Function at 0x49e12d
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5137de
mov eax, dword fs:[0]
push eax
mov eax, 0x1488
call fcn.004e5f20
mov eax, dword [0x549950]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x478]
call fcn.004012a0
xor esi, esi
push 0x522764
lea ecx, [ebp - 0x45c]
mov dword [ebp - 4], esi
call fcn.004012a0
mov byte [ebp - 4], 1
mov dword [ebp - 0x480], esi
cmp dword [ebp - 0x464], esi
jne 0x49e1cf
cmp dword [ebp - 0x448], esi
jne 0x49e1cf
lea ecx, [ebp - 0x45c]
call fcn.004012e0
lea ecx, [ebp - 0x478]
call fcn.004012e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004df2ac
leave
ret
lea eax, [ebp - 0x48c]
push eax
push 0x1000
lea eax, [ebp - 0x1494]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x49e205
lea ecx, [ebp - 0x45c]
call fcn.004012e0
lea ecx, [ebp - 0x478]
call fcn.004012e0
mov eax, esi
jmp 0x49e1b5
lea ebx, [ebp - 0x478]
call fcn.004a74a7
lea ebx, [ebp - 0x45c]
call fcn.004a74a7
mov eax, dword [ebp - 0x48c]
xor ecx, ecx
shr eax, 2
inc ecx
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x47c], ecx
cmp eax, ecx
jbe 0x49e3ea
jmp 0x49e23f
xor esi, esi
mov ecx, dword [ebp - 0x47c]
cmp dword [ebp + ecx*4 - 0x1494], esi
je 0x49e3c1
push 5
pop ecx
mov ebx, 0x1f4
push ebx
lea eax, [ebp - 0x410]
push 0
mov esi, str._unknown_
lea edi, [ebp - 0x424]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004e57c0
add esp, 0xc
push 5
pop ecx
push ebx
xor ebx, ebx
lea eax, [ebp - 0x208]
push ebx
mov esi, str._unknown_
lea edi, [ebp - 0x21c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004e57c0
mov eax, dword [ebp - 0x47c]
add esp, 0xc
push dword [ebp + eax*4 - 0x1494]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x49e302
lea eax, [ebp - 0x490]
push eax
push 4
lea eax, [ebp - 0x484]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x49e302
mov edi, 0x104
push edi
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x484]
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
push edi
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x484]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push ebx
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x428], 7
call fcn.00401830
mov byte [ebp - 4], 2
cmp dword [ebp - 0x464], ebx
je 0x49e35b
lea eax, [ebp - 0x424]
push eax
push 0x5227e4
lea ecx, [ebp - 0x440]
call fcn.004a754a
pop ecx
pop ecx
lea ebx, [ebp - 0x440]
call fcn.004a74a7
lea eax, [ebp - 0x478]
mov ecx, ebx
call fcn.00405610
test al, al
jne 0x49e3d5
xor ebx, ebx
cmp dword [ebp - 0x448], ebx
je 0x49e3a5
lea eax, [ebp - 0x21c]
push eax
push 0x5227e4
lea ecx, [ebp - 0x440]
call fcn.004a754a
lea ebx, [ebp - 0x440]
call fcn.004a74a7
mov eax, ebx
push eax
lea ecx, [ebp - 0x45c]
call fcn.004a7869
add esp, 0xc
cmp eax, 0xffffffff
je 0x49e3a5
mov dword [ebp - 0x480], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 1
call fcn.004012e0
mov eax, dword [ebp - 0x488]
inc dword [ebp - 0x47c]
cmp dword [ebp - 0x47c], eax
jb 0x49e23d
jmp 0x49e3ea
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x480], 1
call fcn.004012e0
mov esi, dword [ebp - 0x480]
jmp 0x49e1eb