Function at 0x1000f402
Capabilities:
Enumerate process modules

Disassembly:
jae 0x1000f2b1
jmp 0x1000f2ac
call fcn.1000f2b3
jae 0x1000f2ac
add esp, 4
jmp 0x1000f2b8
dec dword [esp]
jno 0x1000f2bd
jns 0x1000f2a8
jp 0x1000f2c1
add esp, 4
popf
jmp 0x1000f2c8
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000f2e1
jne 0x1000f2e1
call 0x1fc12635
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0x3c48084a
lea ecx, [ebp - 0x64]
call fcn.1000fc40
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x30]
call fcn.1000a500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.1000fb00
clc
jae 0x1000f32b
popfd
jns 0x1000f392
pushf
pushfd
push 0xa
jae 0x1000f338
jmp 0x1000f333
call 0x1000f33a
jae 0x1000f333
add esp, 4
jmp 0x1000f33f
dec dword [esp]
jno 0x1000f344
jns 0x1000f32f
jp 0x1000f348
add esp, 4
popf
jmp 0x1000f34f
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000f368
jne 0x1000f368
jns 0x1000f3e5
jl 0x1000f36d
add ebp, ebx
add edi, dword [ecx + 0x74]
sti
jmp 0x1000f36f
je 0x1000f36a
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000f389
jne 0x1000f388
call 0x9304e410
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000f397
jne 0x1000f397
call 0xfb0e883
dec dword [ebx - 0x769b0bb3]
or eax, 0
call fcn.1000a390
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jmp 0x1000f3e9
add esi, edx
je 0x1000f3e4
clc
jae 0x1000f3ee
cmp eax, 0x750374f2
add edx, esi
je 0x1000f3f3
jne 0x1000f3f3
pushf
pushf
push 0xa
jae 0x1000f400
jmp 0x1000f3fb
call 0x1000f402
jae 0x1000f3fb
add esp, 4
jmp 0x1000f407
dec dword [esp]
jno 0x1000f40c
jns 0x1000f3f7
jp 0x1000f410
add esp, 4
popf
jmp 0x1000f417
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000f430
jne 0x1000f430
call 0x1fc12784
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, 1
test eax, eax
je 0x1000f4d0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], 0x224
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
jne 0x1000f48a
jmp 0x1000f541
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1000f4b3
lea edx, [ebp - 0x108]
push edx
call fcn.1000f150
add esp, 4
jmp 0x1000f48a
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000f441
clc
jae 0x1000f4d5
pop ecx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x1000f4e2
jmp 0x1000f4dd
call 0x1000f4e4
jae 0x1000f4dd
add esp, 4
jmp 0x1000f4e9
dec dword [esp]
jno 0x1000f4ee
jns 0x1000f4d9
jp 0x1000f4f2
add esp, 4
popf
jmp 0x1000f4f9
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000f512
jne 0x1000f512
lcall 0x749a, 0x3eb037c
sti
jl 0x1000f517
jmp 0x1000f519
je 0x1000f514
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000f533
jne 0x1000f532
call 0x9304e5ba
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000f541
jne 0x1000f541
call 0x9b5c53a4
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a6ea
mov esp, ebp
pop ebp
ret