Function at 0x40ea50
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x4616e8
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47c748]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0x1c], 0
jne 0x40ea91
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xe0]
push ecx
jmp 0x40ea92
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x482768
mov ecx, 0x482774
mov edi, eax
call fcn.0040a580
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx - 0xc]
cmp eax, 4
jle 0x40eac5
lea edx, [esp + 0x2c]
push edx
mov ecx, 0x482774
call fcn.0040a580
push 0x4821f0
push edi
mov dword [0x4821f0], 0x428
call sub.KERNEL32.dll_Module32FirstW
or ebp, 0xffffffff
lea ecx, [ecx]
mov eax, 0x482210
lea edx, [eax + 2]
jmp 0x40eaf0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40eaf0
sub eax, edx
sar eax, 1
push eax
push 0x482210
mov ecx, 0x482770
call fcn.0040a600
mov edx, dword [0x482774]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40eb3a
push esi
mov ecx, 0x482774
call fcn.0040a470
mov edx, dword [0x482774]
lea eax, [esi + 1]
push eax
push edx
call fcn.004350a3
add esp, 8
test esi, esi
jl 0x40eca7
mov eax, dword [0x482774]
cmp esi, dword [eax - 8]
jg 0x40eca7
mov dword [eax - 0xc], esi
mov ecx, dword [0x482774]
mov word [ecx + esi*2], 0
mov edx, dword [0x482770]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40eb97
push esi
mov ecx, 0x482770
call fcn.0040a470
mov edx, dword [0x482770]
lea eax, [esi + 1]
push eax
push edx
call fcn.004350a3
add esp, 8
test esi, esi
jl 0x40eca7
mov eax, dword [0x482770]
cmp esi, dword [eax - 8]
jg 0x40eca7
mov dword [eax - 0xc], esi
mov ecx, dword [0x482770]
mov word [ecx + esi*2], 0
mov ecx, dword [0x482774]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x40ec6f
mov eax, dword [0x482770]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ec09
test dx, dx
je 0x40ec05
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ec09
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ebe3
xor eax, eax
jmp 0x40ec0d
sbb eax, eax
sbb eax, ebp
test eax, eax
sete al
test al, al
jne 0x40ec79
push 0x4821f0
push edi
mov dword [0x4821f0], 0x428
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x40eae0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x40ec57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
push 0x80004005
call fcn.0040a390
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x482204]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], ebp
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x40eca3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x40ec59
push 0x80070057
call fcn.0040a390
int3