Function at 0x44076c
Capabilities:
Enumerate process modules

Disassembly:
push ebp
push ebx
mov edx, 0x115
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x440773
call fcn.005873a0
mov edx, dword [esp + 0x464]
lea ecx, [esp]
call fcn.004fc000
mov dword [section..data], 0x170005d
mov dword [section..data], 0x1700062
mov dword [esp + 4], 0
mov dword [section..data], 0x1700063
mov dword [esp + 8], 0
mov dword [section..data], 0x1700064
mov edx, 0x6bb5f6
lea ecx, [esp + 0xc]
call fcn.004fc008
mov dword [section..data], 0x1700067
mov dword [esp + 0x14], 0x400
mov dword [section..data], 0x170006f
mov dword [section..data], 0x1700071
mov dword [esp + 0x450], 1
mov dword [section..data], 0x1700072
push dword [esp + 0x460]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 8], eax
mov dword [section..data], 0x1700074
mov ebx, dword [esp + 8]
cmp ebx, 0xffffffff
je 0x440b80
mov dword [section..data], 0x1700076
lea ebp, [esp + 0x28]
mov dword [ebp], 0x428
mov dword [section..data], 0x1700078
lea eax, [esp + 0x28]
push eax
push dword [esp + 0xc]
call sub.KERNEL32.dll_Module32FirstW
and eax, eax
je 0x440876
xor eax, eax
jmp 0x44087b
mov eax, 1
and eax, eax
je 0x4409ac
mov dword [section..data], 0x1700079
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x170007a
mov ebx, dword [esp + 0x24]
cmp ebx, 0x12
jne 0x4408e7
mov dword [section..data], 0x170007b
push 3
mov eax, str.No_running_processes_detected
push eax
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.0043fbb5
mov dword [section..data], 0x170007d
jmp 0x4411d3
mov dword [section..data], 0x170007e
mov dword [section..data], 0x170007f
push edx
call fcn.00587290
pop edx
push eax
push 0
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.Module32First_failed__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6db8ba
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043f2a5
pop eax
mov edx, 0x6bdecc
push edx
call fcn.00587330
call fcn.00587380
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x1700080
mov dword [esp + 0x450], 0
mov dword [section..data], 0x1700081
jmp 0x4411d3
mov dword [section..data], 0x1700083
mov dword [section..data], 0x1700085
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
lea ebp, [esp + 0x38]
lea eax, [ebp + 0x20]
push eax
call fcn.005870b0
call fcn.004fc302
add dword [esp], edx
call fcn.00575d20
call fcn.00587380
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0xc]
call fcn.00575d20
call fcn.004fc330
mov edx, eax
pop ecx
push ecx
call fcn.004fc330
mov ecx, eax
call fcn.004fc340
je 0x440a72
mov dword [section..data], 0x1700086
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
lea ebp, [esp + 0x30]
lea eax, [ebp + 0x220]
push eax
call fcn.005870b0
lea eax, [esp + 0x10]
push eax
call fcn.005872c0
mov dword [section..data], 0x1700087
jmp 0x4411d3
mov dword [section..data], 0x1700088
mov dword [section..data], 0x170008a
lea eax, [esp + 0x28]
push eax
push dword [esp + 0xc]
call sub.KERNEL32.dll_Module32NextW
and eax, eax
je 0x440b71
mov dword [section..data], 0x170008b
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
lea ebp, [esp + 0x38]
lea eax, [ebp + 0x20]
push eax
call fcn.005870b0
call fcn.004fc302
add dword [esp], edx
call fcn.00575d20
call fcn.00587380
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0xc]
call fcn.00575d20
call fcn.004fc330
mov edx, eax
pop ecx
push ecx
call fcn.004fc330
mov ecx, eax
call fcn.004fc340
je 0x440b58
mov dword [section..data], 0x170008c
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
lea ebp, [esp + 0x30]
lea eax, [ebp + 0x220]
push eax
call fcn.005870b0
lea eax, [esp + 0x10]
push eax
call fcn.005872c0
mov dword [section..data], 0x170008d
jmp 0x4411d3
mov dword [section..data], 0x170008e
mov dword [section..data], 0x170008f
jmp 0x440a7c
mov dword [section..data], 0x1700092
jmp 0x4411bf
mov dword [section..data], 0x1700092
mov dword [section..data], 0x1700093
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x1700094
mov dword [esp + 8], 0
mov dword [section..data], 0x1700096
push edx
call fcn.00587290
pop edx
push eax
push 3
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.CreateToolhelp32Snapshot__failed____
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6db8ba
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043f2a5
pop eax
mov edx, str.___now_continue_with_OpenProcess_
push edx
call fcn.00587330
call fcn.00587380
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x1700098
push dword [esp + 0x460]
push 0
push 0x400
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + 0x18], eax
mov dword [section..data], 0x1700099
cmp dword [esp + 0x18], 0
je 0x440c75
xor eax, eax
jmp 0x440c7a
mov eax, 1
and eax, eax
je 0x440d46
mov dword [section..data], 0x170009a
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x170009b
push edx
call fcn.00587290
pop edx
push eax
push 0
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.OpenProcess_failed__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6db8ba
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043f2a5
