Function at 0x410dc8
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa54
push ebx
push esi
push edi
lea ecx, [esp + 0x650]
call fcn.004045b8
mov esi, 0x104
lea eax, [esp + 0x548]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.0041c3f0
push esi
lea eax, [esp + 0x450]
push ebx
push eax
call fcn.0041c3f0
push str.Modules_____:
push 0x40000
push dword [0x4b4ec8]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov byte [esp + 0x33], 1
call fcn.00422b38
add esp, 0x24
call dword [sym.imp.dbghelp.dll_SymGetOptions]
or eax, 0x206
push eax
call dword [sym.imp.dbghelp.dll_SymSetOptions]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 0x46ceec
call ebx
push eax
call dword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
je 0x411140
cmp dword [0x4c0364], 0
jne 0x410e7e
push 4
push 0x3000
push 0x22000
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [0x4c0364], eax
and dword [0x4c0368], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x411140
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x428
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Module32FirstW]
jmp 0x411131
lea eax, [esp + 0x238]
push eax
lea ecx, [esp + 0x54c]
call fcn.00410ca1
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x448]
call fcn.00410ca1
pop ecx
pop ecx
lea eax, [esp + 0x238]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
push dword [esp + 0x30]
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
lea eax, [esp + 0x44c]
push eax
lea eax, [esp + 0x558]
push eax
push 0
call ebx
push eax
call dword [sym.imp.dbghelp.dll_SymLoadModule64]
or eax, edx
je 0x411139
mov esi, dword [0x4c0364]
test esi, esi
je 0x411139
mov edx, dword [0x4c0368]
cmp edx, 0x100
jae 0x411139
imul eax, edx, 0x220
add eax, esi
je 0x410f74
push 0xffffffffffffffff
lea ecx, [esp + 0x23c]
push ecx
push 0x100
push eax
call fcn.00428a3a
mov edx, dword [0x4c0368]
add esp, 0x10
mov esi, dword [0x4c0364]
test edx, edx
jne 0x410fc6
mov ecx, 0x4b4394
call fcn.00401b2b
test al, al
jne 0x410fc6
push 0x5c
push esi
call fcn.0041b939
pop ecx
pop ecx
test eax, eax
je 0x410fba
xor ecx, ecx
mov edx, 0x100
mov word [eax], cx
imul ecx, dword [0x4c0368], 0x220
push dword [0x4b4398]
add ecx, dword [0x4c0364]
call fcn.004081a7
pop ecx
mov esi, dword [0x4c0364]
mov edx, dword [0x4c0368]
imul eax, edx, 0x220
mov dword [eax + esi + 0x200], edx
and dword [eax + esi + 0x204], 0
imul esi, dword [0x4c0368], 0x220
mov ecx, dword [0x4c0364]
mov eax, dword [esp + 0x2c]
cdq
mov dword [esi + ecx + 0x208], eax
mov dword [esi + ecx + 0x20c], edx
imul esi, dword [0x4c0368], 0x220
mov eax, dword [esp + 0x30]
add eax, dword [esp + 0x2c]
mov ecx, dword [0x4c0364]
cdq
mov dword [esi + ecx + 0x210], eax
mov dword [esi + ecx + 0x214], edx
imul esi, dword [0x4c0368], 0x220
cmp byte [esp + 0xf], 0
mov edx, dword [0x4c0364]
mov eax, dword [esi + edx + 0x208]
mov ecx, dword [esi + edx + 0x20c]
mov dword [esi + edx + 0x218], eax
mov dword [esi + edx + 0x21c], ecx
jne 0x411072
push str.____________:
push 0x40000
push dword [0x4b4ec8]
call fcn.00422b38
add esp, 0xc
jmp 0x411077
mov byte [esp + 0xf], 0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00410ce6
test al, al
je 0x4110d7
mov ecx, dword [esp + 0x10]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [esp + 0x1c]
movzx eax, cx
push eax
imul eax, dword [0x4c0368], 0x220
shr ecx, 0x10
push ecx
add eax, dword [0x4c0364]
push eax
push dword [esp + 0x44]
lea eax, [esp + 0x668]
push dword [esp + 0x44]
push str.__.8X__.8X__s___u._u._u._u__r_n
push eax
call fcn.004011fb
add esp, 0x24
jmp 0x411105
imul eax, dword [0x4c0368], 0x220
add eax, dword [0x4c0364]
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x658]
push dword [esp + 0x34]
push str.__.8X__.8X__s_r_n
push eax
call fcn.004011fb
add esp, 0x14
push dword [esp + 0x654]
push 0x40000
push dword [0x4b4ec8]
call fcn.00422b38
add esp, 0xc
lea eax, [esp + 0x18]
inc dword [0x4c0368]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Module32NextW]
test eax, eax
jne 0x410eb8
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret