Function at 0x1000252a
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
push edi
push edi
push dword [ebp + 8]
call sub.KERNEL32.dll_K32EnumProcessModules
mov dword [ebp - 0x10], eax
call fcn.100039a4
movsx ebx, al
call fcn.100039a1
movsx ecx, al
imul ebx, ecx
call fcn.100039ad
movsx esi, al
xor edx, edx
movsx eax, byte [0x1000c004]
imul ecx, ebx, 6
mov dword [ebp - 4], esi
add ecx, esi
add eax, ecx
movsx ecx, byte [0x1000c003]
div ecx
movsx ecx, byte [section..data]
sub eax, ecx
je 0x100025fa
cmp dword [ebp - 0x10], edi
je 0x100025a5
cmp dword [ebp - 8], edi
je 0x100025a5
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jmp 0x100025ae
mov dword [ebp - 0xc], 1
mov ecx, edi
movsx eax, byte [0x1000c004]
imul edx, ebx, 7
add eax, edx
mov dword [ebp - 0x10], edx
add eax, esi
xor edx, edx
movsx esi, byte [0x1000c003]
div esi
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov esi, eax
call fcn.10006df0
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10004e73
pop ecx
pop ecx
movsx ecx, byte [section..data]
sub esi, ecx
imul eax, esi
test eax, eax
jne 0x10002735
jmp 0x10002600
imul eax, ebx, 7
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
xor edx, edx
movsx eax, byte [0x1000c004]
add eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
movsx ecx, byte [0x1000c003]
div ecx
movsx ecx, byte [section..data]
mov dword [ebp - 0xc], esi
sub eax, ecx
je 0x100026a6
test esi, esi
jne 0x1000263f
xor ecx, ecx
mov dword [ebp - 0x10], edi
inc ecx
jmp 0x10002650
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
movsx eax, byte [0x1000c004]
xor edx, edx
add eax, dword [ebp - 4]
movsx esi, byte [0x1000c003]
lea eax, [eax + ebx*8]
div esi
mov edx, dword [ebp - 0x10]
mov esi, eax
call fcn.10006df0
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10004e73
pop ecx
pop ecx
movsx ecx, byte [section..data]
sub esi, ecx
imul eax, esi
test eax, eax
je 0x100026a3
push str.____Error_allocating_memory_to_store_process_modules_handles_n
call fcn.10006b19
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push dword [ebp + 8]
call sub.KERNEL32.dll_K32EnumProcessModules
movsx ecx, byte [0x1000c004]
xor edx, edx
add ecx, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [ecx + ebx*4]
movsx ecx, byte [0x1000c003]
div ecx
movsx ecx, byte [section..data]
sub eax, ecx
je 0x10002742
cmp dword [ebp - 0x10], edi
jne 0x100026e6
xor ecx, ecx
inc ecx
jmp 0x100026f4
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
movsx eax, byte [0x1000c004]
xor edx, edx
imul esi, ebx, 9
add esi, dword [ebp - 4]
add eax, esi
movsx esi, byte [0x1000c003]
div esi
mov edx, edi
mov esi, eax
call fcn.10006df0
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10004e73
pop ecx
pop ecx
movsx ecx, byte [section..data]
sub esi, ecx
imul eax, esi
test eax, eax
je 0x1000273f
push str.____Error_enumerating_process_modules_n
jmp 0x10002695
mov esi, dword [ebp - 0xc]
mov edi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
movsx eax, byte [0x1000c004]
xor edx, edx
imul ecx, ebx, 0xa
add ecx, dword [ebp - 4]
add eax, ecx
movsx ecx, byte [0x1000c003]
div ecx
movsx ecx, byte [section..data]
sub eax, ecx
push ecx
push ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10008ba0]
movsd qword [esp], xmm0
call fcn.10004e73
pop ecx
pop ecx
test eax, eax
jle 0x10002796
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret