Function at 0x422038
Capabilities:
Enumerate process modules

Disassembly:
push 0x36c
mov eax, 0x4e7fac
call fcn.00483d44
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x36c], ebx
mov eax, dword [esi]
mov dword [esi + 4], eax
push dword [esi + 0x14]
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42206f
xor al, al
jmp 0x4222cd
push 0x220
lea eax, [ebp - 0x364]
push 0
push eax
call fcn.004857d0
add esp, 0xc
mov dword [ebp - 0x368], 0x224
lea eax, [ebp - 0x368]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
jne 0x4220aa
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x422068
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004857d0
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push dword [ebp - 0x34c]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
push 0x38
call fcn.00482b1b
pop ecx
mov dword [ebp - 0x374], eax
xor eax, eax
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x422113
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x144]
call fcn.00408b44
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x348]
or ebx, 1
mov dword [ebp - 0x118], 0xf
xor eax, eax
mov dword [ebp - 0x36c], ebx
mov dword [ebp - 0x12c], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x12c], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x422163
sub ecx, edx
lea eax, [ebp - 0x348]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.00408b44
push 2
pop eax
mov dword [ebp - 4], eax
or ebx, eax
mov ecx, dword [ebp - 0x374]
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x36c], ebx
push eax
push dword [ebp - 0x350]
push dword [ebp - 0x34c]
call fcn.00421be0
mov dword [ebp - 0x378], eax
test bl, 2
je 0x422227
mov eax, dword [ebp - 0x118]
and ebx, 0xfffffffd
cmp eax, 0x10
jb 0x42220f
mov ecx, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x370], ecx
cmp eax, 0x1000
jb 0x422206
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x370]
push eax
call fcn.00403c47
mov eax, dword [ebp - 0x36c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x370]
push eax
push ecx
call fcn.00482b0d
pop ecx
pop ecx
and dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
or dword [ebp - 4], 0xffffffff
test bl, 1
je 0x42229a
mov eax, dword [ebp - 0x130]
and ebx, 0xfffffffe
cmp eax, 0x10
jb 0x422282
mov ecx, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x36c], ecx
cmp eax, 0x1000
jb 0x422279
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x36c]
push eax
call fcn.00403c47
mov eax, dword [ebp - 0x370]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x36c]
push eax
push ecx
call fcn.00482b0d
pop ecx
pop ecx
and dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
lea eax, [ebp - 0x378]
mov ecx, esi
push eax
call fcn.00422b89
lea eax, [ebp - 0x368]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x4220aa
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
setne al
call fcn.00483cf3
ret