Function at 0x439470
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x180c
call fcn.00425a20
mov eax, dword [0x628144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1000
lea eax, [ebp - 0x1804]
push 0
push eax
call fcn.00442fd0
and dword [ebp - 0x180c], 0
add esp, 0xc
call fcn.0042680a
test al, al
je 0x4394d0
pop edx
push esi
pop edx
push esi
push ebp
push esp
pop edi
push eax
pop edi
push edx
pop esi
pop esi
push ecx
pop ebx
pop ebx
push ebp
pop esp
push esi
pop ebp
pop eax
pop ecx
push ecx
push eax
pop edi
push esi
pop ebp
push esi
pop ebx
pop ecx
push eax
pop ebp
push edi
call fcn.0042684f
test al, al
je 0x4394ea
pop esi
push esp
push ecx
pop edx
push ebp
pop edx
push eax
pop eax
push esp
pop ebx
push ebp
push eax
pop esi
pop eax
pop ebx
push edi
push esp
call fcn.00426b46
test al, al
je 0x439513
push edx
push esp
pop esp
pop esi
push ebx
pop eax
pop edi
push eax
push ecx
pop esp
pop edi
push edi
pop esp
pop ebp
pop ecx
pop ecx
push eax
push eax
push ecx
pop edi
pop ebp
pop ebp
push esp
pop ebx
push ebp
push eax
push ecx
push ebx
pop ebp
pop esp
pop eax
pop ecx
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00442fd0
add esp, 0xc
call fcn.0042684f
test al, al
je 0x43954f
push eax
pop esi
pop edi
pop esp
push esi
pop edi
pop ecx
pop ebp
push ebx
pop ebp
push ecx
push ecx
push eax
push edi
push ebx
pop esi
pop eax
pop edx
push esi
push esp
push edi
pop ecx
pop ebx
push ecx
pop ebx
push edx
pop edx
pop esp
pop edx
call fcn.00426489
test al, al
je 0x43956e
push ebp
pop ecx
push esp
pop edx
push ecx
push ebx
push edi
push esp
pop ebx
pop eax
pop edx
pop edx
push ebx
pop esi
pop ecx
push ebx
push esi
pop ecx
push ebx
push edx
push ebp
pop edi
call fcn.0042666c
test al, al
je 0x439588
push edi
pop esp
pop edx
push eax
push edx
pop ebp
push ebx
push esp
push esp
pop esi
pop esp
pop eax
push ebx
push ecx
push esp
push esp
pop ecx
and dword [ebp - 0x1808], 0
xor ebx, ebx
call fcn.00426a77
test al, al
je 0x4395ab
push edx
push edi
push edx
pop eax
pop esi
push ebx
pop edx
push ebx
push eax
push esi
pop ebp
pop edx
pop eax
push esi
push ebx
pop ebp
push ebp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x180c]
push eax
push 0x1000
lea eax, [ebp - 0x1804]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x4395ab
mov edi, dword [ebp - 0x180c]
xor esi, esi
shr edi, 2
test edi, edi
je 0x439647
and dword [ebp - 0x1808], esi
push 0x400
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00442fd0
push 0x400
lea eax, [ebp - 0x804]
push eax
push dword [ebp + esi*4 - 0x1804]
call fcn.004398e6
add esp, 0x18
test eax, eax
je 0x439630
lea eax, [ebp - 0x804]
push str.Windowsexplorer.exe
push eax
call fcn.004399e5
pop ecx
pop ecx
test eax, eax
jne 0x439637
inc esi
cmp esi, edi
jb 0x4395e7
jmp 0x439647
mov eax, dword [ebp + esi*4 - 0x1804]
xor ebx, ebx
mov dword [ebp - 0x1808], eax
inc ebx
test ebx, ebx
je 0x4395ab
call fcn.00426a77
test al, al
je 0x43966d
push eax
pop ebp
pop edx
push edx
push esp
push ecx
pop ebx
pop esp
pop ecx
pop ecx
pop ebx
push edi
push ebp
pop ecx
push edx
pop ebp
pop eax
push edx
push ebx
pop eax
push edi
call fcn.004266f6
test al, al
je 0x439693
push eax
push esi
pop esp
push ecx
push ebx
pop ebp
pop ebx
pop esi
pop eax
pop ebp
pop ebp
push ebx
pop esp
pop edx
pop esi
push eax
pop edi
pop esp
pop esp
push edi
push ebp
pop edx
pop ecx
push esp
push ebx
push edi
pop esp
push esi
push eax
call fcn.0042680a
test al, al
je 0x4396b7
pop ebx
push ebp
push edx
push eax
pop esp
pop edx
pop edx
push eax
pop esp
push eax
push ebx
pop eax
pop edx
pop eax
push esi
push eax
push ebx
push esp
push ebp
pop ebp
push esi
pop ecx
push ebx
push esp
push ecx
pop ebp
pop ebp
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1808]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0042578a
mov esp, ebp
pop ebp
ret