Function at 0x40e1a0
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x462238
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47c748]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0x1c], 0
jne 0x40e1e1
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xd8]
push ecx
jmp 0x40e1e2
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x48576c
mov ecx, 0x485778
mov edi, eax
call fcn.00408380
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx - 0xc]
cmp eax, 4
jle 0x40e215
lea edx, [esp + 0x2c]
push edx
mov ecx, 0x485778
call fcn.00408380
push 0x485178
push edi
mov dword [0x485178], 0x428
call sub.KERNEL32.dll_Module32FirstW
or ebp, 0xffffffff
lea ecx, [ecx]
mov eax, 0x485198
lea edx, [eax + 2]
jmp 0x40e240
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e240
sub eax, edx
sar eax, 1
push eax
push 0x485198
mov ecx, 0x485774
call fcn.00408400
mov edx, dword [0x485778]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40e28a
push esi
mov ecx, 0x485778
call fcn.00408270
mov edx, dword [0x485778]
lea eax, [esi + 1]
push eax
push edx
call fcn.00434659
add esp, 8
test esi, esi
jl 0x40e3f7
mov eax, dword [0x485778]
cmp esi, dword [eax - 8]
jg 0x40e3f7
mov dword [eax - 0xc], esi
mov ecx, dword [0x485778]
mov word [ecx + esi*2], 0
mov edx, dword [0x485774]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40e2e7
push esi
mov ecx, 0x485774
call fcn.00408270
mov edx, dword [0x485774]
lea eax, [esi + 1]
push eax
push edx
call fcn.00434659
add esp, 8
test esi, esi
jl 0x40e3f7
mov eax, dword [0x485774]
cmp esi, dword [eax - 8]
jg 0x40e3f7
mov dword [eax - 0xc], esi
mov ecx, dword [0x485774]
mov word [ecx + esi*2], 0
mov ecx, dword [0x485778]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x40e3bf
mov eax, dword [0x485774]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40e359
test dx, dx
je 0x40e355
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40e359
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e333
xor eax, eax
jmp 0x40e35d
sbb eax, eax
sbb eax, ebp
test eax, eax
sete al
test al, al
jne 0x40e3c9
push 0x485178
push edi
mov dword [0x485178], 0x428
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x40e230
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x40e3a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
push 0x80004005
call fcn.00408a00
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x48518c]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], ebp
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x40e3f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x40e3a9
push 0x80070057
call fcn.00408a00
int3