Function at 0x457a10
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ee8f4
mov eax, dword fs:[0]
push eax
mov eax, 0x8018
call fcn.0041ead0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8014], ecx
mov ebx, dword [ebp + 8]
call fcn.0043e530
test al, al
je 0x458148
mov esi, dword [ecx + 0x14e4]
mov ecx, esi
push dword [ebx + 4]
call fcn.005c5730
mov edi, eax
mov eax, dword [ebp - 0x8014]
push 0x10
push ecx
mov dword [ebp - 0x8010], edi
push dword [eax + 4]
push ecx
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bea10
push 0
push 0x14
push 0x111b
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x6b88]
push eax
push 0x1f40
lea eax, [ebp - 0x2534]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x458148
shr dword [ebp - 0x6b88], 2
lea eax, [ebp - 0x6b84]
push fcn.005dc430
push fcn.005dc5e0
push 0x5dc
push 0xc
push eax
call fcn.0041e804
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x6ba0]
xorps xmm0, xmm0
mov dword [ebp - 0x8020], 0
mov dword [ebp - 0x8018], 0
movq qword [ebp - 0x6ba0], xmm0
mov dword [ebp - 0x6b98], 0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x6bb0], 0
lea ecx, [ebp - 0x6bb8]
movq qword [ebp - 0x6bb8], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x6b8c], 0
lea ecx, [ebp - 0x6b94]
movq qword [ebp - 0x6b94], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x6bbc], 0
lea ecx, [ebp - 0x6bc4]
movq qword [ebp - 0x6bc4], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x6ba4], 0
lea ecx, [ebp - 0x6bac]
movq qword [ebp - 0x6bac], xmm0
call fcn.005dc5e0
push 0xfc8
lea eax, [ebp - 0x7fb4]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x7fb4]
call fcn.005e9a70
mov eax, dword [ebp - 0x8014]
lea ecx, [ebp - 0x6bac]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov byte [ebp - 4], 6
push 0x624284
push dword [eax + 0x20]
mov dword [ebp - 0x8000], 0xffff0002
call fcn.005dc200
or esi, 0xffffffff
mov dword [ebp - 0x6fec], 0x428
mov dword [ebp - 0x7fb8], esi
push 0
push 0
push 0x1108
push edi
mov byte [ebp - 4], 7
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov dword [ebp - 0x801c], eax
mov dword [ebp - 0x8008], ecx
cmp dword [ebp - 0x6b88], ecx
jbe 0x458091
mov dword [ebp - 0x800c], ecx
xor eax, eax
nop dword [eax + eax]
cmp dword [ebp + ecx*4 - 0x2534], 5
jb 0x45806f
test byte [ebx + 8], 8
jne 0x457c72
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, dword [ebp - 0x8008]
mov ecx, edx
sub ecx, eax
jne 0x457c94
mov eax, dword [ebp - 0x800c]
xor edx, edx
mov ecx, dword [ebp - 0x8014]
div dword [ebp - 0x6b88]
push 0
push eax
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
mov edx, dword [ebp - 0x8008]
cmp byte [ebx + 0x10], 0
jne 0x45808b
push dword [ebp + edx*4 - 0x2534]
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp esi, 0xffffffff
je 0x457cbf
test esi, esi
je 0x457cbf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
mov dword [ebp - 0x7fb8], esi
test edi, edi
jne 0x457cd9
or esi, 0xffffffff
mov dword [ebp - 0x7fb8], esi
jmp 0x458063
cmp edi, 0xffffffff
je 0x458063
lea eax, [ebp - 0x6fec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x458063
lea eax, [ebp - 0x6dcc]
push eax
lea ecx, [ebp - 0x6b94]
call fcn.005dc510
lea ecx, [ebp - 0x6b94]
call fcn.005dc3a0
cmp eax, 4
jl 0x458063
push 4
push 1
push 1
push 1
push 0x628910
lea ecx, [ebp - 0x6b94]
call fcn.005daa70
lea ecx, [ebp - 0x6b94]
test eax, eax
je 0x457d49
push 4
call fcn.005dad50
jmp 0x457d76
push 0
call fcn.005dc440
cmp word [eax], 0x5c
jne 0x457d76
push 0
push 1
lea ecx, [ebp - 0x6bac]
call fcn.005dc190
push eax
push str.Systemroot_
lea ecx, [ebp - 0x6b94]
call fcn.005da270
lea ecx, [ebp - 0x6b94]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x7fb4]
call fcn.005e9660
mov edi, dword [ebp - 0x8008]
lea ecx, [ebp - 0x6bb8]
push dword [ebp + edi*4 - 0x2534]
call fcn.005db290
sub esp, 0xc
lea ecx, [ebp - 0x7fb4]
push 0
push 0
push 0
push 0
push 0
push 0x6558f0
push str.No_Publisher
push 0x624804
call fcn.005e98f0
push eax
push 0x6558f0
