Function at 0x4f2870
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x50ceb0
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [edx + 0x14], 0
cmp dword [esi + 0x10], 0
je 0x4f2b94
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x4f28be
mov eax, dword [esi]
push eax
push str.AdobeUpdater.exe
call fcn.005d3f0e
add esp, 8
test eax, eax
je 0x4f2964
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x4f28de
mov eax, dword [esi]
push eax
push str.Adobe_Updater.exe
call fcn.005d3f0e
add esp, 8
test eax, eax
je 0x4f2964
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4f28fa
mov eax, dword [esi]
push eax
push str.ReaderUpdater.exe
call fcn.005d3f0e
add esp, 8
test eax, eax
je 0x4f2964
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4f2916
mov eax, dword [esi]
push eax
push str.AcrobatUpdater.exe
call fcn.005d3f0e
add esp, 8
test eax, eax
je 0x4f2964
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4f2932
mov eax, dword [esi]
push eax
push 0x676e7e
call fcn.005d3f0e
add esp, 8
test eax, eax
je 0x4f2964
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4f294e
mov eax, dword [esi]
push eax
push str.AcroRdUWP.exe
call fcn.005d3f0e
add esp, 8
test eax, eax
jne 0x4f2b94
mov edi, 0x20
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
nop word cs:[eax + eax]
nop dword [eax]
mov esi, eax
mov edx, edi
mov dword [ebp - 0x2c], edi
sub esi, ecx
sar esi, 2
sub edx, esi
jae 0x4f29b0
lea eax, [ecx + edi*4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 2
jmp 0x4f29e0
jbe 0x4f29e0
mov esi, dword [ebp - 0x20]
sub esi, ecx
sar esi, 2
cmp esi, edi
jae 0x4f2a21
lea eax, [ebp - 0x48]
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x28]
push eax
push edi
call fcn.0050afb0
mov edi, dword [ebp - 0x2c]
nop word cs:[eax + eax]
nop
mov ecx, dword [ebp - 0x28]
lea eax, [edi*4]
lea edx, [ebp - 0x48]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x10], 2
push edx
push eax
push ecx
call sub.PSAPI.DLL_EnumProcesses
mov edi, dword [ebp - 0x2c]
test eax, eax
je 0x4f2a3b
mov eax, dword [ebp - 0x48]
shr eax, 2
cmp eax, edi
jb 0x4f2a43
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add edi, edi
jmp 0x4f2990
lea esi, [eax + edx*4]
shl edx, 2
push edx
push 0
push eax
call fcn.0061e8c0
add esp, 0xc
mov dword [ebp - 0x24], esi
jmp 0x4f29a6
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
jmp 0x4f2a90
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov edx, eax
mov edi, ecx
sub edi, esi
sar edi, 2
sub edx, edi
jae 0x4f2a5e
lea eax, [esi + eax*4]
mov dword [ebp - 0x24], eax
jmp 0x4f2a90
jbe 0x4f2a90
mov edi, dword [ebp - 0x20]
sub edi, esi
sar edi, 2
cmp edi, eax
jae 0x4f2a7b
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x28]
push edx
push eax
call fcn.0050afb0
jmp 0x4f2a90
lea esi, [ecx + edx*4]
shl edx, 2
push edx
push 0
push ecx
call fcn.0061e8c0
add esp, 0xc
mov dword [ebp - 0x24], esi
xor edx, edx
jmp 0x4f2ab6
push edx
push eax
call fcn.005d319e
add esp, 8
mov edx, dword [ebp - 0x2c]
inc edx
test esi, esi
je 0x4f2b98
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x4f2b4c
mov eax, dword [eax + edx*4]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x4c], eax
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00499110
add esp, 8
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
mov eax, ecx
jb 0x4f2af3
mov eax, dword [ecx]
cmp dword [ebp - 0x34], 7
lea ecx, [ebp - 0x48]
jbe 0x4f2aff
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x10], 3
push eax
push ecx
call fcn.005d3f0e
add esp, 8
mov ecx, dword [ebp - 0x34]
mov esi, eax
cmp ecx, 8
jb 0x4f2aaa
mov eax, dword [ebp - 0x48]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4f2aa0
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4f2bc9
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x4f2aa0
xor esi, esi
test eax, eax
je 0x4f2ba2
mov ecx, dword [ebp - 0x20]
sub ecx, eax
cmp ecx, 0x1000
jb 0x4f2b71
mov edx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, edx
cmp eax, 0x20
jae 0x4f2bd5
add ecx, 0x23
mov eax, edx
push ecx
push eax
call fcn.005d319e
add esp, 8
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
test esi, esi
jne 0x4f2ba6
xor eax, eax
jmp 0x4f2bb5
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x4c]
test eax, eax
jne 0x4f2b52
test esi, esi
je 0x4f2b94
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 1
mov dword [eax + 0x1c], esi
mov al, 1
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [ebp - 0x10], 0
call fcn.006207e0
mov dword [ebp - 0x10], 1
call fcn.006207e0
nop word cs:[eax + eax]
nop dword [eax + eax]
push ebp
sub esp, 0xc
add ebp, 0xc
call fcn.0061de80
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
call fcn.0061de80
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
mov ecx, dword [ebp - 0x34]
cmp ecx, 8
jb 0x4f2c4e
mov eax, dword [ebp - 0x48]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4f2c44
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4f2c67
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], 0
add esp, 0xc
pop ebp
ret
call fcn.006207e0
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4f2cbb
mov eax, dword [ebp - 0x20]
sub eax, ecx
cmp eax, 0x1000
jb 0x4f2c9c
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x4f2cc0
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.005d319e
add esp, 8
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
add esp, 0xc
pop ebp
ret
call fcn.006207e0
int3