Function at 0x51b4c0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a166d
mov eax, dword fs:[0]
push eax
mov eax, 0x8c4c
call fcn.005604e0
mov eax, dword [0x60a070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x8c40], ebx
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov byte [ebp - 0x8c31], 0
cmp esi, edi
je 0x51b51e
nop word [eax + eax]
mov ecx, esi
call fcn.00463a80
add esi, 0x4c
cmp esi, edi
jne 0x51b510
mov eax, dword [ebx]
mov cl, 1
mov dword [ebx + 4], eax
call fcn.0051b3f0
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
mov dword [ebp - 0x89fc], 0
mov byte [ebp - 0x8c38], 0
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x6153fc], eax
test eax, eax
je 0x51b57f
lea ecx, [ebp - 0x89fc]
push ecx
call eax
mov ecx, dword [ebp - 0x8c38]
test eax, eax
movzx ecx, cl
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x8c38], ecx
push 0
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x8c3c], esi
cmp esi, 0xffffffff
je 0x51bb2b
push 0x228
lea eax, [ebp - 0x8c2c]
push 0
push eax
call fcn.00562b20
add esp, 0xc
mov dword [ebp - 0x8c30], 0x22c
lea eax, [ebp - 0x8c30]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x51bb23
mov byte [ebp - 0x8c31], 1
nop dword [eax]
push dword [ebp - 0x8c28]
push 0
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
mov dword [ebp - 0x8930], 0
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x892c], eax
mov word [ebp - 0x8940], cx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x88f4], ecx
test edi, edi
je 0x51bac6
lea eax, [ebp - 0x8c0c]
push str.rundll32.exe
push eax
call fcn.0057d171
add esp, 8
test eax, eax
jne 0x51b81b
lea eax, [ebp - 0x88f4]
push eax
push 0x7d00
lea eax, [ebp - 0x88f0]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x51b81b
xor esi, esi
test dword [ebp - 0x88f4], 0xfffffffc
jbe 0x51b815
push 0x3e8
lea eax, [ebp - 0xbf0]
push eax
push dword [ebp + esi*4 - 0x88f0]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
xor eax, eax
mov dword [ebp - 0x8944], 7
mov dword [ebp - 0x8948], 0
mov word [ebp - 0x8958], ax
cmp word [ebp - 0xbf0], ax
je 0x51b6cf
lea eax, [ebp - 0xbf0]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x51b6c0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0xbf0]
push eax
lea ecx, [ebp - 0x8958]
call fcn.00413c10
push 0xa
push 0
push str.VersionCue
lea ecx, [ebp - 0x8958]
mov byte [ebp - 4], 1
call fcn.0041dd80
cmp eax, 0xffffffff
je 0x51b7e1
push 0x1d
push str.Adobe_Version_Cue_Preferences
lea ecx, [ebp - 0x8940]
call fcn.00413c10
xor eax, eax
mov dword [ebp - 0x89e0], 7
mov dword [ebp - 0x89e4], 0
mov word [ebp - 0x89f4], ax
mov dword [ebp - 0x89c8], 7
mov dword [ebp - 0x89cc], eax
mov word [ebp - 0x89dc], ax
mov dword [ebp - 0x89b0], 7
mov dword [ebp - 0x89b4], eax
mov word [ebp - 0x89c4], ax
mov byte [ebp - 4], 2
cmp word [ebp - 0xbf0], 0
mov eax, dword [ebp - 0x8c28]
mov dword [ebp - 0x89f8], eax
jne 0x51b77e
xor ecx, ecx
jmp 0x51b796
lea ecx, [ebp - 0xbf0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x51b787
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xbf0]
push eax
lea ecx, [ebp - 0x89f4]
call fcn.00413c10
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x8940]
push eax
lea ecx, [ebp - 0x89dc]
call fcn.00414130
lea eax, [ebp - 0x89f8]
mov ecx, ebx
push eax
call fcn.0051c5a0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x89f8]
xor edi, edi
call fcn.00463a80
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x8944]
cmp eax, 8
jb 0x51b803
inc eax
lea ecx, [ebp - 0x8958]
push eax
push dword [ebp - 0x8958]
call fcn.00414580
mov eax, dword [ebp - 0x88f4]
inc esi
shr eax, 2
cmp esi, eax
