Function at 0x4107f0
Capabilities:
Enumerate process modules
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7582
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1a84
call fcn.004aa8c0
mov eax, dword [0x524ee0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x1a54]
mov dword [ebp - 0x1a20], eax
call fcn.00444480
mov esi, dword [0x526340]
mov eax, esi
imul eax, esi
imul eax, esi
cdq
mov ecx, 0x15
idiv ecx
mov dword [ebp - 4], 0
cmp edx, 5
jne 0x410899
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x63]
mov esi, 4
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a7aa0
push eax
call fcn.004a98f0
add esp, 8
xor eax, eax
xor edi, edi
mov dword [ebp - 0x1a00], eax
mov dword [ebp - 0x1a04], eax
mov dword [ebp - 0x19fc], eax
mov dword [ebp - 0x19f8], edi
push 0x4e0a14
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00444a00
sub esp, 0x18
mov ecx, eax
push esp
call fcn.004451d0
lea eax, [ebp - 0x1a10]
push eax
call fcn.004512c0
add esp, 0x1c
push 0x4e0b20
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.00445a20
test al, al
je 0x410950
push 0x4e0b20
mov ecx, ebx
call fcn.00444a00
mov ecx, eax
call fcn.004459f0
test al, al
je 0x410950
push 0x4e0b20
mov ecx, ebx
call fcn.00444a00
mov ecx, eax
call fcn.004450d0
mov esi, eax
test esi, esi
je 0x410950
push 1
lea ecx, [ebp - 0x1a00]
call fcn.0040c350
mov eax, dword [ebp - 0x19fc]
test eax, eax
je 0x41093c
mov dword [eax], esi
add eax, 4
mov dword [ebp - 0x1a04], eax
mov dword [ebp - 0x19fc], eax
jmp 0x410d82
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x19f0], ebx
cmp ebx, 0xffffffff
jne 0x410a5f
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x19f4], eax
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x19f4]
push str.enumModules_CreateToolhelp32Snapshot_process__d
push eax
call fcn.00406040
add esp, 0xc
lea eax, [ebp - 0x19f4]
push eax
lea eax, [ebp - 0x1390]
push eax
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x1a64]
mov byte [ebp - 4], 5
call fcn.004443a0
push 0x4dfc64
lea ecx, [ebp - 0x1a54]
mov byte [ebp - 4], 6
call fcn.00444920
lea ecx, [ebp - 0x1a64]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x1a64]
mov byte [ebp - 4], 5
call fcn.00444690
cmp dword [ebp - 0x137c], 0x10
jb 0x410a0d
push dword [ebp - 0x1390]
call fcn.004a831e
add esp, 4
mov edx, dword [ebp - 0x19f4]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lea ecx, [edx + 0xc]
mov byte [ebp - 4], 3
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x410a33
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1a10]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410a56
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x411689
push 0x22c
lea eax, [ebp - 0x15bc]
push 0
push eax
call fcn.004a9c90
add esp, 0xc
lea eax, [ebp - 0x15bc]
push eax
push ebx
mov dword [ebp - 0x15bc], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4116c7
call fcn.004188c0
test al, al
jne 0x410ab0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea ecx, [ecx]
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x19ec], esi
lea eax, [ebp - 0x1598]
mov byte [ebp - 4], 7
test eax, 0xffff0000
jne 0x410af8
movzx ebx, ax
push 0
push ebx
call fcn.00403b10
add esp, 8
test eax, eax
je 0x410b29
push ebx
push eax
lea ecx, [ebp - 0x19ec]
call fcn.004074c0
jmp 0x410b23
lea ecx, [ebp - 0x1598]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410b01
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x1598]
push eax
