Function at 0x10003480
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004ade6
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x10061010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ecx, esi
mov dword [ebp - 0x4a0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100034e0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.1000a980
mov dword [ebp - 4], 0
mov eax, 0x7fffffff
mov ecx, dword [ebp - 0x18]
sub eax, ecx
cmp eax, 4
jb 0x10003959
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea edx, [ecx + 4]
mov dword [ebp - 0x60], 0
cmovae eax, dword [ebp - 0x28]
lea edi, [ebp - 0x70]
mov esi, 0xf
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x5c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x49c], edx
movups xmmword [ebp - 0x70], xmm0
cmp edx, esi
jbe 0x100035d1
mov esi, edx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x1000358b
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
push ecx
call fcn.10026b6a
add esp, 4
test eax, eax
je 0x10003968
mov ecx, dword [ebp - 0x18]
lea edi, [eax + 0x23]
mov edx, dword [ebp - 0x49c]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x100035c8
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x100035ac
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x1000395e
jmp 0x10003566
test eax, eax
je 0x100035c6
push eax
call fcn.10026b6a
mov ecx, dword [ebp - 0x18]
add esp, 4
mov edx, dword [ebp - 0x49c]
mov edi, eax
jmp 0x100035c8
xor edi, edi
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x70], edi
push ecx
push eax
push edi
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], esi
call fcn.100280e0
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov dword [eax + edi], 0x4c4c442e
mov byte [edi + eax + 4], 0
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.100033a0
lea ecx, [ebp - 0x524]
mov byte [ebp - 4], 2
call fcn.10004f40
mov esi, eax
mov byte [ebp - 4], 3
lea edx, [ebp - 0x58]
cmp dword [ebp - 0x44], 0x10
cmovae edx, dword [ebp - 0x58]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003625
sub ecx, edi
lea eax, [ecx + edx]
mov ecx, esi
push eax
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.10007120
lea ecx, [ebp - 0x524]
mov byte [ebp - 4], 5
call fcn.10004e80
cmp dword [ebp - 0x44], 0x10
lea edx, [ebp - 0x58]
xorps xmm0, xmm0
mov dword [ebp - 0x4ac], 0
cmovae edx, dword [ebp - 0x58]
mov ecx, edx
mov dword [ebp - 0x4a8], 0
movups xmmword [ebp - 0x4bc], xmm0
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003680
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x4bc]
call fcn.1000a980
lea edx, [ebp - 0x4bc]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4d4]
call fcn.100033a0
mov esi, eax
mov edx, 0x1005a2dc
mov byte [ebp - 4], 7
call fcn.10009950
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x100036c5
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, eax
call fcn.1000c930
push eax
call fcn.10009c20
mov byte [ebp - 4], 6
add esp, 8
mov ecx, dword [ebp - 0x4c0]
cmp ecx, 0x10
jb 0x10003716
mov edx, dword [ebp - 0x4d4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000370c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003963
push ecx
push edx
call fcn.10026b39
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x4c0], 0xf
mov byte [ebp - 0x4d4], 0
cmp ecx, 0x10
jb 0x1000376f
mov edx, dword [ebp - 0x4bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003765
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003963
push ecx
push edx
call fcn.10026b39
add esp, 8
mov esi, dword [ebp - 0x4a0]
cmp esi, 0xffffffff
je 0x10003819
push 0x424
lea eax, [ebp - 0x494]
push 0
push eax
call fcn.10028660
add esp, 0xc
mov dword [ebp - 0x498], 0x428
lea eax, [ebp - 0x498]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x10003819
mov edi, dword [sym.imp.KERNEL32.dll_Module32NextW]
nop word [eax + eax]
cmp dword [ebp - 0x2c], 8
lea edx, [ebp - 0x40]
mov ecx, 0x10062cb0
cmovae edx, dword [ebp - 0x40]
call fcn.10009cc0
lea edx, [ebp - 0x478]
mov ecx, eax
call fcn.10009cc0
push eax
call fcn.10009f80
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x478]
push eax
call fcn.1002d963
add esp, 0xc
test eax, eax
je 0x10003914
lea eax, [ebp - 0x498]
push eax
push esi
call edi
test eax, eax
jne 0x100037c0
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x1000385c
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10003852
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003968
push ecx
push edx
call fcn.10026b39
add esp, 8
mov ecx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp ecx, 0x10
jb 0x100038a4
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000389a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003968
push ecx
push edx
call fcn.10026b39
add esp, 8
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
cmp ecx, 0x10
jb 0x100038ea
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100038e0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003968
push ecx
push edx
call fcn.10026b39
add esp, 8
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x1000393c
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x10003932
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003968
jmp 0x10003932
mov edx, str.Found_nigga__
call fcn.10009950
push eax
call fcn.10009c20
mov edi, dword [ebp - 0x484]
add esp, 4
jmp 0x1000381b
push ecx
push edx
call fcn.10026b39
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026b2b
mov esp, ebp
pop ebp
ret
call fcn.100015c0
call fcn.100014f0
call fcn.1002d7e1
call fcn.1002d7e1
int3