Function at 0x441020
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4887c8
mov eax, dword fs:[0]
push eax
mov eax, 0x11c8
call fcn.00480420
mov eax, dword [0x4c0e0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x11d0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x11d4], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x441083
xor eax, eax
jmp 0x441258
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x11c0]
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AFilePath::constructor_char_const__]
lea ecx, [ebp - 0x11c4]
mov dword [ebp - 4], 0
push ecx
mov ecx, eax
call dword [sym.imp.FSUTIL.dll_public:_class_AString___thiscall_AFilePath::GetFullPath_void_]
lea edx, [ebp - 0x218]
mov ecx, dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x4410b4
lea ecx, [ebp - 0x11c4]
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AString::destructor_void_]
lea ecx, [ebp - 0x11c0]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AFilePath::destructor_void_]
lea eax, [ebp - 0x11bc]
mov dword [ebp - 0x11bc], 0
push eax
push 0xfa0
lea eax, [ebp - 0x11b8]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x44107c
shr dword [ebp - 0x11bc], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x11bc]
mov edx, eax
xor esi, esi
mov dword [ebp - 0x11c0], edx
xor edi, edi
test ecx, ecx
je 0x441240
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp + edi*4 - 0x11b8]
cmp edx, eax
je 0x441237
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x44122b
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
push ebx
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x11cc]
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AFilePath::constructor_char_const__]
lea ecx, [ebp - 0x11c8]
mov dword [ebp - 4], 1
push ecx
mov ecx, eax
call dword [sym.imp.FSUTIL.dll_public:_class_AString___thiscall_AFilePath::GetFullPath_void_]
mov edx, dword [eax]
lea eax, [ebp - 0x114]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [eax], cl
lea eax, [eax + 1]
test cl, cl
jne 0x4411c2
lea ecx, [ebp - 0x11c8]
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AString::destructor_void_]
lea ecx, [ebp - 0x11cc]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AFilePath::destructor_void_]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x44121f
inc esi
cmp esi, 1
jne 0x44121f
mov ecx, dword [ebp - 0x11d0]
mov eax, dword [ebp + edi*4 - 0x11b8]
mov dword [ecx], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 2
je 0x441240
mov ecx, dword [ebp - 0x11bc]
mov edx, dword [ebp - 0x11c0]
inc edi
cmp edi, ecx
jb 0x441140
mov ecx, dword [ebp - 0x11d4]
xor eax, eax
cmp esi, 2
sete al
mov dword [ecx], eax
xor eax, eax
cmp esi, 1
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047ff18
mov esp, ebp
pop ebp
ret