lea ecx, [ebp - 0x19ec]
call fcn.00409670
mov esi, dword [ebp - 0x19ec]
mov ebx, dword [esi - 0xc]
mov byte [ebp - 4], 8
test ebx, ebx
jns 0x410b3e
push 0x80070057
call fcn.00404410
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x410b61
push ebx
lea ecx, [ebp - 0x19ec]
call fcn.004085d0
mov esi, dword [ebp - 0x19ec]
lea eax, [ebx + 1]
push eax
push esi
call fcn.004aa3c6
add esp, 8
cmp ebx, dword [esi - 8]
jg 0x410b34
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
call fcn.00450de0
test al, al
jne 0x410b95
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov eax, dword [ebp - 0x1a10]
cmp dword [eax - 0xc], 0
jl 0x410ce6
push esi
push eax
call fcn.004a9f2f
add esp, 8
test eax, eax
je 0x410ce6
sub eax, dword [ebp - 0x1a10]
sar eax, 1
js 0x410ce6
mov ecx, dword [ebp - 0x1a04]
mov edx, dword [ebp - 0x1a00]
lea eax, [ebp - 0x15b4]
cmp eax, ecx
jae 0x410c62
cmp edx, eax
ja 0x410c62
mov ebx, eax
sub ebx, edx
sar ebx, 2
cmp ecx, edi
jne 0x410c59
mov eax, edi
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x410c59
sub ecx, edx
sar ecx, 2
mov eax, 0x3fffffff
sub eax, ecx
cmp eax, 1
jae 0x410c15
push str.vector_T__too_long
call fcn.004a79f0
sub edi, dword [ebp - 0x1a00]
lea edx, [ecx + 1]
sar edi, 2
mov ecx, edi
shr ecx, 1
mov eax, 0x3fffffff
sub eax, ecx
cmp eax, edi
jae 0x410c34
xor edi, edi
jmp 0x410c36
add edi, ecx
cmp edi, edx
cmovb edi, edx
push edi
lea ecx, [ebp - 0x1a00]
call fcn.0040c2d0
mov edi, dword [ebp - 0x19f8]
mov ecx, dword [ebp - 0x19fc]
mov edx, dword [ebp - 0x1a00]
test ecx, ecx
je 0x410cd7
mov eax, dword [edx + ebx*4]
jmp 0x410cd5
cmp ecx, edi
jne 0x410ccb
mov eax, edi
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x410ccb
sub ecx, edx
sar ecx, 2
mov eax, 0x3fffffff
sub eax, ecx
cmp eax, 1
jae 0x410c8d
push str.vector_T__too_long
call fcn.004a79f0
sub edi, dword [ebp - 0x1a00]
lea edx, [ecx + 1]
sar edi, 2
mov ecx, edi
shr ecx, 1
mov eax, 0x3fffffff
sub eax, ecx
cmp eax, edi
jae 0x410cac
xor edi, edi
jmp 0x410cae
add edi, ecx
cmp edi, edx
cmovb edi, edx
push edi
lea ecx, [ebp - 0x1a00]
call fcn.0040c2d0
mov edi, dword [ebp - 0x19f8]
mov ecx, dword [ebp - 0x19fc]
test ecx, ecx
je 0x410cd7
mov eax, dword [ebp - 0x15b4]
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x19fc], ecx
mov dword [ebp - 0x1a04], ecx
add esi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410d04
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x19f0]
lea eax, [ebp - 0x15bc]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x410ab0
mov ecx, dword [0x526340]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x15
idiv ecx
cmp edx, 0xf
jne 0x410d5a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x526340]
mov edi, 7
test eax, eax
cmove ecx, edi
mov dword [0x526340], ecx
call fcn.00418910
test al, al
jne 0x410d75
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1a04]
mov esi, dword [0x526340]
or ebx, 0xffffffff
xor edx, edx
mov edi, dword [ebp - 0x1a00]
sub eax, edi
sar eax, 2
mov dword [ebp - 0x19f4], edx
cmp edx, eax
jae 0x411602
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x13
idiv ecx
cmp edx, 7
jne 0x410dfd
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x2f4]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a7aa0
add esp, 4
push eax
call fcn.004a98f0
add esp, 4
mov eax, dword [ebp - 0x19f4]
push dword [edi + eax*4]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x526340]
mov edi, eax
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 7
