Function at 0x41c4f0
Capabilities:
Create thread
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41debc
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0x426304]
xor eax, esp
mov dword [esp + 0x488], eax
push ebx
push esi
push edi
mov eax, dword [0x426304]
xor eax, esp
push eax
lea eax, [esp + 0x4a0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
mov ebx, ecx
push 8
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x30], esi
xor edi, edi
mov dword [esp + 0x4a8], edi
cmp esi, 0xffffffff
jne 0x41c59b
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], str.Could_not_get_module_snapshot_for_remote_process.
call fcn.0040680e
mov byte [esp + 0x4a8], 1
mov dword [esp + 0x14], vtable.std::runtime_error.0
mov byte [esp + 0x4a8], 0
push 0x424220
lea ecx, [esp + 0x18]
push ecx
call fcn.0040b8f9
push 0x424
lea edx, [esp + 0x3c]
push edi
push edx
mov dword [esp + 0x40], 0x428
call fcn.0040ca80
add esp, 0xc
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
cmp eax, edi
je 0x41c893
lea ebx, [ebx]
xor ecx, ecx
lea eax, [esp + 0x54]
mov dword [esp + 0x474], 7
mov dword [esp + 0x470], edi
mov word [esp + 0x460], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41c5f3
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x58]
lea esi, [esp + 0x464]
call fcn.004014c0
mov byte [esp + 0x4a8], 2
xor edx, edx
lea eax, [esp + 0x254]
mov word [esp + 0x47c], dx
mov dword [esp + 0x490], 7
mov dword [esp + 0x48c], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41c641
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x258]
lea esi, [esp + 0x480]
call fcn.004014c0
mov byte [esp + 0x4a8], 3
mov edi, dword [ebx + 0x10]
mov ecx, 8
cmp dword [ebx + 0x14], ecx
jb 0x41c67d
mov eax, dword [ebx]
jmp 0x41c67f
mov eax, ebx
mov esi, dword [esp + 0x470]
mov edx, esi
cmp esi, edi
jb 0x41c68e
mov edx, edi
cmp dword [esp + 0x474], ecx
mov ecx, dword [esp + 0x460]
jae 0x41c6a5
lea ecx, [esp + 0x460]
test edx, edx
je 0x41c6c5
lea esp, [esp]
mov bx, word [ecx]
cmp bx, word [eax]
jne 0x41c6ce
add ecx, 2
add eax, 2
dec edx
jne 0x41c6b0
mov ebx, dword [esp + 0x24]
cmp esi, edi
jae 0x41c6dc
or eax, 0xffffffff
jmp 0x41c6e3
sbb eax, eax
and eax, 0xfffffffe
inc eax
je 0x41c6c1
mov ebx, dword [esp + 0x24]
jmp 0x41c6e3
xor eax, eax
cmp esi, edi
setne al
test eax, eax
sete al
mov esi, 8
test al, al
jne 0x41c7b4
cmp dword [ebx + 0x14], esi
jb 0x41c6fe
mov eax, dword [ebx]
jmp 0x41c700
mov eax, ebx
push eax
mov eax, dword [esp + 0x490]
lea ecx, [esp + 0x480]
call fcn.00401dd0
test eax, eax
je 0x41c7b4
mov byte [esp + 0x4a8], 2
cmp dword [esp + 0x490], esi
jb 0x41c73d
mov edx, dword [esp + 0x47c]
push edx
call fcn.00406e29
add esp, 4
xor eax, eax
mov edi, 7
xor esi, esi
mov dword [esp + 0x490], edi
mov dword [esp + 0x48c], esi
mov word [esp + 0x47c], ax
mov byte [esp + 0x4a8], al
cmp dword [esp + 0x474], 8
jb 0x41c77d
mov ecx, dword [esp + 0x460]
push ecx
call fcn.00406e29
add esp, 4
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x34]
push eax
xor edx, edx
push ecx
mov dword [esp + 0x47c], edi
mov dword [esp + 0x478], esi
mov word [esp + 0x468], dx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
cmp eax, esi
je 0x41c893
xor edi, edi
jmp 0x41c5d0
mov byte [esp + 0x4a8], 2
cmp dword [esp + 0x490], esi
jb 0x41c7d5
mov edx, dword [esp + 0x47c]
push edx
call fcn.00406e29
add esp, 4
xor eax, eax
mov edi, 7
mov dword [esp + 0x490], edi
mov dword [esp + 0x48c], 0
mov word [esp + 0x47c], ax
mov byte [esp + 0x4a8], al
cmp dword [esp + 0x474], esi
jb 0x41c816
mov ecx, dword [esp + 0x460]
push ecx
call fcn.00406e29
add esp, 4
xor edx, edx
mov word [esp + 0x460], dx
mov edx, dword [esp + 0x10]
push edx
push 0
push 0x40a
mov dword [esp + 0x480], edi
mov dword [esp + 0x47c], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [esp + 0x28], edi
mov byte [esp + 0x4a8], 5
test edi, edi
jne 0x41c8d0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], str.Could_not_get_handle_to_process.
