Function at 0x10013dc0
Capabilities:
Enumerate process modules
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ea51
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x1005801c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ebx, [esi + 0x58]
push ebx
mov dword [ebp - 0x43c], ebx
call fcn.1001d562
add esp, 4
test eax, eax
jne 0x1001455d
cmp byte [esi + 0x88], al
je 0x10013e20
push ebx
call fcn.1001d573
add esp, 4
jmp 0x1001453f
push str.mono.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.kernel32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x10013ec7
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x440], eax
cmp eax, 0xffffffff
je 0x10013eb1
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x438], 0x428
push ecx
push eax
call dword [sym.imp.kernel32.dll_Module32FirstW]
test eax, eax
je 0x10013ea1
push str.mono_thread_attach
push dword [ebp - 0x41c]
call ebx
test eax, eax
jne 0x10013e9b
lea eax, [ebp - 0x438]
push eax
push dword [ebp - 0x440]
call dword [sym.imp.kernel32.dll_Module32NextW]
test eax, eax
jne 0x10013e71
jmp 0x10013ea1
mov edi, dword [ebp - 0x41c]
push dword [ebp - 0x440]
call dword [sym.imp.kernel32.dll_CloseHandle]
test edi, edi
jne 0x10013ec7
mov eax, dword [ebp - 0x43c]
push eax
call fcn.1001d573
add esp, 4
xor al, al
jmp 0x10014541
push str.mono_assembly_foreach
push edi
call ebx
mov dword [esi + 4], eax
test eax, eax
jne 0x10013f1b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x2f
push str.Failed_to_get_address_of_mono_assembly_foreach.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 0
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_assembly_get_image
push edi
call ebx
mov dword [esi + 8], eax
test eax, eax
jne 0x10013f6f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x31
push str.Failed_to_get_address_of_mono_assembly_get_image.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 1
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_image_get_table_info
push edi
call ebx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x10013fc3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x33
push str.Failed_to_get_address_of_mono_image_get_table_info.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 2
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_table_info_get_rows
push edi
call ebx
mov dword [esi + 0x10], eax
test eax, eax
jne 0x10014017
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x32
push str.Failed_to_get_address_of_mono_table_info_get_rows.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 3
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_class_get
push edi
call ebx
mov dword [esi + 0x14], eax
test eax, eax
jne 0x1001406b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x28
push str.Failed_to_get_address_of_mono_class_get.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 4
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_class_get_methods
push edi
call ebx
mov dword [esi + 0x18], eax
test eax, eax
jne 0x100140bf
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x30
push str.Failed_to_get_address_of_mono_class_get_methods.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 5
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_compile_method
push edi
call ebx
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x10014113
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x2d
push str.Failed_to_get_address_of_mono_compile_method.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 6
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_class_from_name
push edi
call ebx
mov dword [esi + 0x20], eax
test eax, eax
jne 0x10014167
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x2e
push str.Failed_to_get_address_of_mono_class_from_name.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 7
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_class_get_method_from_name
push edi
call ebx
mov dword [esi + 0x24], eax
test eax, eax
jne 0x100141bb
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x39
push str.Failed_to_get_address_of_mono_class_get_method_from_name.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 8
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_method_get_name
push edi
call ebx
mov dword [esi + 0x28], eax
test eax, eax
jne 0x1001420f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x2e
push str.Failed_to_get_address_of_mono_method_get_name.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 9
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_image_get_name
push edi
call ebx
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x10014263
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x2d
push str.Failed_to_get_address_of_mono_image_get_name.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 0xa
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_image_loaded
push edi
call ebx
mov dword [esi + 0x30], eax
test eax, eax
jne 0x100142b7
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x2b
push str.Failed_to_get_address_of_mono_image_loaded.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 0xb
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_image_get_assembly
push edi
call ebx
mov dword [esi + 0x34], eax
test eax, eax
jne 0x1001430b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x31
push str.Failed_to_get_address_of_mono_image_get_assembly.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 0xc
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_class_get_name
push edi
call ebx
mov dword [esi + 0x38], eax
test eax, eax
jne 0x1001435f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x2d
push str.Failed_to_get_address_of_mono_class_get_name.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 0xd
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_thread_attach
push edi
call ebx
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x100143b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x2c
push str.Failed_to_get_address_of_mono_thread_attach.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 0xe
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_get_root_domain
push edi
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x10014407
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x2e
push str.Failed_to_get_address_of_mono_get_root_domain.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 0xf
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_method_get_flags
push edi
call ebx
mov dword [esi + 0x44], eax
test eax, eax
jne 0x1001445b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x2f
push str.Failed_to_get_address_of_mono_method_get_flags.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 0x10
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_thread_detach
push edi
call ebx
mov dword [esi + 0x48], eax
test eax, eax
jne 0x100144af
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x43c], esp
push 0x2c
push str.Failed_to_get_address_of_mono_thread_detach.
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.100029b0
mov dword [ebp - 4], 0x11
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push str.mono_class_get_flags
push edi
call ebx
sub esp, 0x18
mov dword [esi + 0x4c], eax
mov dword [ebp - 0x43c], esp
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
test eax, eax
jne 0x10014508
push 0x2e
push str.Failed_to_get_address_of_mono_class_get_flags.
call fcn.100029b0
mov dword [ebp - 4], 0x12
push 3
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
add esp, 0x20
xor al, al
jmp 0x10014541
push 0x12
push str._Mono__Intialized.
call fcn.100029b0
mov dword [ebp - 4], 0x13
push 0
push dword [esi + 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10001840
lea eax, [esi + 0x58]
mov byte [esi + 0x88], 1
push eax
call fcn.1001d573
add esp, 0x24
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001fb3b
mov esp, ebp
pop ebp
ret
push eax
call fcn.1001d20d
int3