idiv ecx
mov dword [ebp - 0x1a08], edi
cmp edx, 2
jne 0x410e7a
push 0x28
call fcn.004a7aa0
add esp, 4
mov edi, eax
xor esi, esi
call fcn.004a96f9
add eax, dword [0x526340]
inc esi
mov dword [edi + esi*4 - 4], eax
cmp esi, 0xa
jl 0x410e48
mov eax, dword [edi + 0x24]
push edi
mov dword [0x526340], eax
call fcn.004a98f0
mov esi, dword [0x526340]
mov edi, dword [ebp - 0x1a08]
add esp, 4
test edi, edi
je 0x4115c6
push 0
lea ecx, [ebp - 0x1a44]
call fcn.00444480
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push eax
mov byte [ebp - 4], 0xc
call fcn.004a9c90
add esp, 0xc
lea eax, [ebp - 0x1014]
push 0x800
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
jne 0x410f4d
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1a08], eax
mov byte [ebp - 4], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1a08]
push str.enumModules_GetProcessImageFileName__d
push eax
call fcn.00406040
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1a08]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xc
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410f26
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1a44]
mov byte [ebp - 4], 3
call fcn.00444690
mov edx, dword [ebp - 0x19f4]
mov esi, dword [0x526340]
mov eax, dword [ebp - 0x1a04]
inc edx
jmp 0x410d8d
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x19ec], eax
lea eax, [ebp - 0x1014]
mov byte [ebp - 4], 0xe
test eax, 0xffff0000
jne 0x410f8b
movzx esi, ax
push 0
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x410fb6
push esi
push eax
lea ecx, [ebp - 0x19ec]
call fcn.004074c0
jmp 0x410fb6
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410f94
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x19ec]
call fcn.00409670
lea eax, [ebp - 0x19ec]
push eax
lea eax, [ebp - 0x1358]
push eax
mov byte [ebp - 4], 0xf
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x1a74]
mov byte [ebp - 4], 0x10
call fcn.004443a0
push str.process
lea ecx, [ebp - 0x1a44]
mov byte [ebp - 4], 0x11
call fcn.00444920
lea ecx, [ebp - 0x1a74]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x1a74]
mov byte [ebp - 4], 0x10
call fcn.00444690
cmp dword [ebp - 0x1344], 0x10
mov byte [ebp - 4], 0xf
jb 0x41102c
push dword [ebp - 0x1358]
call fcn.004a831e
add esp, 4
mov ebx, dword [ebp - 0x1a00]
mov esi, dword [ebp - 0x19f4]
lea ecx, [ebp - 0x1a94]
push dword [ebx + esi*4]
call fcn.004443e0
push 0x4e0b20
lea ecx, [ebp - 0x1a44]
mov byte [ebp - 4], 0x12
call fcn.00444920
lea ecx, [ebp - 0x1a94]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x1a94]
mov byte [ebp - 4], 0xf
call fcn.00444690
push 0
lea ecx, [ebp - 0x1a64]
call fcn.00444480
push dword [ebx + esi*4]
mov byte [ebp - 4], 0x13
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x1a0c], ebx
cmp ebx, 0xffffffff
jne 0x4111e2
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1a1c], eax
mov byte [ebp - 4], 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1a1c]
push str.enumModules_CreateToolhelp32Snapshot_moudules__d
push eax
call fcn.00406040
add esp, 0xc
lea eax, [ebp - 0x1a1c]
push eax
lea eax, [ebp - 0x1358]
push eax
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x1a84]
mov byte [ebp - 4], 0x15
call fcn.004443a0
push 0x4dfc64
lea ecx, [ebp - 0x1a44]
mov byte [ebp - 4], 0x16
call fcn.00444920
lea ecx, [ebp - 0x1a84]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x1a84]
mov byte [ebp - 4], 0x15
call fcn.00444690
cmp dword [ebp - 0x1344], 0x10
