Function at 0x10030ed0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x101c7708
push 0x100d5830
mov eax, dword fs:[0]
push eax
add esp, 0xfffffdcc
push ebx
push esi
push edi
lea edi, [ebp - 0x244]
mov ecx, 0x8b
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101ca9c4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100010ff
test eax, eax
je 0x10031283
mov esi, esp
push str.NtWow64QueryInformationProcess64
mov edi, esp
push 0x10192bd8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, esp
call fcn.1000318e
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1000318e
mov dword [ebp - 0x110], eax
mov esi, esp
push str.NtWow64ReadVirtualMemory64
mov edi, esp
push 0x10192bd8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, esp
call fcn.1000318e
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1000318e
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x110], 0
je 0x1003127e
cmp dword [ebp - 0x11c], 0
je 0x1003127e
mov esi, esp
push 0
push 0x30
lea eax, [ebp - 0x74]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x110]
cmp esi, esp
call fcn.1000318e
test eax, eax
je 0x10030fdf
jmp 0x10031411
push 8
mov eax, 1
shl eax, 3
lea ecx, [ebp + eax - 0x74]
push ecx
lea edx, [ebp - 0xf4]
push edx
call fcn.100026da
add esp, 0xc
mov esi, esp
push 0
push 0
push 8
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0xf4]
add ecx, 0x18
mov edx, dword [ebp - 0xf0]
adc edx, 0
push edx
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x11c]
cmp esi, esp
call fcn.1000318e
test eax, eax
je 0x10031037
jmp 0x10031411
mov esi, esp
push 0
push 0
push 8
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0xf4]
add ecx, 0x18
mov edx, dword [ebp - 0xf0]
adc edx, 0
push edx
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x11c]
cmp esi, esp
call fcn.1000318e
test eax, eax
jne 0x1003127e
push 8
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x74]
push edx
lea eax, [ebp - 0xf4]
push eax
call fcn.100026da
add esp, 0xc
mov esi, esp
push 0
push 0
push 8
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0xf4]
add ecx, 0x10
mov edx, dword [ebp - 0xf0]
adc edx, 0
push edx
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x11c]
cmp esi, esp
call fcn.1000318e
test eax, eax
jne 0x1003127e
push 8
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x74]
push edx
lea eax, [ebp - 0xf4]
push eax
call fcn.100026da
add esp, 0xc
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0xf0]
mov dword [ebp - 0x100], ecx
mov byte [ebp - 0x125], 0
mov esi, esp
push 0
push 0
push 0x68
lea eax, [ebp - 0xe4]
push eax
mov ecx, dword [ebp - 0xf0]
push ecx
mov edx, dword [ebp - 0xf4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x11c]
cmp esi, esp
call fcn.1000318e
test eax, eax
jne 0x10031258
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x104]
jne 0x10031256
mov ecx, dword [ebp - 0xf0]
cmp ecx, dword [ebp - 0x100]
jne 0x10031256
push 8
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0xf4]
push ecx
call fcn.100026da
add esp, 0xc
push 8
mov eax, 1
imul ecx, eax, 0x30
lea edx, [ebp + ecx - 0xe4]
push edx
lea eax, [ebp - 0x138]
push eax
call fcn.100026da
add esp, 0xc
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x144], 0
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x138]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10002842
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
je 0x10031223
cmp dword [ebp - 0x144], 0
je 0x10031223
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x138]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x150]
push eax
call fcn.1000191f
mov dword [ebp - 4], 0xfffffffe
jmp 0x1003123c
cmp dword [ebp - 0x150], 0
je 0x10031254
mov eax, dword [ebp - 0x150]
push eax
call fcn.100053ad
add esp, 4
jmp 0x1003127e
jmp 0x1003125a
jmp 0x1003127e
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0xf4]
jne 0x10031104
mov ecx, dword [ebp - 0x100]
cmp ecx, dword [ebp - 0xf0]
jne 0x10031104
jmp 0x10031411
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10031411
mov eax, dword [ebp - 0x3c]
add eax, 4
push eax
call fcn.100028e2
add esp, 4
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
je 0x10031411
mov eax, dword [ebp - 0x30]
add eax, 4
push eax
push 0
mov ecx, dword [ebp - 0x15c]
push ecx
call fcn.1000272f
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x15c]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10031402
mov dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x3c]
shr eax, 2
cmp dword [ebp - 0x168], eax
jae 0x10031402
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x180], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x174], 0
push 0
lea eax, [ebp - 0x174]
push eax
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + ecx*4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10003d28
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
je 0x100313bb
cmp dword [ebp - 0x174], 0
je 0x100313bb
cmp dword [ebp - 0x168], 0
jne 0x100313bb
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + ecx*4]
cdq
push edx
push eax
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x174]
push edx
mov eax, dword [ebp - 0x180]
push eax
call fcn.1000191f
mov dword [ebp - 4], 0xfffffffe
jmp 0x100313d4
cmp dword [ebp - 0x180], 0
je 0x100313ec
mov eax, dword [ebp - 0x180]
push eax
call fcn.100053ad
add esp, 4
mov eax, dword [ebp - 0x168]
add eax, 1
mov dword [ebp - 0x168], eax
jmp 0x10031402
mov eax, dword [ebp - 0x15c]
push eax
call fcn.100053ad
add esp, 4
push edx
mov ecx, ebp
push eax
lea edx, [0x10031450]
call fcn.10004b97
pop eax
pop edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10004d22
add esp, 0x244
cmp ebp, esp
call fcn.1000318e
mov esp, ebp
pop ebp
ret 0x10