Function at 0x48dc10
Capabilities:
Enumerate process modules
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x4e26d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x76c], eax
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 0x78c], ecx
mov ecx, dword [ebp + 0x10]
push 0x410
mov dword [ebp - 0x760], esi
mov dword [ebp - 0x790], ecx
mov dword [ebp - 0x764], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov eax, dword [esi + 4]
cmp eax, edi
je 0x48dc94
test eax, eax
je 0x48dc83
cmp eax, 0xffffffff
je 0x48dc83
call fcn.00448900
push dword [esi + 4]
call fcn.00454e60
add esp, 4
mov dword [esi + 4], ebx
test edi, edi
je 0x48dc94
cmp edi, 0xffffffff
je 0x48dc94
mov dword [esi + 4], edi
call fcn.00448900
mov eax, dword [esi + 4]
test eax, eax
je 0x48e6d6
cmp eax, 0xffffffff
je 0x48e6d6
push 0x2c
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0x2c
xorps xmm0, xmm0
push ecx
push eax
movdqu xmmword [ebp - 0x44], xmm0
movdqu xmmword [ebp - 0x34], xmm0
movq qword [ebp - 0x24], xmm0
call sub.PSAPI.DLL_GetProcessMemoryInfo
test eax, eax
je 0x48dce5
mov eax, dword [ebp - 0x3c]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x40]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x2c], eax
jmp 0x48dd41
call fcn.0043d250
cmp eax, 2
jg 0x48dd28
mov ebx, 1
mov dword [ebp - 0x764], ebx
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xc7
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_1desktopwindowscrash_reporterprocess_state_impl.cc
lea ecx, [ebp - 0x84c]
call fcn.0043c9b0
add eax, 0x10
push str.GetProcessMemoryInfo_failed
push eax
call fcn.00405c42
add esp, 8
test bl, 1
je 0x48dd41
and ebx, 0xfffffffe
lea ecx, [ebp - 0x84c]
mov dword [ebp - 0x764], ebx
call fcn.0043cc50
push dword [esi + 4]
lea eax, [ebp - 0x1c]
push eax
call fcn.0048d900
add esp, 8
mov ebx, 0xa
xor esi, esi
mov dword [ebp - 0x768], esi
lea ecx, [ecx]
push dword [ebp - 0x76c]
dec ebx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp esi, edi
je 0x48dda9
test esi, esi
je 0x48dd93
cmp esi, 0xffffffff
je 0x48dd93
call fcn.00448900
push esi
call fcn.00454e60
add esp, 4
xor esi, esi
mov dword [ebp - 0x768], esi
test edi, edi
je 0x48dda9
cmp edi, 0xffffffff
je 0x48dda9
mov esi, edi
mov dword [ebp - 0x768], esi
call fcn.00448900
test esi, esi
je 0x48ddb2
cmp esi, 0xffffffff
jne 0x48ddc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
jne 0x48ddc1
test ebx, ebx
jg 0x48dd60
mov dword [ebp - 0x75c], ebx
mov ebx, dword [ebp - 0x764]
mov dword [ebp - 0x77c], 0
mov dword [ebp - 0x778], 0
mov dword [ebp - 0x774], 0
test esi, esi
je 0x48df90
cmp esi, 0xffffffff
je 0x48df90
lea eax, [ebp - 0x758]
mov dword [ebp - 0x758], 0x428
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x48df45
mov edi, dword [ebp - 0x760]
cmp dword [edi + 8], 0
jne 0x48de79
cmp word [ebp - 0x538], 0
jne 0x48de35
xor ecx, ecx
jmp 0x48de4f
lea ecx, [ebp - 0x538]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48de40
sub ecx, edx
sar ecx, 1
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push ecx
cmovae eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x538]
push ecx
push dword [ebp - 0xc]
push eax
call fcn.00440860
add esp, 0x10
mov byte [ebp - 0x75c], 1
test eax, eax
je 0x48de80
mov byte [ebp - 0x75c], 0
push dword [ebp - 0x75c]
lea eax, [ebp - 0x538]
mov ecx, edi
push dword [ebp - 0x740]
push dword [ebp - 0x744]
