Function at 0x42121d
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2710
call fcn.004357e0
and dword [ebp - 0xc], 0
push esi
mov esi, 0x104
lea eax, [ebp - 0x118]
push esi
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x21c]
push str.KCBPDaemon.exe
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2710]
push 0x7d0
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x421463
mov eax, dword [ebp - 0x10]
shr eax, 2
test eax, eax
jle 0x421460
push ebx
push edi
mov edi, dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
lea ebx, [ebp - 0x2710]
mov dword [ebp - 8], eax
push dword [ebx]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [ebp - 4], eax
je 0x421452
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x7d0]
push 0x12c
push ecx
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x421449
lea eax, [ebp - 0x118]
and byte [ebp - 0x118], 0
push esi
push eax
push dword [ebp - 0x7d0]
push dword [ebp - 4]
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x421392
lea eax, [ebp - 0x118]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 4
pop ecx
jle 0x421392
lea esi, [ebp + eax - 0x11c]
push str..exe
push esi
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x421331
push str..com
push esi
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x42138d
lea eax, [ebp - 0x21c]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jne 0x42138d
mov esi, dword [sym.imp.MSVCIRT.dll_class_ostream_withassign_cout]
test esi, esi
je 0x421353
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
push 8
push eax
call fcn.00421468
pop ecx
lea eax, [ebp - 0x118]
pop ecx
push eax
push 0x44709c
push dword [ebx]
mov ecx, esi
call dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___unsigned_long_int_]
mov ecx, eax
call edi
mov ecx, eax
call edi
mov esi, eax
push esi
call dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
push esi
call dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_flush_class_ostream__]
pop ecx
pop ecx
mov esi, 0x104
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x421449
lea eax, [ebp - 0x21c]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x421449
lea eax, [ebp - 0x118]
push esi
push eax
push dword [ebp - 0x7d0]
push dword [ebp - 4]
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x421449
lea eax, [ebp - 0x320]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__getcwd]
pop ecx
test eax, eax
pop ecx
je 0x421449
lea eax, [ebp - 0x320]
push 0x4458b8
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x320]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x18
test eax, eax
jne 0x421449
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x421449
mov dword [ebp - 0xc], 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 4
dec dword [ebp - 8]
jne 0x421293
pop edi
pop ebx
mov eax, dword [ebp - 0xc]
pop esi
leave
ret 4