mov byte [ebp - 4], 0x14
jb 0x41114a
push dword [ebp - 0x1358]
call fcn.004a831e
add esp, 4
lea eax, [ebp - 0x1a44]
push eax
lea ecx, [ebp - 0x1a54]
call fcn.00444f60
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1a1c]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0x13
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x411189
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1a64]
mov byte [ebp - 4], 0xf
call fcn.00444690
mov edx, dword [ebp - 0x19ec]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xc
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4111bb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1a44]
mov byte [ebp - 4], 3
call fcn.00444690
mov edx, dword [ebp - 0x19f4]
mov esi, dword [0x526340]
mov eax, dword [ebp - 0x1a04]
inc edx
jmp 0x410d8d
lea eax, [ebp - 0x19e4]
push eax
push ebx
mov dword [ebp - 0x19e4], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x41146a
call fcn.00450de0
test al, al
jne 0x4112a3
xor eax, eax
mov dword [ebp - 0x1a18], eax
lea esi, [ebp - 0x1340]
lea esp, [esp]
xor ecx, ecx
mov dword [ebp - 0x1a34], ecx
mov dword [ebp - 0x19f0], esi
mov edi, edi
mov esi, dword [0x526340]
lea ebx, [ecx + 1]
lea ecx, [eax + 1]
mov eax, esi
cdq
idiv ecx
mov eax, esi
mov ecx, esi
sub ecx, dword [ebp - 0x1a18]
mov esi, dword [ebp - 0x19f0]
mov edi, edx
cdq
imul edi, ecx
idiv ebx
add edi, eax
sub edi, dword [ebp - 0x1a34]
push edi
push 0x4dfc48
call fcn.004aa80e
mov eax, dword [ebp - 0x1a18]
mov ecx, ebx
add esi, 4
add esp, 8
mov dword [ebp - 0x1a34], ecx
mov dword [ebp - 0x19f0], esi
cmp ecx, 0x1d
jl 0x411230
inc eax
mov dword [ebp - 0x1a18], eax
cmp eax, 7
jl 0x411220
mov ebx, dword [ebp - 0x1a0c]
mov edi, dword [ebp - 0x1a08]
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x814], ax
lea eax, [ebp - 0x812]
push eax
call fcn.004a9c90
add esp, 0xc
call fcn.00418970
push 0x800
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x19c8]
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
jne 0x411322
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x19f0], eax
mov byte [ebp - 4], 0x17
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x19f0]
push str.enumModules_GetModuleFileNameEx__d
push eax
call fcn.00406040
mov edx, dword [ebp - 0x19f0]
add esp, 0xc
jmp 0x411432
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1a14], eax
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 0x18
test eax, 0xffff0000
jne 0x411360
movzx esi, ax
push 0
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x411385
push esi
push eax
lea ecx, [ebp - 0x1a14]
call fcn.004074c0
jmp 0x411385
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411363
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x1a14]
call fcn.00409670
lea eax, [ebp - 0x1a14]
push eax
lea eax, [ebp - 0x1358]
push eax
mov byte [ebp - 4], 0x19
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x1388]
mov byte [ebp - 4], 0x1a
call fcn.004443a0
push eax
lea ecx, [ebp - 0x1a64]
mov byte [ebp - 4], 0x1b
call fcn.00444f60
lea ecx, [ebp - 0x1388]
mov byte [ebp - 4], 0x1a
call fcn.00444690
cmp dword [ebp - 0x1344], 0x10
mov byte [ebp - 4], 0x19
jb 0x4113e9
push dword [ebp - 0x1358]
call fcn.004a831e
add esp, 4
call fcn.004188c0
test al, al
jne 0x41142c
push 0x28
call fcn.004a7aa0
add esp, 4
mov edi, eax
xor esi, esi
call fcn.004a96f9
add eax, dword [0x526340]
inc esi
mov dword [edi + esi*4 - 4], eax
cmp esi, 0xa
jl 0x411400
mov eax, dword [edi + 0x24]
push edi
