Function at 0x444423
Capabilities:
Enumerate process modules

Disassembly:
push ebp
push ebx
mov edx, 0x115
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x44442a
call fcn.0057b2e0
mov edx, dword [esp + 0x464]
lea ecx, [esp]
call fcn.0050d0f0
mov dword [section..data], 0x170005d
mov dword [section..data], 0x1700062
mov dword [esp + 4], 0
mov dword [section..data], 0x1700063
mov dword [esp + 8], 0
mov dword [section..data], 0x1700064
mov edx, 0x67a5ae
lea ecx, [esp + 0xc]
call fcn.0050d0f8
mov dword [section..data], 0x1700067
mov dword [esp + 0x14], 0x400
mov dword [section..data], 0x170006f
mov dword [section..data], 0x1700071
mov dword [esp + 0x450], 1
mov dword [section..data], 0x1700072
push dword [esp + 0x460]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 8], eax
mov dword [section..data], 0x1700074
mov ebx, dword [esp + 8]
cmp ebx, 0xffffffff
je 0x444837
mov dword [section..data], 0x1700076
lea ebp, [esp + 0x28]
mov dword [ebp], 0x428
mov dword [section..data], 0x1700078
lea eax, [esp + 0x28]
push eax
push dword [esp + 0xc]
call sub.KERNEL32.dll_Module32FirstW
and eax, eax
je 0x44452d
xor eax, eax
jmp 0x444532
mov eax, 1
and eax, eax
je 0x444663
mov dword [section..data], 0x1700079
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x170007a
mov ebx, dword [esp + 0x24]
cmp ebx, 0x12
jne 0x44459e
mov dword [section..data], 0x170007b
push 3
mov eax, str.No_running_processes_detected
push eax
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.0044386c
mov dword [section..data], 0x170007d
jmp 0x444e8a
mov dword [section..data], 0x170007e
mov dword [section..data], 0x170007f
push edx
call fcn.0057b460
pop edx
push eax
push 0
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.Module32First_failed__
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.0056a320
pop eax
mov edx, 0x69ad3c
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x34]
call fcn.00442f5c
pop eax
mov edx, 0x67ce72
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x1700080
mov dword [esp + 0x450], 0
mov dword [section..data], 0x1700081
jmp 0x444e8a
mov dword [section..data], 0x1700083
mov dword [section..data], 0x1700085
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
lea ebp, [esp + 0x38]
lea eax, [ebp + 0x20]
push eax
call fcn.0057ae20
call fcn.0050d222
add dword [esp], edx
call fcn.0056ab00
call fcn.0057b490
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0xc]
call fcn.0056ab00
call fcn.0050d250
mov edx, eax
pop ecx
push ecx
call fcn.0050d250
mov ecx, eax
call fcn.0050d1d0
je 0x444729
mov dword [section..data], 0x1700086
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
lea ebp, [esp + 0x30]
lea eax, [ebp + 0x220]
push eax
call fcn.0057ae20
lea eax, [esp + 0x10]
push eax
call fcn.0057b350
mov dword [section..data], 0x1700087
jmp 0x444e8a
mov dword [section..data], 0x1700088
mov dword [section..data], 0x170008a
lea eax, [esp + 0x28]
push eax
push dword [esp + 0xc]
call sub.KERNEL32.dll_Module32NextW
and eax, eax
je 0x444828
mov dword [section..data], 0x170008b
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
lea ebp, [esp + 0x38]
lea eax, [ebp + 0x20]
push eax
call fcn.0057ae20
call fcn.0050d222
add dword [esp], edx
call fcn.0056ab00
call fcn.0057b490
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0xc]
call fcn.0056ab00
call fcn.0050d250
mov edx, eax
pop ecx
push ecx
call fcn.0050d250
mov ecx, eax
call fcn.0050d1d0
je 0x44480f
mov dword [section..data], 0x170008c
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
lea ebp, [esp + 0x30]
lea eax, [ebp + 0x220]
push eax
call fcn.0057ae20
lea eax, [esp + 0x10]
push eax
call fcn.0057b350
mov dword [section..data], 0x170008d
jmp 0x444e8a
mov dword [section..data], 0x170008e
mov dword [section..data], 0x170008f
jmp 0x444733
mov dword [section..data], 0x1700092
jmp 0x444e76
mov dword [section..data], 0x1700092
mov dword [section..data], 0x1700093
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x1700094
mov dword [esp + 8], 0
mov dword [section..data], 0x1700096
push edx
call fcn.0057b460
pop edx
push eax
push 3
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.CreateToolhelp32Snapshot__failed____
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.0056a320
pop eax
mov edx, 0x69ad3c
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x34]
call fcn.00442f5c
pop eax
mov edx, str.___now_continue_with_OpenProcess_
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x1700098
push dword [esp + 0x460]
push 0
push 0x400
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + 0x18], eax
mov dword [section..data], 0x1700099
cmp dword [esp + 0x18], 0
je 0x44492c
xor eax, eax
jmp 0x444931
mov eax, 1
and eax, eax
je 0x4449fd
mov dword [section..data], 0x170009a
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x170009b
push edx
call fcn.0057b460
pop edx
push eax
push 0
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.OpenProcess_failed__
