Function at 0x40d640
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x461718
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47c748]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0x1c], 0
jne 0x40d681
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xd8]
push ecx
jmp 0x40d682
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x485724
mov ecx, 0x485730
mov edi, eax
call fcn.00408230
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx - 0xc]
cmp eax, 4
jle 0x40d6b5
lea edx, [esp + 0x2c]
push edx
mov ecx, 0x485730
call fcn.00408230
push 0x485138
push edi
mov dword [0x485138], 0x428
call sub.KERNEL32.dll_Module32FirstW
or ebp, 0xffffffff
lea ecx, [ecx]
mov eax, 0x485158
lea edx, [eax + 2]
jmp 0x40d6e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d6e0
sub eax, edx
sar eax, 1
push eax
push 0x485158
mov ecx, 0x48572c
call fcn.004082b0
mov edx, dword [0x485730]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40d72a
push esi
mov ecx, 0x485730
call fcn.00408120
mov edx, dword [0x485730]
lea eax, [esi + 1]
push eax
push edx
call fcn.00433b49
add esp, 8
test esi, esi
jl 0x40d897
mov eax, dword [0x485730]
cmp esi, dword [eax - 8]
jg 0x40d897
mov dword [eax - 0xc], esi
mov ecx, dword [0x485730]
mov word [ecx + esi*2], 0
mov edx, dword [0x48572c]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40d787
push esi
mov ecx, 0x48572c
call fcn.00408120
mov edx, dword [0x48572c]
lea eax, [esi + 1]
push eax
push edx
call fcn.00433b49
add esp, 8
test esi, esi
jl 0x40d897
mov eax, dword [0x48572c]
cmp esi, dword [eax - 8]
jg 0x40d897
mov dword [eax - 0xc], esi
mov ecx, dword [0x48572c]
mov word [ecx + esi*2], 0
mov ecx, dword [0x485730]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x40d85f
mov eax, dword [0x48572c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d7f9
test dx, dx
je 0x40d7f5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d7f9
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d7d3
xor eax, eax
jmp 0x40d7fd
sbb eax, eax
sbb eax, ebp
test eax, eax
sete al
test al, al
jne 0x40d869
push 0x485138
push edi
mov dword [0x485138], 0x428
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x40d6d0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x40d847
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
push 0x80004005
call fcn.004088a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x48514c]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], ebp
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x40d893
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x40d849
push 0x80070057
call fcn.004088a0
int3