call fcn.0040680e
mov byte [esp + 0x4a8], 6
mov dword [esp + 0x14], vtable.std::runtime_error.0
mov byte [esp + 0x4a8], 5
push 0x424220
lea ecx, [esp + 0x18]
push ecx
call fcn.0040b8f9
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], str.Could_not_find_module_in_remote_process.
call fcn.0040680e
mov byte [esp + 0x4a8], 4
mov dword [esp + 0x14], vtable.std::runtime_error.0
mov byte [esp + 0x4a8], 0
push 0x424220
lea ecx, [esp + 0x18]
push ecx
call fcn.0040b8f9
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x41c91c
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], str.Could_not_get_handle_to_Kernel32.
call fcn.0040680e
mov byte [esp + 0x4a8], 7
mov dword [esp + 0x14], vtable.std::runtime_error.0
mov byte [esp + 0x4a8], 5
push 0x424220
lea eax, [esp + 0x18]
push eax
call fcn.0040b8f9
push str.FreeLibrary
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x41c969
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], str.Could_not_get_pointer_to_FreeLibrary.
call fcn.0040680e
mov byte [esp + 0x4a8], 8
mov dword [esp + 0x14], vtable.std::runtime_error.0
mov byte [esp + 0x4a8], 5
push 0x424220
lea edx, [esp + 0x18]
push edx
call fcn.0040b8f9
mov ecx, dword [esp + 0x48]
push 0
push 0
push ecx
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
mov dword [esp + 0x24], esi
mov bl, 9
mov byte [esp + 0x4a8], bl
test esi, esi
jne 0x41c9cd
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], str.Could_not_create_thread_in_remote_process.
call fcn.0040680e
mov byte [esp + 0x4a8], 0xa
mov dword [esp + 0x14], vtable.std::runtime_error.0
mov byte [esp + 0x4a8], bl
push 0x424220
lea eax, [esp + 0x18]
push eax
call fcn.0040b8f9
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x41ca22
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], str.Could_not_get_thread_exit_code.
call fcn.0040680e
mov byte [esp + 0x4a8], 0xb
mov dword [esp + 0x14], vtable.std::runtime_error.0
mov byte [esp + 0x4a8], bl
push 0x424220
lea eax, [esp + 0x18]
push eax
call fcn.0040b8f9
xor ebx, ebx
cmp dword [esp + 0x2c], ebx
jne 0x41ca47
push str.Call_to_FreeLibrary_in_remote_process_failed.
lea ecx, [esp + 0x18]
call fcn.004010b0
push 0x424220
lea ecx, [esp + 0x18]
push ecx
call fcn.0040b8f9
mov byte [esp + 0x4a8], 5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x4a8], bl
push edi
call esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x4a8], 0xffffffff
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x41ca84
push eax
call esi
mov dword [esp + 0x30], ebx
mov ecx, dword [esp + 0x4a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.004063c1
mov esp, ebp
pop ebp
ret 4