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.0056a320
pop eax
mov edx, 0x69ad3c
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x34]
call fcn.00442f5c
pop eax
mov edx, 0x67ce72
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x170009c
mov dword [esp + 0x450], 0xfffff7c9
mov dword [section..data], 0x170009d
jmp 0x444e8a
mov dword [section..data], 0x170009e
mov dword [section..data], 0x17000a0
mov eax, str.kernel32.dll
push eax
push 0xffffffff
call fcn.0056923a
mov dword [esp + 0x1c], eax
mov dword [section..data], 0x17000a1
cmp dword [esp + 0x1c], 0
je 0x444a3a
xor eax, eax
jmp 0x444a3f
mov eax, 1
and eax, eax
je 0x444b0b
mov dword [section..data], 0x17000a2
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x17000a3
push edx
call fcn.0057b460
pop edx
push eax
push 0
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.OpenLibrary_failed__
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.0056a320
pop eax
mov edx, 0x69ad3c
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x34]
call fcn.00442f5c
pop eax
mov edx, 0x67ce72
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x17000a4
mov dword [esp + 0x450], 0xfffff7c8
mov dword [section..data], 0x17000a5
jmp 0x444e8a
mov dword [section..data], 0x17000a6
mov dword [section..data], 0x17000a8
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x1c]
call fcn.0056a2d0
lea eax, [esp + 0x14]
push eax
call fcn.0057b350
mov dword [section..data], 0x17000a9
mov dword [section..data], 0x17000aa
mov eax, str.QueryFullProcessImageNameW
push eax
push dword [esp + 0x20]
call fcn.005691e0
mov dword [esp + 0x20], eax
mov dword [section..data], 0x17000ab
jmp 0x444b9c
mov dword [section..data], 0x17000ad
mov dword [section..data], 0x17000af
cmp dword [esp + 0x20], 0
je 0x444bbb
xor eax, eax
jmp 0x444bc0
mov eax, 1
and eax, eax
je 0x444c8c
mov dword [section..data], 0x17000b0
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x17000b1
push edx
call fcn.0057b460
pop edx
push eax
push 0
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.GetFunction_failed__
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.0056a320
pop eax
mov edx, 0x69ad3c
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x34]
call fcn.00442f5c
pop eax
mov edx, 0x67ce72
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x17000b2
mov dword [esp + 0x450], 0xfffff7c7
mov dword [section..data], 0x17000b3
jmp 0x444e8a
mov dword [section..data], 0x17000b4
mov dword [section..data], 0x17000b6
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
push 0
push dword [esp + 0x24]
call dword [esp + 0x30]
mov dword [esp + 4], eax
mov dword [section..data], 0x17000b8
cmp dword [esp + 4], 0
je 0x444cd0
xor eax, eax
jmp 0x444cd5
mov eax, 1
and eax, eax
je 0x444da1
mov dword [section..data], 0x17000b9
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x17000ba
push edx
call fcn.0057b460
pop edx
push eax
push 0
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.QueryFullProcessImageName_failed__
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.0056a320
pop eax
mov edx, 0x69ad3c
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x34]
call fcn.00442f5c
pop eax
mov edx, 0x67ce72
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x17000bb
mov dword [esp + 0x450], 0xfffff7c6
mov dword [section..data], 0x17000bc
jmp 0x444e8a
mov dword [section..data], 0x17000bd
mov dword [section..data], 0x17000bf
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x20]
call fcn.0056dd91
call fcn.0050d222
add dword [esp], edx
call fcn.0056ab00
call fcn.0057b490
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0xc]
call fcn.0056ab00
call fcn.0050d250
mov edx, eax
pop ecx
push ecx
call fcn.0050d250
mov ecx, eax
call fcn.0050d1d0
je 0x444e46
mov dword [section..data], 0x17000c0
mov edx, dword [esp + 0x10]
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b230
lea eax, [esp + 0x10]
push eax
call fcn.0057b350
mov dword [section..data], 0x17000c1
mov dword [section..data], 0x17000c3
push dword [esp + 0x1c]
call fcn.0056911f
mov dword [section..data], 0x17000c5
push dword [esp + 0x18]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x17000c7
mov dword [section..data], 0x17000c9
mov dword [section..data], 0x17000cb
cmp dword [esp + 8], 0
je 0x444eae
mov dword [section..data], 0x17000cc
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x17000cd
mov dword [section..data], 0x17000cf
mov ebx, dword [esp + 0x450]
cmp ebx, 1
jne 0x444efa
mov dword [section..data], 0x17000d0
mov edx, dword [esp + 0xc]
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b230
mov ebp, dword [esp + 0x46c]
lea eax, [ebp]
push eax
call fcn.0057b350
mov dword [section..data], 0x17000d1
mov dword [section..data], 0x17000d3
mov eax, dword [esp + 0x450]
jmp 0x444f23
push dword [esp + 0xc]
call fcn.0057b3c0
push dword [esp + 0x10]
call fcn.0057b3c0
push dword [esp]
call fcn.0057b3c0
add esp, 0x454
pop ebx
pop ebp
ret 0xc