Function at 0x43e340
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7568
mov eax, dword fs:[0]
push eax
sub esp, 0x47c
mov eax, dword [0x50b230]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x478], 0x410
push 0
push 0x410
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.00436f90
add esp, 0x10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00431b60
movzx edx, al
test edx, edx
jne 0x43e3f0
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x20]
call fcn.00434630
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
mov ecx, dword [ebp + 8]
call fcn.0043af60
mov eax, dword [ebp - 0x450]
or eax, 1
mov dword [ebp - 0x450], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00431490
mov eax, dword [ebp + 8]
jmp 0x43e68c
lea ecx, [ebp - 0x20]
call fcn.00444810
mov ecx, eax
call fcn.0041cf20
mov dword [ebp - 0x45c], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0043d550
add esp, 4
push eax
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0xffffffff
jne 0x43e4e4
lea edx, [ebp - 0x46c]
push edx
call fcn.0040bc70
add esp, 4
lea ecx, [ebp - 0x46c]
call fcn.0040c2e0
cmp eax, 0x12b
jne 0x43e4a8
lea ecx, [ebp - 0x20]
call fcn.00444810
push eax
lea ecx, [ebp - 0x464]
call fcn.00414650
mov byte [ebp - 0x460], 0
lea eax, [ebp - 0x464]
push eax
mov ecx, dword [ebp + 8]
call fcn.0043afd0
mov ecx, dword [ebp - 0x450]
or ecx, 1
mov dword [ebp - 0x450], ecx
lea ecx, [ebp - 0x464]
call fcn.00439c60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00431490
mov eax, dword [ebp + 8]
jmp 0x43e68c
mov edx, dword [ebp - 0x468]
push edx
mov eax, dword [ebp - 0x46c]
push eax
mov ecx, dword [ebp + 8]
call fcn.0043af60
mov ecx, dword [ebp - 0x450]
or ecx, 1
mov dword [ebp - 0x450], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00431490
mov eax, dword [ebp + 8]
jmp 0x43e68c
mov edx, dword [ebp - 0x454]
push edx
lea ecx, [ebp - 0x458]
call fcn.004146a0
mov byte [ebp - 4], 1
mov dword [ebp - 0x448], 0x428
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 0
push 0x200
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.0048d3c0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x228]
push ecx
call fcn.0048d3c0
add esp, 0xc
lea edx, [ebp - 0x448]
push edx
mov eax, dword [ebp - 0x454]
push eax
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x43e5e0
lea ecx, [ebp - 0x488]
push ecx
call fcn.0040bc70
add esp, 4
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
mov ecx, dword [ebp + 8]
call fcn.0043af60
mov ecx, dword [ebp - 0x450]
or ecx, 1
mov dword [ebp - 0x450], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x458]
call fcn.00419fc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00431490
mov eax, dword [ebp + 8]
jmp 0x43e68c
mov byte [ebp - 0x449], 0
lea edx, [ebp - 0x448]
push edx
mov eax, dword [ebp - 0x45c]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0043ad10
movzx ecx, al
test ecx, ecx
jne 0x43e60b
mov byte [ebp - 0x449], 1
lea edx, [ebp - 0x448]
push edx
mov eax, dword [ebp - 0x454]
push eax
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x43e5e7
lea ecx, [ebp - 0x20]
call fcn.00444810
push eax
lea ecx, [ebp - 0x474]
call fcn.00414650
mov cl, byte [ebp - 0x449]
mov byte [ebp - 0x470], cl
lea edx, [ebp - 0x474]
push edx
mov ecx, dword [ebp + 8]
call fcn.0043afd0
mov eax, dword [ebp - 0x450]
or eax, 1
mov dword [ebp - 0x450], eax
lea ecx, [ebp - 0x474]
call fcn.00439c60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x458]
call fcn.00419fc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00431490
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048ab20
mov esp, ebp
pop ebp
ret