Function at 0x401740
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414de7
mov eax, dword fs:[0]
push eax
sub esp, 0x778
mov eax, dword [0x41e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x22c
lea eax, [ebp - 0x768]
push 0
push eax
call fcn.00405310
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00405310
add esp, 0x18
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.BeautifyExtension.dll
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
cmp dword [ebp + 8], 1
jle 0x401910
mov eax, dword [ebp + 0xc]
mov ecx, str._tabx
mov eax, dword [eax + 4]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401800
test dl, dl
je 0x4017fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401800
add eax, 2
add ecx, 2
test dl, dl
jne 0x4017e0
xor eax, eax
jmp 0x401805
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401910
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x41f624]
cmp eax, dword [ecx + 4]
jle 0x40184f
push 0x41f624
call fcn.004039ba
add esp, 4
cmp dword [0x41f624], 0xffffffff
jne 0x40184f
push 0x41f624
mov dword [0x41f610], 0
call fcn.00403970
add esp, 4
mov byte [ebp - 0x769], 0
lea eax, [ebp - 0x778]
mov dword [ebp - 4], 0
push eax
call fcn.0040249d
mov dword [ebp - 4], 1
lea eax, [ebp - 0x778]
mov dword [ebp - 0x784], eax
lea eax, [ebp - 0x769]
mov dword [ebp - 0x780], eax
lea eax, [ebp - 0x784]
push eax
push 0x402080
push 0x41f610
call fcn.00402b82
add esp, 0x10
test eax, eax
je 0x4018ec
lea eax, [ebp - 0x778]
mov dword [ebp - 4], 2
push eax
call fcn.004024ac
add esp, 4
push 0
push 0x41f5b4
call dword [sym.imp.USER32.dll_FindWindowW]
lea ecx, [ebp - 0x770]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 0x770]
lea edx, [ebp - 0x114]
call fcn.00401630
jmp 0x401b44
lea eax, [ebp - 0x778]
mov byte [ebp - 4], 3
push eax
call fcn.004024cd
add esp, 4
mov byte [ebp - 4], 1
test al, al
je 0x401b82
jmp 0x401b6c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x770], ebx
cmp ebx, 0xffffffff
je 0x401b44
lea eax, [ebp - 0x768]
mov dword [ebp - 0x768], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401b41
call fcn.00401330
test eax, eax
je 0x401b62
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x780], eax
lea eax, [ebp - 0x744]
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x780]
test eax, 0xffff0000
jne 0x401993
movzx eax, ax
push eax
call fcn.00401bb0
jmp 0x401999
push eax
call fcn.00401d60
mov dword [ebp - 4], 6
mov edi, dword [ebp - 0x780]
push str.explorer.exe
push edi
call fcn.004072d1
add esp, 8
test eax, eax
jne 0x401b0c
push 0x428
push eax
lea eax, [ebp - 0x53c]
xor bl, bl
push eax
call fcn.00405310
add esp, 0xc
push dword [ebp - 0x760]
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x77c], eax
cmp eax, 0xffffffff
je 0x401ae2
lea ecx, [ebp - 0x53c]
mov dword [ebp - 0x53c], 0x428
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x401ad6
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
call fcn.00401330
test eax, eax
je 0x401b62
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x774], eax
mov byte [ebp - 4], 7
test esi, esi
je 0x401a5d
test esi, 0xffff0000
jne 0x401a5d
movzx eax, si
lea ecx, [ebp - 0x774]
push eax
call fcn.00401bb0
jmp 0x401a69
push esi
lea ecx, [ebp - 0x774]
call fcn.00401d60
mov esi, dword [ebp - 0x774]
push 0x41b9e8
push esi
call fcn.004072d1
add esp, 8
test eax, eax
je 0x401a93
push str.BeautifyExtension64.dll
push esi
call fcn.004072d1
add esp, 8
test eax, eax
jne 0x401a95
mov bl, 1
mov byte [ebp - 4], 6
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x401ab1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x401ad0
lea eax, [ebp - 0x53c]
push eax
push dword [ebp - 0x77c]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x401a10
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x77c]
call esi
test bl, bl
jne 0x401b06
push dword [ebp - 0x760]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp - 0x760]
lea edx, [ebp - 0x114]
call fcn.00401630
mov ebx, dword [ebp - 0x770]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x401b2b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x768]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401951
push ebx
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403810
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004011a0
sub esp, 8
lea eax, [ebp - 0x778]
mov ecx, esp
push eax
call fcn.004010d0
call fcn.00401130
call fcn.00402c31
int3