Function at 0x50a290
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
sub esp, 0xc70
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0xc6c], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0xc80]
lea eax, [esp + 0xa70]
push 0x208
push 0
push eax
call fcn.006e1410
push 0x208
lea eax, [esp + 0x670]
push 0
push eax
call fcn.006e1410
push 0x208
lea eax, [esp + 0x884]
push 0
push eax
call fcn.006e1410
add esp, 0x24
mov dword [esp + 0xc], 0x22c
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
nop dword [eax]
cmp edi, dword [esp + 0x14]
je 0x50a347
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x50a310
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xc6c]
xor ecx, esp
call fcn.006def69
add esp, 0xc70
ret
xor ecx, ecx
nop dword [eax]
movzx eax, word [esp + ecx + 0x30]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0xa6e], ax
test ax, ax
jne 0x50a350
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x50a39c
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xc6c]
xor ecx, esp
call fcn.006def69
add esp, 0xc70
ret
push edi
push 8
mov dword [esp + 0x240], 0x428
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x50a3d3
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [esp + 0xc6c]
xor ecx, esp
call fcn.006def69
add esp, 0xc70
ret
lea eax, [esp + 0x238]
push eax
push edi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x50a402
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
mov ecx, dword [esp + 0xc6c]
xor ecx, esp
call fcn.006def69
add esp, 0xc70
ret
mov esi, 1
nop word [eax + eax]
lea ecx, [esp + 0xa70]
lea eax, [esp + 0x258]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x50a446
test dx, dx
je 0x50a442
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x50a446
add eax, 4
add ecx, 4
test dx, dx
jne 0x50a420
xor eax, eax
jmp 0x50a44b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x50a4f2
lea eax, [esp + 0x458]
push 0x7229c4
push eax
call fcn.006e1892
mov esi, eax
push 0x7229c4
push esi
call fcn.006e1892
add esp, 0x10
test eax, eax
je 0x50a495
nop dword [eax]
add esi, 2
push 0x7229c4
push esi
call fcn.006e1892
add esp, 8
test eax, eax
jne 0x50a480
lea ecx, [esp + 0x458]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x50a4a0
sub ecx, edx
lea edx, [esi + 2]
sar ecx, 1
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x50a4b2
sub esi, edx
lea eax, [esp + 0x458]
sar esi, 1
sub ecx, esi
add ecx, ecx
push ecx
push eax
lea eax, [esp + 0x870]
push eax
call fcn.006e0e90
lea eax, [esp + 0x874]
push eax
call fcn.006f49a8
add esp, 0x10
mov esi, 1
jmp 0x50a54f
xor ecx, ecx
movzx eax, word [esp + ecx + 0x458]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x65e], ax
test ax, ax
jne 0x50a4f4
lea eax, [esp + 0x660]
push eax
call fcn.006f49a8
lea eax, [esp + 0x664]
push str.C:WINDOWS_
push eax
call fcn.006e1892
add esp, 0xc
test eax, eax
jne 0x50a54f
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x664]
push eax
call fcn.006e1892
add esp, 8
test eax, eax
cmove ebx, esi
lea eax, [esp + 0x238]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x50a410
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc78]
xor eax, eax
pop edi
test ebx, ebx
pop esi
setne al
pop ebx
xor ecx, esp
call fcn.006def69
add esp, 0xc70
ret