Function at 0x100306b0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x101c7780
push 0x100d5830
mov eax, dword fs:[0]
push eax
add esp, 0xfffffdcc
push ebx
push esi
push edi
lea edi, [ebp - 0x244]
mov ecx, 0x8b
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101ca9c4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100010ff
test eax, eax
je 0x10030a97
mov esi, esp
push str.NtWow64QueryInformationProcess64
mov edi, esp
push 0x10192bd8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, esp
call fcn.1000318e
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1000318e
mov dword [ebp - 0x110], eax
mov esi, esp
push str.NtWow64ReadVirtualMemory64
mov edi, esp
push 0x10192bd8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, esp
call fcn.1000318e
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1000318e
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x110], 0
je 0x10030a92
cmp dword [ebp - 0x11c], 0
je 0x10030a92
mov esi, esp
push 0
push 0x30
lea eax, [ebp - 0x74]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x110]
cmp esi, esp
call fcn.1000318e
test eax, eax
je 0x100307bf
jmp 0x10030c23
push 8
mov eax, 1
shl eax, 3
lea ecx, [ebp + eax - 0x74]
push ecx
lea edx, [ebp - 0xf4]
push edx
call fcn.100026da
add esp, 0xc
mov esi, esp
push 0
push 0
push 8
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0xf4]
add ecx, 0x18
mov edx, dword [ebp - 0xf0]
adc edx, 0
push edx
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x11c]
cmp esi, esp
call fcn.1000318e
test eax, eax
je 0x10030817
jmp 0x10030c23
mov esi, esp
push 0
push 0
push 8
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0xf4]
add ecx, 0x18
mov edx, dword [ebp - 0xf0]
adc edx, 0
push edx
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x11c]
cmp esi, esp
call fcn.1000318e
test eax, eax
jne 0x10030a92
push 8
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x74]
push edx
lea eax, [ebp - 0xf4]
push eax
call fcn.100026da
add esp, 0xc
mov esi, esp
push 0
push 0
push 8
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0xf4]
add ecx, 0x10
mov edx, dword [ebp - 0xf0]
adc edx, 0
push edx
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x11c]
cmp esi, esp
call fcn.1000318e
test eax, eax
jne 0x10030a92
push 8
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x74]
push edx
lea eax, [ebp - 0xf4]
push eax
call fcn.100026da
add esp, 0xc
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0xf0]
mov dword [ebp - 0x100], ecx
mov byte [ebp - 0x125], 0
mov esi, esp
push 0
push 0
push 0x68
lea eax, [ebp - 0xe4]
push eax
mov ecx, dword [ebp - 0xf0]
push ecx
mov edx, dword [ebp - 0xf4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x11c]
cmp esi, esp
call fcn.1000318e
test eax, eax
jne 0x10030a6c
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x104]
jne 0x10030974
mov ecx, dword [ebp - 0xf0]
cmp ecx, dword [ebp - 0x100]
jne 0x10030974
push 8
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0xf4]
push ecx
call fcn.100026da
add esp, 0xc
push 8
mov eax, 1
imul ecx, eax, 0x30
lea edx, [ebp + ecx - 0xe4]
push edx
lea eax, [ebp - 0x138]
push eax
call fcn.100026da
add esp, 0xc
jmp 0x10030a6e
push 8
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0xf4]
push ecx
call fcn.100026da
add esp, 0xc
push 8
mov eax, 1
imul ecx, eax, 0x30
lea edx, [ebp + ecx - 0xe4]
push edx
lea eax, [ebp - 0x138]
push eax
call fcn.100026da
add esp, 0xc
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x144], 0
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x138]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10002842
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
je 0x10030a39
cmp dword [ebp - 0x144], 0
je 0x10030a39
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x138]
push edx
push 1
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x150]
push eax
call fcn.1000191f
mov dword [ebp - 4], 0xfffffffe
jmp 0x10030a52
cmp dword [ebp - 0x150], 0
je 0x10030a6a
mov eax, dword [ebp - 0x150]
push eax
call fcn.100053ad
add esp, 4
jmp 0x10030a6e
jmp 0x10030a92
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0xf4]
jne 0x100308e4
mov ecx, dword [ebp - 0x100]
cmp ecx, dword [ebp - 0xf0]
jne 0x100308e4
jmp 0x10030c23
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10030c23
mov eax, dword [ebp - 0x3c]
add eax, 4
push eax
call fcn.100028e2
add esp, 4
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
je 0x10030c23
mov eax, dword [ebp - 0x30]
add eax, 4
push eax
push 0
mov ecx, dword [ebp - 0x15c]
push ecx
call fcn.1000272f
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x15c]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10030c14
mov dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x3c]
shr eax, 2
cmp dword [ebp - 0x168], eax
jae 0x10030c14
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x180], 0
mov dword [ebp - 4], 1
cmp dword [ebp - 0x168], 0
jbe 0x10030bcf
mov dword [ebp - 0x174], 0
push 0
lea eax, [ebp - 0x174]
push eax
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + ecx*4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10003d28
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
je 0x10030bcf
cmp dword [ebp - 0x174], 0
je 0x10030bcf
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + ecx*4]
cdq
push edx
push eax
push 0
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x174]
push edx
mov eax, dword [ebp - 0x180]
push eax
call fcn.1000191f
mov dword [ebp - 4], 0xfffffffe
jmp 0x10030be8
cmp dword [ebp - 0x180], 0
je 0x10030c00
mov eax, dword [ebp - 0x180]
push eax
call fcn.100053ad
add esp, 4
mov eax, dword [ebp - 0x168]
add eax, 1
mov dword [ebp - 0x168], eax
jmp 0x10030b20
mov eax, dword [ebp - 0x15c]
push eax
call fcn.100053ad
add esp, 4
push edx
mov ecx, ebp
push eax
lea edx, [0x10030c60]
call fcn.10004b97
pop eax
pop edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10004d22
add esp, 0x244
cmp ebp, esp
call fcn.1000318e
mov esp, ebp
pop ebp
ret 0x10