Function at 0x402a9e
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x3b8
mov eax, dword [0x40f270]
push ebx
push esi
push edi
mov esi, str.gf.dll
push 0x5c
push esi
mov dword [ebp + 0x6c], eax
mov dword [ebp - 0x1f8], esi
call fcn.00405d70
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
je 0x402ad8
inc eax
mov dword [ebp - 0x208], eax
jmp 0x402ae4
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x1f8], ebx
push dword [ebp + 0x7c]
push 8
pop esi
push esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x402b81
lea eax, [ebp - 0x1b8]
push eax
push edi
mov dword [ebp - 0x1b8], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
jne 0x402b1f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402b81
cmp dword [ebp - 0x1f8], ebx
je 0x402b36
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x1f8]
jmp 0x402b43
lea eax, [ebp - 0x198]
push eax
push dword [ebp - 0x208]
call fcn.0040c18a
test eax, eax
pop ecx
pop ecx
je 0x402b5f
lea eax, [ebp - 0x1b8]
push eax
push edi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x402b1f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x7c]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x1f4], edi
jne 0x402b88
xor eax, eax
jmp 0x40363d
push ebx
push 0x10
push 0x40f148
push dword [ebp - 0x1a0]
mov dword [ebp + 0x7c], ebx
push dword [ebp - 0x1a4]
mov dword [ebp - 0x204], ebx
push edi
mov dword [ebp - 0x208], ebx
call fcn.00402664
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402d58
push ebx
push 0x10
push 0x40f138
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402664
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402d58
push ebx
push 0x10
push 0x40f128
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402664
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402d4c
push ebx
push 0x10
push 0x40f118
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402664
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402d4c
push ebx
push 0x10
push 0x40f108
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402664
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402d43
push ebx
push 0x10
push 0x40f0f8
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402664
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402d43
push ebx
push 0x10
push 0x40f0e8
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402664
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402d43
push ebx
push 0x10
push 0x40f0d8
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402664
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402d43
push ebx
push 0x10
push 0x40f0c8
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402664
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
jne 0x402d43
push ebx
push 0x10
push 0x40f0b8
push dword [ebp - 0x1a0]
push dword [ebp - 0x1a4]
push edi
call fcn.00402664
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 0x200], eax
je 0x40361e
mov dword [ebp + 0x7c], 1
jmp 0x402d67
mov dword [ebp - 0x204], 1
jmp 0x402d67
xor eax, eax
inc eax
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x208], eax
push str._GetService_GF_Util__YAJABU_GUID__PA_WPAPAX_Z
push dword [ebp - 0x1a4]
push edi
call fcn.00402835
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1fc], eax
je 0x40361e
push 0x1c
lea eax, [ebp - 0x228]
push eax
mov dword [ebp - 0x1f8], ebx
push ebx
jmp 0x402e1e
push dword [ebp - 0x214]
lea eax, [ebp - 0x1ec]
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
push dword [ebp - 0x224]
push str.0x_p__0x_p___u__0x_x_r_n
push eax
call fcn.004046f8
add esp, 0x18
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 1
push esi
lea eax, [ebp - 0x200]
push eax
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
push dword [ebp - 0x1f4]
call fcn.00402664
mov edi, eax
add esp, 0x18
cmp edi, 0xffffffff
jne 0x402e32
mov eax, dword [ebp - 0x1f8]
add eax, dword [ebp - 0x21c]
push 0x1c
lea ecx, [ebp - 0x228]
push ecx
mov dword [ebp - 0x1f8], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, 0x1c
je 0x402d9e
jmp 0x40361e
push 4
pop edx
mov ecx, 0x3e8
push 0x20
pop eax
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], ecx
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x30c], ecx
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2c0], ecx
add ecx, 0x1c
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x284], eax
mov eax, 0xfffffe70
push 0x14
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x280], ecx
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x24c], eax
mov eax, 0x3f0
pop ecx
mov dword [ebp - 0x348], 0xfffffff8
mov dword [ebp - 0x344], 0x14
mov dword [ebp - 0x340], 0x10
mov dword [ebp - 0x33c], edx
mov dword [ebp - 0x338], esi
mov dword [ebp - 0x334], ebx
mov dword [ebp - 0x330], esi
mov dword [ebp - 0x324], esi
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x314], ebx
mov dword [ebp - 0x308], esi
mov dword [ebp - 0x304], esi
mov dword [ebp - 0x300], esi
mov dword [ebp - 0x2fc], ebx
mov dword [ebp - 0x2f0], esi
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2e8], ebx
mov dword [ebp - 0x2e4], ebx
mov dword [ebp - 0x2d8], esi
mov dword [ebp - 0x2d4], esi
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2cc], esi
mov dword [ebp - 0x2c8], esi
mov dword [ebp - 0x2bc], esi
mov dword [ebp - 0x2b8], esi
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 0x29c], esi
mov dword [ebp - 0x298], edx
mov dword [ebp - 0x294], 0x1c
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], esi
mov dword [ebp - 0x288], esi
mov dword [ebp - 0x27c], esi
mov dword [ebp - 0x278], 0xc
mov dword [ebp - 0x274], edx
mov dword [ebp - 0x270], 0x1c
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x25c], 0xc
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x254], 0x1c
mov dword [ebp - 0x250], 0x120
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x23c], 0x118
mov dword [ebp - 0x238], 0xfffffe40
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x1f0], ebx
cmp dword [ebp - 0x1f0], 2
mov dword [ebp - 0x1f8], ebx
jne 0x403078
push ebx
push 4
lea eax, [ebp - 0x1f8]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40306b
cmp dword [ebp - 0x1f8], ebx
je 0x40306b
