Function at 0x4016c0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x214], 0
push 0x9c40
call fcn.0040263e
add esp, 4
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x208], 0
push 0x9c40
call fcn.0040263e
add esp, 4
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x20c], 0
lea edx, [ebp - 0x208]
push edx
push 0x9c40
mov eax, dword [ebp - 0x218]
push eax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x40197c
mov ecx, dword [ebp - 0x208]
shr ecx, 2
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x21c], 0
jmp 0x401784
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x208]
jae 0x40197c
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x218]
mov eax, dword [edx + ecx*4]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x401977
lea ecx, [ebp - 0x20c]
push ecx
push 0x9c40
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x228]
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x40196a
mov ecx, dword [ebp - 0x20c]
shr ecx, 2
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x224], 0
jmp 0x401817
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x20c]
jae 0x40196a
push 0
push 0x200
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax + edx*4]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x401965
mov eax, 1
shl eax, 6
mov cx, word [ebp + eax - 0x204]
mov word [ebp - 0x210], cx
movzx edx, word [ebp - 0x210]
cmp edx, 0x7277
je 0x4018a3
movzx eax, word [ebp - 0x210]
cmp eax, 0x7273
je 0x4018a3
movzx ecx, word [ebp - 0x210]
cmp ecx, 0x7268
jne 0x401965
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x214]
cmp eax, dword [edx]
jae 0x401959
mov ecx, dword [ebp - 0x214]
shl ecx, 4
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x21c]
mov esi, dword [ebp - 0x218]
mov eax, dword [esi + eax*4]
mov dword [edx + ecx], eax
mov ecx, dword [ebp - 0x214]
shl ecx, 4
mov edx, dword [ebp + 8]
mov ax, word [ebp - 0x210]
mov word [edx + ecx + 4], ax
movzx ecx, word [ebp - 0x210]
cmp ecx, 0x7277
jne 0x40191d
mov edx, 1
imul eax, edx, 0x42
mov ecx, dword [ebp + eax - 0x204]
mov edx, dword [ebp + eax - 0x200]
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], edx
jmp 0x401928
xorps xmm0, xmm0
movlpd qword [ebp - 0x23c], xmm0
mov eax, dword [ebp - 0x214]
shl eax, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x23c]
mov esi, dword [ebp - 0x238]
mov dword [ecx + eax + 8], edx
mov dword [ecx + eax + 0xc], esi
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
jmp 0x401963
mov dword [ebp - 0x234], 0
jmp 0x40196a
jmp 0x401808
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401775
mov edx, dword [ebp - 0x218]
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp - 0x22c]
push eax
call fcn.00402647
add esp, 4
cmp dword [ebp - 0x22c], 0
jne 0x4019ac
mov dword [ebp - 0x248], 0
jmp 0x4019c2
mov dword [ebp - 0x218], 0x8123
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x248], ecx
mov edx, dword [ebp - 0x220]
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x230]
push eax
call fcn.00402647
add esp, 4
cmp dword [ebp - 0x230], 0
jne 0x4019f2
mov dword [ebp - 0x24c], 0
jmp 0x401a08
mov dword [ebp - 0x220], 0x8123
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x214]
mov dword [edx], eax
mov eax, dword [ebp - 0x234]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004025ef
mov esp, ebp
pop ebp
ret