Function at 0x404e96
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x644
push ebx
push esi
push edi
xor edi, edi
xor edx, edx
mov dword [0x411748], edi
call fcn.00409f3e
call fcn.004102c4
call fcn.0040390d
call fcn.004078bb
push dword [0x411a64]
xor ebx, ebx
lea eax, [esp + 0x24]
inc ebx
push eax
mov dword [0x412ed0], edi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.kernel32.dll_lstrcpyW]
mov esi, 0x401bd0
push esi
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.kernel32.dll_lstrcatW]
push esi
push ebx
push 0x4124d8
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esp + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x40502d
mov esi, 0x401be0
push esi
push ebx
call fcn.00407a4d
cmp eax, 4
je 0x404f36
call fcn.00404769
lea eax, [esp + 0x14]
push eax
push esi
push ebx
push 4
pop eax
call fcn.00407abd
mov esi, 0x401bf4
push esi
push ebx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edi
call fcn.00407a4d
cmp eax, 4
jne 0x404f5b
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
jmp 0x404f5f
mov dword [esp + 0x18], edi
push dword [esp + 0x18]
push edi
push 0x401c08
call fcn.00403d2b
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x18]
je 0x404f87
lea eax, [esp + 0x14]
push eax
push esi
push ebx
push 4
pop eax
call fcn.00407abd
push dword [esp + 0x10]
call fcn.0040d2af
mov esi, 0x401c10
push esi
push ebx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edi
call fcn.00407a4d
cmp eax, edi
je 0x404fc6
push eax
push dword [esp + 0x14]
call fcn.004076f2
test al, al
je 0x404fbd
push esi
push ebx
call fcn.00407b34
push dword [esp + 0x10]
call fcn.0040d2af
mov esi, 0x401c5c
push esi
push ebx
xor eax, eax
call fcn.00407a4d
cmp eax, 4
jne 0x404ff2
push 0x403e78
push edi
push edi
push 0x10000
call dword [0x411bac]
push esi
push ebx
call fcn.00407b34
mov esi, 0x401c70
push esi
push ebx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edi
call fcn.00407a4d
cmp eax, 4
jne 0x405024
mov eax, dword [esp + 0x10]
cmp dword [eax], edi
sete al
movzx eax, al
push eax
call fcn.00404c1f
push esi
push ebx
call fcn.00407b34
push dword [esp + 0x10]
call fcn.0040d2af
cmp dword [esp + 0x1c], edi
je 0x40503d
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x411ea4
mov dword [0x411ec0], edi
mov dword [0x411ebc], edi
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
push 0x411e8c
mov dword [0x411e80], edi
mov dword [0x411e7c], edi
mov dword [0x411e84], edi
mov dword [0x411e88], edi
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
push 0x411768
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov dword [0x411788], edi
call fcn.00405471
xor eax, eax
push 0x41174c
mov word [0x41178c], ax
mov dword [0x411784], edi
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
push dword [0x411c14]
mov dword [esp + 0x22c], 0x428
push 8
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4050fb
lea eax, [esp + 0x228]
push eax
push esi
call dword [sym.imp.kernel32.dll_Module32FirstW]
jmp 0x4050f7
push dword [esp + 0x244]
mov eax, 0x4114a8
call fcn.00406ae9
lea eax, [esp + 0x228]
push eax
push esi
call dword [sym.imp.kernel32.dll_Module32NextW]
test eax, eax
jne 0x4050d7
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret