Function at 0x427ea8
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffec8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x1134], eax
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x112c], eax
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1124], eax
xor eax, eax
push ebp
push 0x428187
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x484dbc], 0
jne 0x427f11
mov dl, 1
mov eax, dword [0x41b4c8]
call fcn.00403af4
mov dword [0x484dbc], eax
jmp 0x427f60
mov eax, dword [0x484dbc]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x427f56
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, dword [0x484dbc]
call fcn.0041db68
mov esi, eax
cmp dword [esi + 0x108], 0
je 0x427f4b
mov eax, dword [esi + 0x108]
call fcn.00403b24
xor eax, eax
mov dword [esi + 0x108], eax
mov eax, esi
call fcn.00402a00
inc ebx
dec edi
jne 0x427f21
mov eax, dword [0x484dbc]
mov edx, dword [eax]
call dword [edx + 8]
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x428169
lea eax, [ebp - 8]
push eax
push 0x1000
lea eax, [ebp - 0x100c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.psapi.dll_EnumProcessModules
test eax, eax
je 0x428151
mov eax, dword [ebp - 8]
shr eax, 2
mov dword [ebp - 8], eax
mov edi, dword [ebp - 8]
dec edi
test edi, edi
jl 0x428151
inc edi
lea ebx, [ebp - 0x100c]
lea eax, [ebp - 0x1110]
xor ecx, ecx
mov edx, 0x104
call fcn.00403398
lea eax, [ebp - 0x111c]
xor ecx, ecx
mov edx, 0xc
call fcn.00403398
push 0x104
lea eax, [ebp - 0x1110]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.psapi.dll_GetModuleFileNameExA
test eax, eax
jbe 0x428147
push 0xc
lea eax, [ebp - 0x111c]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.psapi.dll_GetModuleInformation
test eax, eax
je 0x428147
mov eax, 0x10c
call fcn.004029e0
mov esi, eax
lea eax, [ebp - 0x1124]
lea edx, [ebp - 0x1110]
mov ecx, 0x104
call fcn.00404af8
mov eax, dword [ebp - 0x1124]
lea edx, [ebp - 0x1120]
call fcn.0040b160
mov edx, dword [ebp - 0x1120]
mov eax, esi
mov ecx, 0xff
call fcn.00404b24
mov eax, dword [ebp - 0x111c]
mov dword [esi + 0x100], eax
mov eax, dword [ebp - 0x1118]
mov dword [esi + 0x104], eax
lea eax, [ebp - 0x1130]
lea edx, [ebp - 0x1110]
mov ecx, 0x104
call fcn.00404af8
mov eax, dword [ebp - 0x1130]
lea edx, [ebp - 0x112c]
call fcn.0040a3c8
mov eax, dword [ebp - 0x112c]
lea edx, [ebp - 0x1128]
call fcn.0040b198
mov eax, dword [ebp - 0x1128]
mov edx, 0x4281a0
call fcn.00404c8c
je 0x428133
lea eax, [ebp - 0x1134]
lea edx, [ebp - 0x1110]
mov ecx, 0x104
call fcn.00404af8
mov edx, dword [ebp - 0x1134]
mov eax, dword [0x426eb8]
call fcn.0042790c
cmp edx, 0
jne 0x4280f6
cmp eax, 0
jbe 0x428133
jmp 0x4280f8
jle 0x428133
mov dl, 1
mov eax, dword [0x426eb8]
call fcn.00426f0c
mov dword [esi + 0x108], eax
lea eax, [ebp - 0x1138]
lea edx, [ebp - 0x1110]
mov ecx, 0x104
call fcn.00404af8
mov edx, dword [ebp - 0x1138]
mov eax, dword [esi + 0x108]
call fcn.00427b0c
jmp 0x42813b
xor eax, eax
mov dword [esi + 0x108], eax
mov edx, esi
mov eax, dword [0x484dbc]
call fcn.0041da0c
add ebx, 4
dec edi
jne 0x427fbc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, 0x427e80
mov eax, dword [0x484dbc]
call fcn.0041de58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42818e
lea eax, [ebp - 0x1138]
mov edx, 7
call fcn.004048b4
ret