pop eax
mov edx, 0x6bdecc
push edx
call fcn.00587330
call fcn.00587380
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x170009c
mov dword [esp + 0x450], 0xfffff7c9
mov dword [section..data], 0x170009d
jmp 0x4411d3
mov dword [section..data], 0x170009e
mov dword [section..data], 0x17000a0
mov eax, str.kernel32.dll
push eax
push 0xffffffff
call fcn.00572a50
mov dword [esp + 0x1c], eax
mov dword [section..data], 0x17000a1
cmp dword [esp + 0x1c], 0
je 0x440d83
xor eax, eax
jmp 0x440d88
mov eax, 1
and eax, eax
je 0x440e54
mov dword [section..data], 0x17000a2
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x17000a3
push edx
call fcn.00587290
pop edx
push eax
push 0
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.OpenLibrary_failed__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6db8ba
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043f2a5
pop eax
mov edx, 0x6bdecc
push edx
call fcn.00587330
call fcn.00587380
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x17000a4
mov dword [esp + 0x450], 0xfffff7c8
mov dword [section..data], 0x17000a5
jmp 0x4411d3
mov dword [section..data], 0x17000a6
mov dword [section..data], 0x17000a8
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x1c]
call fcn.00575d90
lea eax, [esp + 0x14]
push eax
call fcn.005872c0
mov dword [section..data], 0x17000a9
mov dword [section..data], 0x17000aa
mov eax, str.QueryFullProcessImageNameW
push eax
push dword [esp + 0x20]
call fcn.00572aa6
mov dword [esp + 0x20], eax
mov dword [section..data], 0x17000ab
jmp 0x440ee5
mov dword [section..data], 0x17000ad
mov dword [section..data], 0x17000af
cmp dword [esp + 0x20], 0
je 0x440f04
xor eax, eax
jmp 0x440f09
mov eax, 1
and eax, eax
je 0x440fd5
mov dword [section..data], 0x17000b0
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x17000b1
push edx
call fcn.00587290
pop edx
push eax
push 0
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.GetFunction_failed__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6db8ba
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043f2a5
pop eax
mov edx, 0x6bdecc
push edx
call fcn.00587330
call fcn.00587380
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x17000b2
mov dword [esp + 0x450], 0xfffff7c7
mov dword [section..data], 0x17000b3
jmp 0x4411d3
mov dword [section..data], 0x17000b4
mov dword [section..data], 0x17000b6
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
push 0
push dword [esp + 0x24]
call dword [esp + 0x30]
mov dword [esp + 4], eax
mov dword [section..data], 0x17000b8
cmp dword [esp + 4], 0
je 0x441019
xor eax, eax
jmp 0x44101e
mov eax, 1
and eax, eax
je 0x4410ea
mov dword [section..data], 0x17000b9
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x24], eax
mov dword [section..data], 0x17000ba
push edx
call fcn.00587290
pop edx
push eax
push 0
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.QueryFullProcessImageName_failed__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x38]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6db8ba
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x34]
call fcn.0043f2a5
pop eax
mov edx, 0x6bdecc
push edx
call fcn.00587330
call fcn.00587380
mov eax, str.WNPRC_GetFullPathFromPid
push eax
call fcn.004fc302
add dword [esp + 4], edx
call fcn.0043fbb5
call fcn.004fc320
mov dword [section..data], 0x17000bb
mov dword [esp + 0x450], 0xfffff7c6
mov dword [section..data], 0x17000bc
jmp 0x4411d3
mov dword [section..data], 0x17000bd
mov dword [section..data], 0x17000bf
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x20]
call fcn.00578e6d
call fcn.004fc302
add dword [esp], edx
call fcn.00575d20
call fcn.00587380
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0xc]
call fcn.00575d20
call fcn.004fc330
mov edx, eax
pop ecx
push ecx
call fcn.004fc330
mov ecx, eax
call fcn.004fc340
je 0x44118f
mov dword [section..data], 0x17000c0
mov edx, dword [esp + 0x10]
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587330
lea eax, [esp + 0x10]
push eax
call fcn.005872c0
mov dword [section..data], 0x17000c1
mov dword [section..data], 0x17000c3
push dword [esp + 0x1c]
call fcn.0057298f
mov dword [section..data], 0x17000c5
push dword [esp + 0x18]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x17000c7
mov dword [section..data], 0x17000c9
mov dword [section..data], 0x17000cb
cmp dword [esp + 8], 0
je 0x4411f7
mov dword [section..data], 0x17000cc
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x17000cd
mov dword [section..data], 0x17000cf
mov ebx, dword [esp + 0x450]
cmp ebx, 1
jne 0x441243
mov dword [section..data], 0x17000d0
mov edx, dword [esp + 0xc]
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587330
mov ebp, dword [esp + 0x46c]
lea eax, [ebp]
push eax
call fcn.005872c0
mov dword [section..data], 0x17000d1
mov dword [section..data], 0x17000d3
mov eax, dword [esp + 0x450]
jmp 0x44126c
push dword [esp + 0xc]
call fcn.00587410
push dword [esp + 0x10]
call fcn.00587410
push dword [esp]
call fcn.00587410
add esp, 0x454
pop ebx
pop ebp
ret 0xc