Function at 0x403d00
Capabilities:
Enumerate process modules

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x427248
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
push str.QueryFullProcessImageNameW
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp byte [esp + 0x5c], 0
mov dword [0x49ada8], eax
je 0x403e69
mov ecx, dword [0x49c058]
mov eax, dword [0x49c054]
mov ebx, ecx
cmp eax, ecx
jbe 0x403d64
call fcn.00417536
mov ecx, dword [0x49c058]
mov eax, dword [0x49c054]
mov esi, dword [0x49c048]
mov edi, eax
cmp eax, ecx
jbe 0x403d75
call fcn.00417536
mov eax, dword [0x49c048]
push ebx
push esi
push edi
push eax
lea ebx, [esp + 0x34]
mov esi, 0x49c048
call fcn.00408db0
mov eax, dword [0x49c070]
mov ecx, dword [0x49c06c]
mov ebx, eax
cmp ecx, eax
jbe 0x403dad
call fcn.00417536
mov eax, dword [0x49c070]
mov ecx, dword [0x49c06c]
mov esi, dword [0x49c060]
mov edi, ecx
cmp ecx, eax
jbe 0x403dbe
call fcn.00417536
mov ecx, dword [0x49c060]
push ebx
push esi
push edi
push ecx
lea ebx, [esp + 0x34]
mov esi, 0x49c060
call fcn.00408db0
mov eax, dword [0x49c088]
mov ecx, dword [0x49c084]
mov ebx, eax
cmp ecx, eax
jbe 0x403df7
call fcn.00417536
mov eax, dword [0x49c088]
mov ecx, dword [0x49c084]
mov esi, dword [0x49c078]
mov edi, ecx
cmp ecx, eax
jbe 0x403e08
call fcn.00417536
mov edx, dword [0x49c078]
push ebx
push esi
push edi
push edx
lea ebx, [esp + 0x34]
mov esi, 0x49c078
call fcn.00408db0
mov eax, dword [0x49c040]
mov ecx, dword [0x49c03c]
mov ebx, eax
cmp ecx, eax
jbe 0x403e41
call fcn.00417536
mov eax, dword [0x49c040]
mov ecx, dword [0x49c03c]
mov esi, dword [0x49c030]
mov edi, ecx
cmp ecx, eax
jbe 0x403e52
call fcn.00417536
mov eax, dword [0x49c030]
push ebx
push esi
push edi
push eax
lea ebx, [esp + 0x34]
mov esi, 0x49c030
call fcn.00408db0
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], esi
mov word [esp + 0x30], cx
push 0x9c40
mov dword [esp + 0x58], esi
call fcn.00416c66
add esp, 4
mov edi, eax
push 0x4e20
mov dword [esp + 0x20], edi
call fcn.00416c66
add esp, 4
lea edx, [esp + 0x14]
push edx
push 0x9c40
push edi
mov ebp, eax
mov dword [esp + 0x20], esi
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x403ef4
push 0x15
mov eax, str.EnumProcesses_failed_n
mov esi, 0x496df4
call fcn.00413f30
push edi
call fcn.00416fed
add esp, 4
push ebp
call fcn.00416fed
add esp, 4
cmp dword [esp + 0x44], 8
jb 0x404111
mov eax, dword [esp + 0x30]
push eax
jmp 0x404109
mov ecx, dword [esp + 0x14]
shr ecx, 2
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
cmp ecx, esi
jbe 0x4040bc
lea ecx, [ecx]
mov esi, dword [edi + eax*4]
mov dword [esp + 0x10], esi
test esi, esi
je 0x4040a5
mov edi, dword [sym.imp.KERNEL32.DLL_OpenProcess]
push esi
push 0
push 0x1fffff
call edi
mov ebx, eax
test ebx, ebx
jne 0x403f48
push esi
push eax
push 0x410
call edi
mov ebx, eax
test ebx, ebx
je 0x404039
mov edx, ebx
call fcn.00403660
mov dword [esp + 0x20], eax
test eax, eax
je 0x403fe5
xor esi, esi
test eax, eax
jbe 0x404036
jmp 0x403f70
mov ecx, dword [0x49c02c]
mov edx, dword [ecx + esi*4]
push 0x2710
push ebp
push edx
push ebx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x403fd8
mov eax, ebp
call fcn.00403620
mov edi, eax
test esi, esi
jne 0x403fbe
call fcn.004158b0
test al, al
jne 0x403fd8
mov eax, dword [esp + 0x10]
push eax
push ebp
call fcn.004031a0
mov ecx, dword [esp + 0x64]
push ecx
mov ecx, ebp
mov edx, edi
call fcn.004039d0
add esp, 0xc
jmp 0x403fd8
call fcn.00415880
test al, al
jne 0x403fd8
mov edx, dword [esp + 0x5c]
push edx
mov ecx, ebp
mov edx, edi
call fcn.004036a0
add esp, 4
inc esi
cmp esi, dword [esp + 0x20]
jb 0x403f70
push ebx
jmp 0x40409f
mov eax, dword [0x49ada8]
test eax, eax
je 0x404036
lea ecx, [esp + 0x20]
push ecx
push ebp
push 0
push ebx
mov dword [esp + 0x30], 0x2710
call eax
test eax, eax
je 0x404036
mov eax, ebp
call fcn.00403620
mov edi, eax
call fcn.004158b0
test al, al
jne 0x404036
mov edx, dword [esp + 0x5c]
push edx
mov ecx, ebp
mov edx, edi
call fcn.004039d0
mov eax, dword [esp + 0x14]
add esp, 4
push eax
push ebp
call fcn.004031a0
add esp, 8
push ebx
jmp 0x40409f
cmp dword [0x49ada8], 0
je 0x4040a5
push esi
push 0
push 0x1000
call edi
mov esi, eax
test esi, esi
je 0x4040a5
lea ecx, [esp + 0x20]
push ecx
push ebp
push 0
push esi
mov dword [esp + 0x30], 0x2710
call dword [0x49ada8]
test eax, eax
je 0x40409e
mov eax, ebp
call fcn.00403620
mov edi, eax
call fcn.004158b0
test al, al
jne 0x40409e
mov edx, dword [esp + 0x5c]
push edx
mov ecx, ebp
mov edx, edi
call fcn.004039d0
mov eax, dword [esp + 0x14]
add esp, 4
push eax
push ebp
call fcn.004031a0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x24]
jb 0x403f10
cmp byte [esp + 0x5c], 0
je 0x4040eb
mov esi, 0x49c048
call fcn.00401220
mov esi, 0x49c060
call fcn.00401220
mov esi, 0x49c078
call fcn.00401220
mov esi, 0x49c030
call fcn.00401220
push edi
call fcn.00416fed
add esp, 4
push ebp
call fcn.00416fed
add esp, 4
cmp dword [esp + 0x44], 8
jb 0x404111
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00416c71
add esp, 4
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x48
ret