lea ecx, [ebp - 0x6b94]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x6bb8]
call fcn.005da510
push 1
lea eax, [ebp - 0x7fbc]
mov dword [ebp - 0x7fe4], 0
push eax
push 0
push 0
lea ecx, [ebp - 0x6b94]
mov dword [ebp - 0x7ff0], 0x10
mov dword [ebp - 0x7ff4], 0x10
mov dword [ebp - 0x7ffc], 0x2b
call fcn.005dc190
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x457e5a
push dword [ebp - 0x7fbc]
push 0xffffffffffffffff
push dword [ebp - 0x801c]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [ebp - 0x7fbc]
mov dword [ebp - 0x7fe4], eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 0x7fe4]
xor ecx, ecx
cmp eax, 1
cmovl eax, ecx
lea ecx, [ebp - 0x6bb8]
mov dword [ebp - 0x7fe4], eax
mov dword [ebp - 0x7fe0], eax
call fcn.005dc190
mov dword [ebp - 0x7fec], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x8004], 0
cmp eax, dword [ebp + edi*4 - 0x2534]
jne 0x457ea9
or dword [ebp - 0x7ff4], 0x22
or dword [ebp - 0x7ff0], 0x22
lea eax, [ebp - 0x8004]
push eax
push 0
push 0x1132
push dword [ebp - 0x8010]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [ebp - 0x8024], edi
test edi, edi
je 0x458063
mov eax, dword [ebp - 0x8008]
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp + eax*4 - 0x2534]
jne 0x457f0d
push edi
push 9
push 0x110b
push dword [ebp - 0x8010]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push 0x1114
push dword [ebp - 0x8010]
call dword [sym.imp.USER32.dll_SendMessageW]
inc dword [ebp - 0x8018]
lea eax, [ebp - 0x6fec]
push eax
push esi
mov dword [ebp - 0x8004], edi
mov dword [ebp - 0x7ffc], 1
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
je 0x458049
mov edi, dword [ebp - 0x8010]
nop
lea eax, [ebp - 0x6dcc]
push eax
lea ecx, [ebp - 0x6ba0]
call fcn.005dc510
lea ecx, [ebp - 0x6ba0]
call fcn.005dc3a0
cmp eax, 4
jl 0x45802d
push 4
push 1
push 1
push 1
push 0x628910
lea ecx, [ebp - 0x6ba0]
call fcn.005daa70
lea ecx, [ebp - 0x6ba0]
test eax, eax
je 0x457f91
push 4
call fcn.005dad50
jmp 0x457fbe
push 0
call fcn.005dc440
cmp word [eax], 0x5c
jne 0x457fbe
push 0
push 1
lea ecx, [ebp - 0x6bac]
call fcn.005dc190
push eax
push str.Systemroot_
lea ecx, [ebp - 0x6ba0]
call fcn.005da270
lea ecx, [ebp - 0x6b94]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x6ba0]
call fcn.005dc4c0
test al, al
jne 0x45802d
push dword [ebx + 8]
lea eax, [ebp - 0x8020]
push eax
lea eax, [ebp - 0x5f4]
push eax
lea eax, [ebp - 0x6b84]
push eax
lea eax, [ebp - 0x6dcc]
push eax
call fcn.004578e0
cmp byte [ebx + 0x10], 0
jne 0x458043
test al, al
je 0x45802d
lea ecx, [ebp - 0x6ba0]
call fcn.005dc190
mov dword [ebp - 0x7fec], eax
lea eax, [ebp - 0x8004]
push eax
push 0
push 0x1132
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x6fec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x457f40
mov edi, dword [ebp - 0x8024]
cmp byte [ebx + 0x10], 0
jne 0x45808b
push edi
push 0
push 0x1113
push dword [ebp - 0x8010]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x800c]
mov ecx, dword [ebp - 0x8008]
inc ecx
add eax, 0x64
mov dword [ebp - 0x8008], ecx
mov dword [ebp - 0x800c], eax
cmp ecx, dword [ebp - 0x6b88]
jb 0x457c40
mov edi, dword [ebp - 0x8010]
push 0
push 0
push 0x1113
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x8014]
push str.List_creation_complete
push 0x64
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
cmp esi, 0xffffffff
je 0x4580c9
test esi, esi
je 0x4580c9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x6ff8]
call fcn.005dc430
lea ecx, [ebp - 0x7004]
call fcn.005dc430
lea ecx, [ebp - 0x7010]
call fcn.005dc430
lea ecx, [ebp - 0x6bac]
call fcn.005dc430
lea ecx, [ebp - 0x6bc4]
call fcn.005dc430
lea ecx, [ebp - 0x6b94]
call fcn.005dc430
lea ecx, [ebp - 0x6bb8]
call fcn.005dc430
lea ecx, [ebp - 0x6ba0]
call fcn.005dc430
push fcn.005dc430
push 0x5dc
push 0xc
lea eax, [ebp - 0x6b84]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.0041e45b
mov eax, dword [ebp - 0x8018]
jmp 0x45814a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4