea edi, [ebp - 0x34c]
mov esi, 0x4f84e4
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419a3e
test dl, dl
je 0x419a3a
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419a3e
add edi, 2
add esi, 2
test dl, dl
jne 0x419a1e
xor eax, eax
jmp 0x419a43
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f84ec
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419a76
test dl, dl
je 0x419a72
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419a76
add edi, 2
add esi, 2
test dl, dl
jne 0x419a56
xor eax, eax
jmp 0x419a7b
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f84f4
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419aae
test dl, dl
je 0x419aaa
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419aae
add edi, 2
add esi, 2
test dl, dl
jne 0x419a8e
xor eax, eax
jmp 0x419ab3
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f84f8
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419ae6
test dl, dl
je 0x419ae2
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419ae6
add edi, 2
add esi, 2
test dl, dl
jne 0x419ac6
xor eax, eax
jmp 0x419aeb
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8500
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419b1e
test dl, dl
je 0x419b1a
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419b1e
add edi, 2
add esi, 2
test dl, dl
jne 0x419afe
xor eax, eax
jmp 0x419b23
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8508
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419b56
test dl, dl
je 0x419b52
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419b56
add edi, 2
add esi, 2
test dl, dl
jne 0x419b36
xor eax, eax
jmp 0x419b5b
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8514
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419b8e
test dl, dl
je 0x419b8a
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419b8e
add edi, 2
add esi, 2
test dl, dl
jne 0x419b6e
xor eax, eax
jmp 0x419b93
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8520
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419bc6
test dl, dl
je 0x419bc2
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419bc6
add edi, 2
add esi, 2
test dl, dl
jne 0x419ba6
xor eax, eax
jmp 0x419bcb
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8528
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419bfe
test dl, dl
je 0x419bfa
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419bfe
add edi, 2
add esi, 2
test dl, dl
jne 0x419bde
xor eax, eax
jmp 0x419c03
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8540
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419c36
test dl, dl
je 0x419c32
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419c36
add edi, 2
add esi, 2
test dl, dl
jne 0x419c16
xor eax, eax
jmp 0x419c3b
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8554
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419c6e
test dl, dl
je 0x419c6a
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419c6e
add edi, 2
add esi, 2
test dl, dl
jne 0x419c4e
xor eax, eax
jmp 0x419c73
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f855c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419ca6
test dl, dl
je 0x419ca2
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419ca6
add edi, 2
add esi, 2
test dl, dl
jne 0x419c86
xor eax, eax
jmp 0x419cab
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8564
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419cde
test dl, dl
je 0x419cda
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419cde
add edi, 2
add esi, 2
test dl, dl
jne 0x419cbe
xor eax, eax
jmp 0x419ce3
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8570
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419d16
test dl, dl
je 0x419d12
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419d16
add edi, 2
add esi, 2
test dl, dl
jne 0x419cf6
xor eax, eax
jmp 0x419d1b
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8578
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419d4e
test dl, dl
je 0x419d4a
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419d4e
add edi, 2
add esi, 2
test dl, dl
jne 0x419d2e
xor eax, eax
jmp 0x419d53
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8580
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419d86
test dl, dl
je 0x419d82
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419d86
add edi, 2
add esi, 2
test dl, dl
jne 0x419d66
xor eax, eax
jmp 0x419d8b
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8588
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419dbe
test dl, dl
je 0x419dba
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419dbe
add edi, 2
add esi, 2
test dl, dl
jne 0x419d9e
xor eax, eax
jmp 0x419dc3
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f8590
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419df6
test dl, dl
je 0x419df2
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419df6
add edi, 2
add esi, 2
test dl, dl
jne 0x419dd6
xor eax, eax
jmp 0x419dfb
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f859c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419e2a
test dl, dl
je 0x419e26
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419e2a
add edi, 2
add esi, 2
test dl, dl
jne 0x419e0a
xor eax, eax
jmp 0x419e2f
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e6c
lea edi, [ebp - 0x34c]
mov esi, 0x4f85a4
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x419e5e
test dl, dl
je 0x419e5a
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x419e5e
add edi, 2
add esi, 2
test dl, dl
jne 0x419e3e
xor eax, eax
jmp 0x419e63
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
sete dl
jmp 0x419e71
mov edx, 1
test edx, edx
jne 0x419f1b
push dword [ebp - 0x368]
push 0x18
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419f1b
mov dword [ebp - 0x248], 0x224
lea eax, [ebp - 0x248]
push eax
push ebx
call sub.KERNEL32.DLL_Module32First
test eax, eax
je 0x41a02a
lea ecx, [ebp - 0x128]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x419ecf
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x419eb8
add eax, 0xffffffff
test eax, eax
je 0x419ee5
add ecx, eax
movsx edx, byte [ecx]
cmp edx, 0x5c
je 0x419ee2
cmp edx, 0x2f
jne 0x419f11
add ecx, 1
mov eax, dword [ecx]
cmp eax, 0x4c554150
jne 0x41a01a
movsx eax, byte [ecx + 4]
cmp eax, 0x2e
je 0x419f56
lea eax, [ebp - 0x248]
push eax
push ebx
call sub.KERNEL32.DLL_Module32Next
test eax, eax
jne 0x419eb0
jmp 0x41a02a
add ecx, 0xffffffff
add eax, 0xffffffff
jne 0x419ed5
jmp 0x419ee5
lea eax, [ebp - 0x370]
push eax
mov edx, dword [ebp - 0x18]
push edx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4199b8
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
cmp eax, 0x11
jbe 0x419f65
mov byte [ebp - 0x33b], 0
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x34c]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x419f6e
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebx, dword [ebp - 0x368]
push 0
push 0x4e3834
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x419fc6
mov dword [ebp - 0x374], 0
lea eax, [ebp - 0x374]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp ebx, dword [ebp - 0x374]
je 0x419fca
xor edi, edi
jmp 0x419fe8
push 0x48fb80
push 0x4198a0
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
test eax, eax
je 0x419fe3
xor edi, edi
jmp 0x419fe8
mov edi, 0x48fb80
test edi, edi
je 0x419ffd
mov esi, dword [ebp + 0xc]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x419fef
mov eax, dword [ebp - 0x368]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp eax, 0x6c756170
je 0x419ef2
jmp 0x419efb
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x419f1b