jb 0x51b674
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test edi, edi
je 0x51bac0
lea eax, [ebp - 0x88f8]
mov dword [ebp - 0x88f8], 0x104
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_QueryFullProcessImageNameW]
test eax, eax
je 0x51babd
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.00576df2
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
xor eax, eax
mov dword [ebp - 0x8914], 7
mov dword [ebp - 0x8918], 0
mov word [ebp - 0x8928], ax
mov dword [ebp - 0x88fc], 7
mov dword [ebp - 0x8900], eax
mov word [ebp - 0x8910], ax
mov byte [ebp - 4], 4
cmp word [ebp - 0x420], ax
jne 0x51b8b9
xor ecx, ecx
jmp 0x51b8d1
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x51b8c2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x8928]
call fcn.00413c10
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x8c58]
call fcn.00413890
lea edx, [ebp - 0x8910]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8c58]
call fcn.005274c0
test al, al
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x8c44]
sete bl
cmp eax, 8
jb 0x51b932
inc eax
lea ecx, [ebp - 0x8c58]
push eax
push dword [ebp - 0x8c58]
call fcn.00414580
xor eax, eax
mov dword [ebp - 0x8c44], 7
mov dword [ebp - 0x8c48], 0
mov word [ebp - 0x8c58], ax
test bl, bl
je 0x51b968
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x8928]
push eax
lea ecx, [ebp - 0x8910]
call fcn.00414130
xor eax, eax
mov dword [ebp - 0x8990], 7
mov dword [ebp - 0x8994], 0
mov word [ebp - 0x89a4], ax
mov dword [ebp - 0x8978], 7
mov dword [ebp - 0x897c], eax
mov word [ebp - 0x898c], ax
mov dword [ebp - 0x8960], 7
mov dword [ebp - 0x8964], eax
mov word [ebp - 0x8974], ax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x89a4]
mov eax, dword [ebp - 0x8c28]
push 0xffffffffffffffff
mov dword [ebp - 0x89a8], eax
lea eax, [ebp - 0x8928]
push 0
push eax
call fcn.00414130
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x8910]
push eax
lea ecx, [ebp - 0x898c]
call fcn.00414130
cmp word [ebp - 0x218], 0
jne 0x51b9fd
xor ecx, ecx
jmp 0x51ba15
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x51ba06
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x8974]
call fcn.00413c10
mov ebx, dword [ebp - 0x8c40]
lea eax, [ebp - 0x89a8]
push eax
mov ecx, ebx
call fcn.0051c5a0
lea ecx, [ebp - 0x89a8]
call fcn.00463a80
mov eax, dword [ebp - 0x88fc]
cmp eax, 8
jb 0x51ba65
inc eax
lea ecx, [ebp - 0x8910]
push eax
push dword [ebp - 0x8910]
call fcn.00414580
xor eax, eax
mov dword [ebp - 0x88fc], 7
mov word [ebp - 0x8910], ax
mov eax, dword [ebp - 0x8914]
mov dword [ebp - 0x8900], 0
cmp eax, 8
jb 0x51baa0
inc eax
lea ecx, [ebp - 0x8928]
push eax
push dword [ebp - 0x8928]
call fcn.00414580
xor eax, eax
mov dword [ebp - 0x8914], 7
mov dword [ebp - 0x8918], 0
mov word [ebp - 0x8928], ax
push edi
call esi
mov eax, dword [ebp - 0x892c]
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x51bae5
inc eax
lea ecx, [ebp - 0x8940]
push eax
push dword [ebp - 0x8940]
call fcn.00414580
xor eax, eax
mov dword [ebp - 0x892c], 7
mov word [ebp - 0x8940], ax
lea eax, [ebp - 0x8c30]
push eax
push dword [ebp - 0x8c3c]
mov dword [ebp - 0x8930], 0
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x51b5e0
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push dword [ebp - 0x8c3c]
call esi
cmp byte [ebp - 0x8c38], 0
je 0x51bb59
mov esi, dword [ebp - 0x89fc]
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x615404], eax
test eax, eax
je 0x51bb59
push esi
call eax
xor cl, cl
call fcn.0051b3f0
mov al, byte [ebp - 0x8c31]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055eeb4
mov esp, ebp
pop ebp
ret