add edi, 0x2c
jmp 0x4030a5
cmp dword [ebp - 0x204], ebx
je 0x403098
add edi, 0x18
jmp 0x4030a5
cmp dword [ebp - 0x1f0], 1
jne 0x403098
cmp dword [ebp + 0x7c], ebx
je 0x40308b
add edi, 0x30
jmp 0x4030a5
cmp dword [ebp - 0x204], ebx
je 0x403098
add edi, 0x1c
jmp 0x4030a5
mov eax, dword [ebp - 0x1f0]
add edi, dword [ebp + eax*4 - 0x348]
push ebx
push 4
lea eax, [ebp - 0x1f8]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40361e
mov edi, dword [ebp - 0x1f8]
cmp edi, ebx
je 0x40361e
cmp dword [ebp - 0x1f0], 3
jne 0x4030e5
cmp dword [ebp - 0x204], ebx
je 0x4030e5
mov dword [ebp - 0x20c], edi
inc dword [ebp - 0x1f0]
cmp dword [ebp - 0x1f0], 5
jl 0x403035
mov dword [ebp - 0x200], edi
mov dword [ebp + 0x7c], ebx
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 9
mov dword [ebp - 0x1f0], ebx
jne 0x40312c
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403154
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0xb
mov edi, dword [ebp - 0x1f0]
jl 0x403101
jmp 0x403156
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403176
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x4031d8
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0xb
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x10
mov dword [ebp - 0x1f0], ebx
jne 0x4031ae
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4031d6
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x12
mov edi, dword [ebp - 0x1f0]
jl 0x403183
jmp 0x4031d8
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4031f8
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x40325a
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x12
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x16
mov dword [ebp - 0x1f0], ebx
jne 0x403230
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403258
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x18
mov edi, dword [ebp - 0x1f0]
jl 0x403205
jmp 0x40325a
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40327a
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x4032dc
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x18
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x1c
mov dword [ebp - 0x1f0], ebx
jne 0x4032b2
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4032da
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x1e
mov edi, dword [ebp - 0x1f0]
jl 0x403287
jmp 0x4032dc
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4032fc
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x40335e
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x1e
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x23
mov dword [ebp - 0x1f0], ebx
jne 0x403334
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40335c
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x25
mov edi, dword [ebp - 0x1f0]
jl 0x403309
jmp 0x40335e
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40337e
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x4033e0
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x25
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x2a
mov dword [ebp - 0x1f0], ebx
jne 0x4033b6
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0x14]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4033de
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x2e
mov edi, dword [ebp - 0x1f0]
jl 0x40338b
jmp 0x4033e0
xor edi, edi
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403404
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x403486
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x2e
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
cmp eax, 0x33
mov dword [ebp - 0x1f0], ebx
jne 0x40343c
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0x14]
push eax
push dword [ebp - 0x1f4]
call esi
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403462
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x37
mov edi, dword [ebp - 0x1f0]
jl 0x403411
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403486
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x40361b
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4034a6
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x40350d
mov edi, dword [ebp - 0x200]
mov dword [ebp + 0x7c], 0x37
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
mov dword [ebp - 0x1f0], ebx
call esi
test eax, eax
je 0x4034e9
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x3e
mov edi, dword [ebp - 0x1f0]
jl 0x4034b3
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40350d
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x40361b
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40352d
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x403594
mov edi, dword [ebp - 0x20c]
mov dword [ebp + 0x7c], 0x3e
mov eax, dword [ebp + 0x7c]
add edi, dword [ebp + eax*4 - 0x348]
push ebx
push 4
lea eax, [ebp - 0x1f0]
push eax
push edi
push dword [ebp - 0x1f4]
mov dword [ebp - 0x1f0], ebx
call esi
test eax, eax
je 0x403570
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0x43
mov edi, dword [ebp - 0x1f0]
jl 0x40353a
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x403594
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x40361b
push ebx
push 0x10
push dword [ebp + 0x78]
push edi
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x4035b4
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
jne 0x40362e
mov eax, dword [ebp - 0x20c]
push 0x43
add eax, 8
pop edi
cmp edi, 0x44
mov dword [ebp + 0x7c], ebx
jne 0x4035d7
cmp dword [ebp - 0x208], ebx
je 0x4035d7
sub eax, 0x130
jmp 0x4035de
add eax, dword [ebp + edi*4 - 0x348]
push ebx
push 4
lea ecx, [ebp + 0x7c]
push ecx
push eax
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40361e
mov eax, dword [ebp + 0x7c]
inc edi
cmp edi, 0x48
jl 0x4035c0
push ebx
push 0x10
push dword [ebp + 0x78]
push eax
push dword [ebp - 0x1f4]
call esi
test eax, eax
je 0x40362e
push dword [ebp + 0x78]
call fcn.00402805
test eax, eax
pop ecx
je 0x40362e
xor ebx, ebx
inc ebx
push dword [ebp - 0x1f4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x40363d
push dword [ebp - 0x1f4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x6c]
pop edi
pop esi
pop ebx
call fcn.00404ad1
add ebp, 0x70
leave
ret 8