push eax
lea eax, [ebp - 0x738]
push eax
call fcn.0048d450
xor eax, eax
mov dword [ebp - 0x318], 7
mov dword [ebp - 0x31c], 0
mov word [ebp - 0x32c], ax
cmp word [ebp - 0x538], ax
jne 0x48ded1
xor ecx, ecx
jmp 0x48deef
lea ecx, [ebp - 0x538]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48dee0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x32c]
call fcn.0040576a
lea eax, [ebp - 0x32c]
push eax
lea ecx, [ebp - 0x77c]
call fcn.0041e672
cmp dword [ebp - 0x318], 8
jb 0x48df2b
push dword [ebp - 0x32c]
call fcn.00492cb0
add esp, 4
lea eax, [ebp - 0x758]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x48de21
jmp 0x48dffd
call fcn.0043d250
cmp eax, 2
jg 0x48df86
or ebx, 2
mov dword [ebp - 0x764], ebx
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xe6
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_1desktopwindowscrash_reporterprocess_state_impl.cc
lea ecx, [ebp - 0x84c]
call fcn.0043c9b0
add eax, 0x10
push str.Module32First_failed
push eax
call fcn.00405c42
add esp, 8
test bl, 2
je 0x48dff7
and ebx, 0xfffffffd
jmp 0x48dfe6
call fcn.0043d250
cmp eax, 2
jg 0x48dfde
or ebx, 4
mov dword [ebp - 0x764], ebx
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xe9
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_1desktopwindowscrash_reporterprocess_state_impl.cc
lea ecx, [ebp - 0x84c]
call fcn.0043c9b0
push dword [ebp - 0x75c]
add eax, 0x10
push str.TH32CS_SNAPMODULE_failed__retries_left
push eax
call fcn.00405c42
add esp, 8
mov ecx, eax
call fcn.00413d31
test bl, 4
je 0x48dff7
and ebx, 0xfffffffb
lea ecx, [ebp - 0x84c]
mov dword [ebp - 0x764], ebx
call fcn.0043cc50
mov edi, dword [ebp - 0x760]
lea eax, [edi + 0xc]
cmp dword [eax + 4], eax
jne 0x48e10c
call fcn.0043d250
test eax, eax
jg 0x48e043
push 0
push 0xed
or ebx, 8
lea ecx, [ebp - 0x844]
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_1desktopwindowscrash_reporterprocess_state_impl.cc
mov dword [ebp - 0x764], ebx
call fcn.0043c8d0
add eax, 8
push str.Using_fallback_modules
push eax
call fcn.00405c42
add esp, 8
test bl, 8
je 0x48e05c
and ebx, 0xfffffff7
lea ecx, [ebp - 0x844]
mov dword [ebp - 0x764], ebx
call fcn.0043c9e0
mov edi, dword [ebp + 0x14]
mov eax, dword [edi + 4]
mov edi, dword [edi]
mov dword [ebp - 0x794], eax
cmp edi, eax
je 0x48e106
mov ebx, dword [ebp - 0x760]
lea esi, [edi + 0x18]
jmp 0x48e080
cmp dword [ebx + 8], 0
jne 0x48e0b8
cmp dword [esi + 0x14], 8
jb 0x48e090
mov ecx, dword [esi]
jmp 0x48e092
mov ecx, esi
push dword [esi + 0x10]
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push ecx
push dword [ebp - 0xc]
cmovae eax, dword [ebp - 0x1c]
push eax
call fcn.00440860
add esp, 0x10
mov byte [ebp - 0x75c], 1
test eax, eax
je 0x48e0bf
mov byte [ebp - 0x75c], 0
cmp dword [esi + 0x14], 8
jb 0x48e0c9
mov ecx, dword [esi]
jmp 0x48e0cb
mov ecx, esi
cmp dword [esi - 4], 8
jb 0x48e0d5
mov eax, dword [edi]
jmp 0x48e0d7
mov eax, edi
push dword [ebp - 0x75c]
push dword [esi + 0x1c]
push dword [esi + 0x18]
push ecx
push eax
mov ecx, ebx
call fcn.0048d450
add edi, 0x38
add esi, 0x38
cmp edi, dword [ebp - 0x794]
jne 0x48e080
mov esi, dword [ebp - 0x768]
mov ebx, dword [ebp - 0x764]
mov edi, dword [ebp - 0x760]
cmp dword [edi + 8], 0
jne 0x48e25d
cmp dword [ebp - 0xc], 0
je 0x48e25d
call fcn.0043d250
cmp eax, 1
jg 0x48e16f
push 1
push 0xf9
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_1desktopwindowscrash_reporterprocess_state_impl.cc
lea ecx, [ebp - 0x844]
or ebx, 0x10
call fcn.0043c8d0
add eax, 8
push str.Couldnt_find_main_module_for_
push eax
call fcn.00405c42
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x1c]
push ecx
push eax
call fcn.0043ce20
push 0x27
push eax
call fcn.0043c5f0
add esp, 0x18
test bl, 0x10
je 0x48e182
lea ecx, [ebp - 0x844]
and ebx, 0xffffffef
call fcn.0043c9e0
mov eax, dword [ebp - 0x77c]
mov edi, eax
cmp eax, dword [ebp - 0x778]
je 0x48e257
mov esi, dword [ebp - 0x778]
lea esp, [esp]
xor eax, eax
mov dword [ebp - 0x318], 7
push 0xffffffffffffffff
push eax
push edi
lea ecx, [ebp - 0x32c]
mov dword [ebp - 0x31c], 0
mov word [ebp - 0x32c], ax
call fcn.004058f5
call fcn.0043d250
cmp eax, 1
jg 0x48e21c
push 1
push 0xfc
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_1desktopwindowscrash_reporterprocess_state_impl.cc
lea ecx, [ebp - 0x844]
or ebx, 0x20
call fcn.0043c8d0
add eax, 8
push str.Module_path:
push eax
call fcn.00405c42
cmp dword [ebp - 0x318], 8
lea ecx, [ebp - 0x32c]
cmovae ecx, dword [ebp - 0x32c]
push ecx
push eax
call fcn.0043ce20
add esp, 0x10
test bl, 0x20
je 0x48e22f
lea ecx, [ebp - 0x844]
and ebx, 0xffffffdf
call fcn.0043c9e0
cmp dword [ebp - 0x318], 8
jb 0x48e246
push dword [ebp - 0x32c]
call fcn.00492cb0
add esp, 4
add edi, 0x18
cmp edi, esi
jne 0x48e1a0
mov esi, dword [ebp - 0x768]
mov edi, dword [ebp - 0x760]
lea eax, [ebp - 0x75c]
mov dword [ebp - 0x780], 0
push eax
push 4
lea eax, [ebp - 0x780]
mov dword [ebp - 0x75c], 0
push eax
push dword [ebp - 0x78c]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x48e64b
cmp dword [ebp - 0x75c], 4
jne 0x48e64b
lea eax, [ebp - 0x75c]
mov dword [ebp - 0x788], 0
push eax
push 8
lea eax, [ebp - 0x788]
mov dword [ebp - 0x784], 0
push eax
push dword [ebp - 0x780]
mov dword [ebp - 0x75c], 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x48e64b
cmp dword [ebp - 0x75c], 8
jne 0x48e64b
lea eax, [ebp - 0x75c]
mov dword [ebp - 0x75c], 0
push eax
push 4
lea eax, [edi + 0x1c]
push eax
push dword [ebp - 0x788]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x48e64b
cmp dword [ebp - 0x75c], 4
jne 0x48e64b
mov ecx, dword [ebp - 0x788]
lea eax, [ebp - 0x75c]
push eax
push 4
lea eax, [edi + 0x20]
mov dword [ebp - 0x75c], 0
push eax
add ecx, 0xc
push ecx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x48e64b
cmp dword [ebp - 0x75c], 4
jne 0x48e64b
lea eax, [ebp - 0x75c]
mov dword [ebp - 0x75c], 0
push eax
push 0x2cc
lea eax, [ebp - 0x314]
push eax
push dword [ebp - 0x784]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x48e64b
cmp dword [ebp - 0x75c], 0x2cc
jne 0x48e64b
lea eax, [ebp - 0x770]
mov ecx, edi
push eax
push dword [ebp - 0x790]
call fcn.0048d140
test al, al
jne 0x48e41f
call fcn.0043d250
cmp eax, 1
jg 0x48e402
push 1
push 0x117
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_1desktopwindowscrash_reporterprocess_state_impl.cc
lea ecx, [ebp - 0x844]
or ebx, 0x40
call fcn.0043c8d0
add eax, 8
push str.Could_not_read_ID_of_crashed_thread
push eax
call fcn.00405c42
add esp, 8
test bl, 0x40
je 0x48e415
lea ecx, [ebp - 0x844]
and ebx, 0xffffffbf
call fcn.0043c9e0
mov dword [ebp - 0x770], 0
push 0xb4
call fcn.00492cd0
add esp, 4
test eax, eax
je 0x48e64b
push 1
push dword [ebp - 0x770]
mov ecx, eax
call fcn.0048f550
mov dword [ebp - 0x75c], eax
test eax, eax
je 0x48e64b
lea ecx, [ebp - 0x314]
push ecx
push dword [edi + 4]
mov ecx, eax
call fcn.0048fb80
mov ecx, dword [ebp - 0x75c]
test al, al
je 0x48e645
add ecx, 4
lea edx, [edi + 0x14]
mov edi, dword [ebp - 0x76c]
push edi
push 4
mov dword [ecx + 4], edx
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx]
mov dword [eax + 4], ecx
mov dword [edx], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push eax
lea ecx, [ebp - 0x768]
call fcn.0048e8f0
mov esi, dword [ebp - 0x768]
test esi, esi
je 0x48e5f0
cmp esi, 0xffffffff
je 0x48e5f0
lea eax, [ebp - 0x330]
mov dword [ebp - 0x330], 0x1c
push eax
push esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x48e57b
cmp dword [ebp - 0x330], 0x10
jb 0x48e57b
cmp dword [ebp - 0x324], edi
jne 0x48e555
mov eax, dword [ebp - 0x328]
cmp eax, dword [ebp - 0x770]
je 0x48e555
push 0xb4
call fcn.00492cd0
add esp, 4
test eax, eax
je 0x48e555
push 0
push dword [ebp - 0x328]
mov ecx, eax
call fcn.0048f550
mov edi, eax
test edi, edi
je 0x48e54f
mov ebx, dword [ebp - 0x760]
mov ecx, edi
push dword [ebx + 4]
call fcn.0048fad0
test al, al
je 0x48e547
lea ecx, [edi + 4]
lea edi, [ebx + 0x14]
mov dword [ecx + 4], edi
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi]
mov dword [eax + 4], ecx
mov dword [edi], ecx
jmp 0x48e54f
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov edi, dword [ebp - 0x76c]
lea eax, [ebp - 0x330]
mov dword [ebp - 0x330], 0x1c
push eax
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x48e4e1
mov bl, 1
jmp 0x48e64d
call fcn.0043d250
cmp eax, 2
jg 0x48e5dd
or ebx, 0x80
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x13c
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_1desktopwindowscrash_reporterprocess_state_impl.cc
lea ecx, [ebp - 0x84c]
call fcn.0043c9b0
push 0x10
push str.__min_size
push dword [ebp - 0x330]
add eax, 0x10
push str.Thread32First_failed__te.dwSize
push eax
call fcn.00405c42
add esp, 8
mov ecx, eax
call fcn.00413dc9
push eax
call fcn.00405c42
add esp, 8
mov ecx, eax
call fcn.00413dc9
test bl, bl
jns 0x48e641
lea ecx, [ebp - 0x84c]
call fcn.0043cc50
mov bl, 1
jmp 0x48e64d
call fcn.0043d250
cmp eax, 2
jg 0x48e62e
or ebx, 0x100
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x140
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_1desktopwindowscrash_reporterprocess_state_impl.cc
lea ecx, [ebp - 0x84c]
call fcn.0043c9b0
add eax, 0x10
push str.TH32CS_SNAPTHREAD_failed
push eax
call fcn.00405c42
add esp, 8
test ebx, 0x100
je 0x48e641
lea ecx, [ebp - 0x84c]
call fcn.0043cc50
mov bl, 1
jmp 0x48e64d
mov eax, dword [ecx]
push 1
call dword [eax]
xor bl, bl
mov ecx, dword [ebp - 0x77c]
test ecx, ecx
je 0x48e6a2
mov eax, dword [ebp - 0x778]
mov edi, ecx
cmp ecx, eax
je 0x48e699
cmp dword [edi + 0x14], 8
jb 0x48e679
push dword [edi]
call fcn.00492cb0
mov eax, dword [ebp - 0x778]
add esp, 4
xor ecx, ecx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], cx
add edi, 0x18
cmp edi, eax
jne 0x48e663
mov ecx, dword [ebp - 0x77c]
push ecx
call fcn.00492cb0
add esp, 4
test esi, esi
je 0x48e6b9
cmp esi, 0xffffffff
je 0x48e6b9
call fcn.00448900
push esi
call fcn.00454e60
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.0043ff00
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049653f
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049653f
mov esp, ebp
pop ebp
ret 0x10