Function at 0x40d360
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x461118
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47b748]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0x1c], 0
jne 0x40d3a1
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xdc]
push ecx
jmp 0x40d3a2
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x48471c
mov ecx, 0x484728
mov edi, eax
call fcn.00408220
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx - 0xc]
cmp eax, 4
jle 0x40d3d5
lea edx, [esp + 0x2c]
push edx
mov ecx, 0x484728
call fcn.00408220
push 0x484138
push edi
mov dword [0x484138], 0x428
call sub.KERNEL32.dll_Module32FirstW
or ebp, 0xffffffff
lea ecx, [ecx]
mov eax, 0x484158
lea edx, [eax + 2]
jmp 0x40d400
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d400
sub eax, edx
sar eax, 1
push eax
push 0x484158
mov ecx, 0x484724
call fcn.004082a0
mov edx, dword [0x484728]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40d44a
push esi
mov ecx, 0x484728
call fcn.00408110
mov edx, dword [0x484728]
lea eax, [esi + 1]
push eax
push edx
call fcn.00433569
add esp, 8
test esi, esi
jl 0x40d5b7
mov eax, dword [0x484728]
cmp esi, dword [eax - 8]
jg 0x40d5b7
mov dword [eax - 0xc], esi
mov ecx, dword [0x484728]
mov word [ecx + esi*2], 0
mov edx, dword [0x484724]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40d4a7
push esi
mov ecx, 0x484724
call fcn.00408110
mov edx, dword [0x484724]
lea eax, [esi + 1]
push eax
push edx
call fcn.00433569
add esp, 8
test esi, esi
jl 0x40d5b7
mov eax, dword [0x484724]
cmp esi, dword [eax - 8]
jg 0x40d5b7
mov dword [eax - 0xc], esi
mov ecx, dword [0x484724]
mov word [ecx + esi*2], 0
mov ecx, dword [0x484728]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x40d57f
mov eax, dword [0x484724]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d519
test dx, dx
je 0x40d515
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d519
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d4f3
xor eax, eax
jmp 0x40d51d
sbb eax, eax
sbb eax, ebp
test eax, eax
sete al
test al, al
jne 0x40d589
push 0x484138
push edi
mov dword [0x484138], 0x428
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x40d3f0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x40d567
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
push 0x80004005
call fcn.00408890
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x48414c]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], ebp
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x40d5b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x40d569
push 0x80070057
call fcn.00408890
int3