Function at 0x40f3c8
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431f56
mov eax, dword fs:[0]
push eax
mov eax, 0x1454
call fcn.0042d800
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x430], ebx
cmp esi, ebx
je 0x40f67a
cmp word [esi], bx
je 0x40f67a
cmp dword [ebp + 8], ebx
je 0x40f67a
cmp eax, ebx
je 0x40f67a
xor eax, eax
push 0x206
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x426]
push ebx
push eax
call fcn.00421bc0
add esp, 0xc
push 0x437bd8
push esi
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x440]
push eax
push reloc.KERNEL32.dll_WaitForMultipleObjects
lea eax, [ebp - 0x1460]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x40f67a
lea eax, [ebp - 0x45c]
push eax
call fcn.0040b9f1
xor eax, eax
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x440]
push 0x208
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x21e]
push ebx
push eax
shr edi, 2
call fcn.00421bc0
add esp, 0xc
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x42c], ebx
cmp edi, ebx
jbe 0x40f5a2
mov eax, dword [ebp - 0x42c]
push dword [ebp + eax*4 - 0x1460]
push ebx
push 0x100410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x43c], esi
cmp esi, ebx
je 0x40f590
lea eax, [ebp - 0x460]
push eax
push 4
lea eax, [ebp - 0x434]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40f589
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x434]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x40f589
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x438], eax
xor esi, esi
mov eax, dword [ebp - 0x444]
push dword [eax + esi*4]
push dword [ebp - 0x438]
call fcn.0041faf6
pop ecx
pop ecx
test eax, eax
je 0x40f574
inc esi
cmp esi, 2
jl 0x40f552
jmp 0x40f590
lea ebx, [ebp - 0x43c]
lea esi, [ebp - 0x45c]
call fcn.00417ee4
xor ebx, ebx
jmp 0x40f590
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x42c]
cmp dword [ebp - 0x42c], edi
jb 0x40f4ca
mov esi, dword [ebp - 0x44c]
sub esi, dword [ebp - 0x450]
sar esi, 2
cmp esi, ebx
jbe 0x40f65d
xor ecx, ecx
push 4
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041edea
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40f629
xor edi, edi
test esi, esi
jbe 0x40f605
mov eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0x450]
sar eax, 2
cmp edi, eax
jb 0x40f5f4
call fcn.004203c7
mov eax, dword [ebp - 0x450]
mov eax, dword [eax + edi*4]
mov dword [ebx + edi*4], eax
inc edi
cmp edi, esi
jb 0x40f5dc
push dword [ebp + 8]
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor ecx, ecx
cmp eax, 0x102
setne cl
push ebx
mov dword [ebp - 0x430], ecx
call fcn.0041f319
pop ecx
xor edi, edi
test esi, esi
jbe 0x40f667
mov eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0x450]
sar eax, 2
cmp edi, eax
jb 0x40f647
call fcn.004203c7
mov eax, dword [ebp - 0x450]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, esi
jb 0x40f62f
jmp 0x40f667
mov dword [ebp - 0x430], 1
lea esi, [ebp - 0x45c]
call fcn.00417ec1
mov eax, dword [ebp - 0x430]
jmp 0x40f67c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f23c
leave
ret