mov dword [0x526340], eax
call fcn.004a98f0
mov edi, dword [ebp - 0x1a08]
add esp, 4
mov edx, dword [ebp - 0x1a14]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
mov byte [ebp - 4], 0x13
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x411450
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x19e4]
push eax
push ebx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x4112a3
jmp 0x411531
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x19e8], eax
mov byte [ebp - 4], 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x19e8]
push str.enumModules_CreateToolhelp32Snapshot_moudules__d
push eax
call fcn.00406040
add esp, 0xc
lea eax, [ebp - 0x19e8]
push eax
lea eax, [ebp - 0x1358]
push eax
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x1a30]
mov byte [ebp - 4], 0x1d
call fcn.004443a0
push 0x4dfc64
lea ecx, [ebp - 0x1a44]
mov byte [ebp - 4], 0x1e
call fcn.00444920
lea ecx, [ebp - 0x1a30]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x1a30]
mov byte [ebp - 4], 0x1d
call fcn.00444690
cmp dword [ebp - 0x1344], 0x10
jb 0x41150d
push dword [ebp - 0x1358]
call fcn.004a831e
add esp, 4
mov edx, dword [ebp - 0x19e8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x13
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x411531
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1a64]
call fcn.00445dd0
test eax, eax
je 0x41155e
push str.modules
lea ecx, [ebp - 0x1a44]
call fcn.00444920
lea ecx, [ebp - 0x1a64]
push ecx
mov ecx, eax
call fcn.00444730
lea eax, [ebp - 0x1a44]
push eax
lea ecx, [ebp - 0x1a54]
call fcn.00444f60
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push edi
call ebx
lea ecx, [ebp - 0x1a64]
mov byte [ebp - 4], 0xf
call fcn.00444690
mov edx, dword [ebp - 0x19ec]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0xc
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4115b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1a44]
mov byte [ebp - 4], 3
call fcn.00444690
mov esi, dword [0x526340]
call fcn.004187d0
test al, al
jne 0x4115f0
mov edx, 1
mov eax, edx
mov ecx, 0x71
jmp 0x4115e0
dec ecx
lea esi, [eax + edx]
lea edx, [eax]
mov eax, esi
jns 0x4115e0
mov dword [0x526340], esi
mov edx, dword [ebp - 0x19f4]
mov eax, dword [ebp - 0x1a04]
inc edx
jmp 0x410d8d
lea ecx, [ebp - 0x1a54]
call fcn.00445410
test al, al
je 0x411652
push str.empty
lea ecx, [ebp - 0x1a30]
call fcn.00444440
push 0x4dfc64
lea ecx, [ebp - 0x1a54]
mov byte [ebp - 4], 0x1f
call fcn.00444920
lea ecx, [ebp - 0x1a30]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x1a30]
mov byte [ebp - 4], 3
call fcn.00444690
mov edx, dword [ebp - 0x1a10]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x411675
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x411682
push edi
call fcn.004a831e
add esp, 4
mov dword [ebp - 4], 0
call fcn.004188e0
test al, al
jne 0x411860
mov esi, dword [0x526340]
test esi, esi
je 0x411860
mov ecx, esi
and ecx, 0x80000001
jns 0x4116b3
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x41181a
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x411821
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x19e8], eax
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x19e8]
push str.enumModules_Process32First__d
push eax
call fcn.00406040
add esp, 0xc
lea eax, [ebp - 0x19e8]
push eax
lea eax, [ebp - 0x1358]
push eax
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x1a30]
mov byte [ebp - 4], 0xa
call fcn.004443a0
push 0x4dfc64
