Function at 0x1011ddbd
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017ca25
mov eax, dword fs:[0]
push eax
mov eax, 0x1a74
call fcn.1012ba20
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1a5c], esi
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x1a60], eax
mov dword [ebp - 0x1a54], ebx
mov dword [ebp - 0x1a50], ebx
mov dword [ebp - 0x1a4c], ebx
mov dword [ebp - 4], ebx
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x54], ebx
je 0x1011de3c
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x1a54]
push eax
push edi
push dword [ebp + 8]
call fcn.1011e32c
cmp dword [esi + 0x48], ebx
je 0x1011e2fc
cmp dword [ebp + 8], 0x2712
mov dword [esi + 0x48], 1
mov dword [esi + 0x50], edi
jne 0x1011e2ff
push dword [esi + 0x3c]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x1a44], edi
test edi, edi
jne 0x1011de9e
mov ecx, esi
call fcn.1011c8d4
test eax, eax
mov edi, 0x2712
lea eax, [ebp - 0x1a54]
mov ecx, esi
push eax
push dword [esi + 0x3c]
push edi
je 0x1011de97
call fcn.1011af9b
mov ebx, eax
jmp 0x1011e2ff
call fcn.1011beb2
jmp 0x1011de90
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x1a58]
push eax
push 0x1000
lea eax, [ebp - 0x1a38]
push eax
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1011e2b5
mov eax, dword [ebp - 0x1a58]
cmp eax, 0x1000
ja 0x1011e2b5
xor ecx, ecx
cmp dword [esi + 0x54], ebx
setne cl
shr eax, 2
mov dword [ebp - 0x1a40], ecx
cmp ecx, eax
jae 0x1011e2b5
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp + ecx*4 - 0x1a38]
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x1011e291
push 0x1c
call fcn.1012b779
mov edi, eax
pop ecx
mov dword [ebp - 0x1a48], edi
mov dword [ebp - 0x1a80], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x1011df53
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], ebx
jmp 0x1011df5b
mov edi, ebx
mov dword [ebp - 0x1a48], ebx
mov byte [ebp - 4], bl
test edi, edi
je 0x1011e28b
cmp dword [ebp - 0x1a40], 0
mov dword [edi], 0x1c
mov eax, dword [esi + 0x3c]
mov dword [edi + 0xc], eax
jne 0x1011e076
push 0x208
lea eax, [ebp - 0xa38]
push ebx
push eax
call fcn.1012db70
add esp, 0xc
call fcn.10007945
push eax
lea ecx, [ebp - 0x1a3c]
call fcn.10008bfd
mov byte [ebp - 4], 3
lea eax, [ebp - 0xa38]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0xb
mov esi, str.SystemRoot
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10131342
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x218]
jne 0x1011e023
push eax
call fcn.10130fe5
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x1a3c]
call fcn.10008f20
lea eax, [ebp - 0xa38]
push eax
push esi
lea ecx, [ebp - 0x1a3c]
call fcn.10015b5c
mov esi, dword [ebp - 0x1a3c]
lea eax, [ebp - 0x218]
push esi
push 0x208
push eax
call fcn.100100b8
jmp 0x1011e065
push 4
mov esi, 0x10181620
push esi
push eax
call fcn.10131342
add esp, 0xc
test eax, eax
jne 0x1011e05f
lea eax, [ebp - 0x218]
push eax
call fcn.10130fe5
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x1a3c]
call fcn.10008f20
push 0x101bd7f8
jmp 0x1011dffd
mov esi, dword [ebp - 0x1a3c]
mov byte [ebp - 4], bl
lea ecx, [esi - 0x10]
call fcn.100078bc
mov esi, dword [ebp - 0x1a5c]
call fcn.1012998f
cmp dword [eax + 4], 0
je 0x1011e0d6
xor eax, eax
cmp dword [ebp - 0x1a40], eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x420]
push 0x104
push eax
lea eax, [ebp - 0x218]
push eax
jne 0x1011e0ac
call fcn.1004b7e6
jmp 0x1011e0b1
call fcn.1004b449
add esp, 0xc
test eax, eax
je 0x1011e0d6
push SysReAllocString
lea eax, [ebp - 0x420]
push eax
push ebx
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.10015d3f
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.1003b401
push 0x410
lea eax, [ebp - 0x830]
push ebx
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x7e
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x1011e158
push 0x23
call fcn.10010082
mov edi, 0x208
pop ecx
push edi
test eax, eax
je 0x1011e130
lea ecx, [ebp - 0x830]
push ecx
lea ecx, [ebp - 0x218]
push ecx
call eax
jmp 0x1011e144
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x1011e176
push SysReAllocString
lea eax, [ebp - 0x218]
push eax
push ebx
push edi
jmp 0x1011e16a
push SysReAllocString
lea eax, [ebp - 0x218]
push eax
push ebx
push 0x208
lea eax, [ebp - 0x830]
push eax
call fcn.10015d3f
xor eax, eax
lea edi, [ebp - 0x1a7c]
stosd dword es:[edi], eax
push 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1a7c]
push eax
mov eax, dword [ebp - 0x1a40]
push dword [ebp + eax*4 - 0x1a38]
push dword [ebp - 0x1a44]
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x1011e230
lea ecx, [ebp - 0x1a64]
call fcn.10008950
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1a7c]
cdq
mov dword [ebp - 0x1a70], eax
mov eax, dword [ebp - 0x1a78]
mov dword [ebp - 0x1a68], eax
lea eax, [ebp - 0x830]
push eax
mov dword [ebp - 0x1a6c], edx
call fcn.10130fe5
pop ecx
push eax
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x1a64]
call fcn.10008f20
lea eax, [ebp - 0x1a70]
push eax
lea ecx, [ebp - 0x1a54]
call fcn.1011a7b7
mov eax, dword [ebp - 0x1a60]
test eax, eax
je 0x1011e222
lea ecx, [ebp - 0x1a70]
push ecx
mov ecx, eax
call fcn.1011a7b7
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1a70]
call fcn.10040044
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
push dword [esi + 0x3c]
call fcn.1011c9fd
cmp dword [ebp + 0x10], 0
je 0x1011e264
test eax, eax
jne 0x1011e264
mov edi, dword [ebp - 0x1a48]
mov ecx, edi
call fcn.10039234
push 0x1c
push edi
call fcn.1012b624
pop ecx
pop ecx
jmp 0x1011e28b
mov ecx, ebx
test eax, eax
je 0x1011e26f
mov ecx, 0x2716
mov edi, dword [ebp - 0x1a48]
push ebx
push ecx
push edi
mov ecx, esi
call fcn.1011b52d
push edi
mov ecx, esi
call fcn.1011e9b2
test eax, eax
je 0x1011e2af
mov edi, dword [ebp - 0x1a44]
mov ecx, dword [ebp - 0x1a40]
mov eax, dword [ebp - 0x1a58]
inc ecx
shr eax, 2
mov dword [ebp - 0x1a40], ecx
cmp ecx, eax
jb 0x1011defe
mov edi, dword [ebp - 0x1a44]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x48], 0
je 0x1011e2f1
lea eax, [ebp - 0x1a54]
mov edi, 0x2712
push eax
push dword [esi + 0x3c]
mov ecx, esi
push edi
call fcn.1011beb2
cmp dword [esi + 0x48], 0
je 0x1011e2f1
lea eax, [ebp - 0x1a54]
mov ecx, esi
push eax
push dword [esi + 0x3c]
push edi
call fcn.1011af9b
lea ecx, [ebp - 0x1a54]
call fcn.1011eedd
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a54]
call fcn.10040a41
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012b632
leave
ret 0x10