Function at 0x407de0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x3c0
mov eax, edx
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a8], ecx
mov dword [ebp - 0x3a4], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x39c], edx
mov ecx, dword [0x4de47c]
mov ecx, dword [ecx]
xor ecx, ebp
mov dword [ebp - 0xc], ecx
mov eax, dword [eax]
mov dword [ebp - 0x3a0], eax
lea ecx, [ebp - 0x350]
call fcn.00408320
mov eax, dword [ebp - 0x39c]
mov ecx, dword [eax]
mov dword [ebp - 0x338], ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x334], eax
lea ecx, [ebp - 0x338]
add ecx, 8
lea eax, [ebp - 0x350]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call fcn.004a72a0
mov eax, dword [0x4aa77c]
mov dword [ebp - 0x318], eax
mov eax, dword [0x4aa780]
mov dword [ebp - 0x314], eax
mov eax, dword [0x4aa784]
mov dword [ebp - 0x310], eax
lea ecx, [ebp - 0x37c]
lea eax, [ebp - 0x338]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2c
call fcn.004a72a0
xor eax, eax
mov dword [esp], 0x18
mov dword [esp + 4], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x394], eax
mov ecx, 0xffffffff
cmp eax, ecx
je 0x407fe6
jmp 0x40807a
mov word [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0x37c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2c
call fcn.004a72a0
mov ecx, dword [ebp - 0x3a8]
lea eax, [ebp - 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x30
call fcn.004a72a0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
mov eax, dword [0x4de47c]
mov eax, dword [eax]
sub eax, ecx
jne 0x407f2c
jmp 0x407f31
call fcn.004a85b0
mov eax, dword [ebp - 0x3a4]
add esp, 0x3c0
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x2dc]
mov dword [esp], eax
mov dword [esp + 4], 0xaa
mov dword [esp + 8], 0x224
call fcn.004a6a40
mov ecx, dword [ebp - 0x398]
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0xb8], 0x4d430001
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], 0x224
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
lea eax, [ebp - 0xb8]
xor edx, edx
rol edi, 3
rol edi, 0xd
rol edi, 0x3d
rol edi, 0x33
xchg ebx, ebx
mov dword [ebp - 0x2dc], 0x224
lea eax, [ebp - 0x2dc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Module32First
sub esp, 8
cmp eax, 0
je 0x40808b
jmp 0x4080fb
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [ebp - 0x3ac]
mov word [ebp - 0x38e], ax
movzx edx, ax
call fcn.00408360
mov edx, dword [ebp - 0x39c]
mov word [ebp - 0x3ae], ax
lea ecx, [ebp - 0x37c]
add ecx, 0x20
call fcn.00408550
mov ax, word [ebp - 0x3ae]
mov ecx, dword [ebp - 0x3ac]
mov word [ebp - 0x2e0], ax
call fcn.00401c30
mov ecx, dword [ebp - 0x3a8]
lea eax, [ebp - 0x30c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x30
call fcn.004a72a0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
mov eax, dword [0x4de47c]
mov eax, dword [eax]
sub eax, ecx
jne 0x407f2c
jmp 0x40806a
mov eax, dword [ebp - 0x3a4]
add esp, 0x3c0
pop esi
pop edi
pop ebp
ret
jmp 0x407f41
mov byte [ebp - 0x37d], 1
jmp 0x40810d
mov ecx, dword [ebp - 0x398]
call fcn.00408610
mov edx, dword [ebp - 0x39c]
lea ecx, [ebp - 0x37c]
add ecx, 0x20
call fcn.00408550
mov ecx, dword [ebp - 0x3ac]
call fcn.00401c30
mov ecx, dword [ebp - 0x3a8]
lea eax, [0x4aa788]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x30
call fcn.004a72a0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
mov eax, dword [0x4de47c]
mov eax, dword [eax]
sub eax, ecx
jne 0x407f2c
jmp 0x4080eb
mov eax, dword [ebp - 0x3a4]
add esp, 0x3c0
pop esi
pop edi
pop ebp
ret
jmp 0x40807f
mov ecx, dword [ebp - 0x398]
call fcn.00408610
jmp 0x407eda
test byte [ebp - 0x37d], 1
jne 0x40811a
jmp 0x408150
jmp 0x40810d
mov eax, dword [ebp - 0x39c]
mov edx, dword [ebp - 0x3ac]
lea esi, [ebp - 0x37c]
add esi, 0x20
lea ecx, [ebp - 0xa0]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00408640
cmp word [ebp - 0x9c], 0
jne 0x408154
jmp 0x4081dd
jmp 0x4080fd
jmp 0x408118
mov ecx, dword [ebp - 0x398]
mov ax, word [ebp - 0x9c]
mov word [ebp - 0x3b0], ax
call fcn.00408610
mov edx, dword [ebp - 0x39c]
lea ecx, [ebp - 0x37c]
add ecx, 0x20
call fcn.00408550
mov ax, word [ebp - 0x3b0]
mov ecx, dword [ebp - 0x3ac]
mov word [ebp - 0x6c], ax
call fcn.00401c30
mov ecx, dword [ebp - 0x3a8]
lea eax, [ebp - 0x98]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x30
call fcn.004a72a0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
mov eax, dword [0x4de47c]
mov eax, dword [eax]
sub eax, ecx
jne 0x407f2c
jmp 0x4081cd
mov eax, dword [ebp - 0x3a4]
add esp, 0x3c0
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x39c]
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x3b4], ecx
mov dword [ebp - 0x38c], ecx
movsd xmm0, qword [eax]
movsd qword [ebp - 0x68], xmm0
movsd xmm0, qword [ebp - 0x68]
movsd qword [ebp - 0x60], xmm0
lea ecx, [ebp - 0x2bc]
call fcn.00408750
mov ecx, edx
mov edx, dword [ebp - 0x3ac]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x58], eax
mov esi, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
lea edi, [ebp - 0x60]
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call fcn.004087f0
cmp word [ebp - 0x48], 0
je 0x4082d6
jmp 0x4082f9
mov ecx, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x3b8]
mov edx, dword [ebp - 0x3bc]
mov dword [ebp - 0x388], eax
mov dword [ebp - 0x384], edx
mov esi, dword [ebp - 0x2c8]
mov dword [ecx], esi
mov esi, dword [ebp - 0x2c4]
mov dword [ecx + 4], esi
mov dword [ecx + 0xc], edx
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ecx + 0x10], eax
add ecx, 0x14
lea eax, [0x4aa7b8]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call fcn.004a72a0
mov ecx, dword [ebp - 0x398]
lea eax, [ebp - 0x2dc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Module32Next
sub esp, 8
cmp eax, 1
sete al
and al, 1
mov byte [ebp - 0x37d], al
jmp 0x408152
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3b8], ecx
mov dword [ebp - 0x3bc], eax
jmp 0x40824d
mov eax, dword [ebp - 0x3ac]
mov ecx, dword [ebp - 0x3a0]
mov dword [eax], ecx
xor eax, eax
mov ecx, 1
mov dword [ebp - 0x3b8], ecx
mov dword [ebp - 0x3bc], eax
jmp 0x40824d