lea ecx, [ebp - 0x1a54]
mov byte [ebp - 4], 0xb
call fcn.00444920
lea ecx, [ebp - 0x1a30]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x1a30]
mov byte [ebp - 4], 0xa
call fcn.00444690
cmp dword [ebp - 0x1344], 0x10
jb 0x41176a
push dword [ebp - 0x1358]
call fcn.004a831e
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x19e8]
jmp 0x410a13
lea esi, [esi*2 + 1]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*2]
sub ecx, eax
mov dword [0x526340], esi
sub ecx, 0
je 0x41184b
sub ecx, 2
je 0x41184e
dec ecx
je 0x41184f
jmp 0x411858
add esi, 2
inc esi
add esi, 2
mov dword [0x526340], esi
test esi, esi
jne 0x4116a4
lea ecx, [ebp - 0x1378]
call fcn.004465d0
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
mov byte [ebp - 4], 0x24
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x19e8], esi
lea eax, [ebp - 0x1a54]
push eax
lea eax, [ebp - 0x1358]
push eax
lea ecx, [ebp - 0x1378]
mov byte [ebp - 4], 0x25
call fcn.00449500
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x26
jb 0x4118b0
mov edx, dword [edx]
sub esp, 0x18
mov edi, esp
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp byte [edx], 0
jne 0x4118cf
xor ecx, ecx
jmp 0x4118dd
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4118d4
sub ecx, ebx
push ecx
push edx
mov ecx, edi
call fcn.00401460
lea eax, [ebp - 0x1a0c]
push eax
call fcn.004512c0
add esp, 0x1c
mov eax, dword [eax]
lea ebx, [esi - 0x10]
lea edi, [eax - 0x10]
mov byte [ebp - 4], 0x27
cmp edi, ebx
je 0x4119b2
cmp dword [ebx + 0xc], 0
jl 0x41199d
mov ecx, dword [edi]
cmp ecx, dword [ebx]
jne 0x41199d
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x41193e
cmp ecx, dword [edi]
jne 0x41193e
mov esi, edi
mov ecx, 1
lock xadd dword [eax], ecx
jmp 0x41197b
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov esi, eax
test esi, esi
jne 0x411952
call fcn.00409970
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.004a98f5
add esp, 0x10
or eax, 0xffffffff
lea ecx, [ebx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x411992
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0x10
mov dword [ebp - 0x19e8], esi
jmp 0x4119b2
push dword [eax - 0xc]
lea ecx, [ebp - 0x19e8]
push eax
call fcn.00409670
mov esi, dword [ebp - 0x19e8]
mov edx, dword [ebp - 0x1a0c]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0x26
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4119d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x1344], 0x10
mov byte [ebp - 4], 0x25
jb 0x4119f3
push dword [ebp - 0x1358]
call fcn.004a831e
add esp, 4
mov edi, dword [ebp - 0x1a20]
mov eax, 8
mov word [edi], ax
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x411a14
call fcn.00409970
mov dword [edi + 8], eax
mov edi, dword [0x526340]
lea ecx, [edi + 1]
lea eax, [edi + 2]
imul eax, ecx
imul eax, edi
cdq
mov ecx, 9
idiv ecx
cmp edx, 1
jne 0x411a3d
dec edi
mov dword [0x526340], edi
add esi, 0xfffffff0
mov byte [ebp - 4], 0x24
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x411a58
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x1360], 0x10
mov byte [ebp - 4], 0
mov dword [ebp - 0x1378], 0x4dfc5c
jb 0x411a7d
push dword [ebp - 0x1374]
call fcn.004a831e
add esp, 4
lea ecx, [ebp - 0x1378]
mov dword [ebp - 0x1360], 0xf
mov dword [ebp - 0x1364], 0
mov byte [ebp - 0x1374], 0
call fcn.004466d0
lea ecx, [ebp - 0x1a54]
mov dword [ebp - 4], 0xffffffff
call fcn.00444690
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a8b24
mov esp, ebp
pop ebp
ret