Function at 0x410160
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x1658
call fcn.004573e0
sub rsp, rax
mov rax, qword [0x00472618]
xor rax, rsp
mov qword [rsp + 0x1610], rax
xor eax, eax
mov qword [rsp + 0x1650], rsi
mov qword [rsp + 0x1648], rdi
mov rdi, rdx
mov rcx, 0xffffffffffffffff
mov rsi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
lea eax, [rcx - 1]
cmp eax, 0x103
ja 0x4106ce
mov qword [rsp + 0x1670], rbx
xor ebx, ebx
test ecx, ecx
mov qword [rsp + 0x1678], rbp
movsxd rbp, ecx
jle 0x4101fc
lea rax, [rsp + 0x13f0]
sub rsi, rax
nop
nop
lea rdi, [rsp + rbx + 0x13f0]
movsx ecx, byte [rsi + rdi]
call fcn.0043ac70
add rbx, 1
cmp rbx, rbp
mov byte [rdi], al
jl 0x4101e0
lea rcx, [rsp + 0xfe0]
mov byte [rsp + rbp + 0x13f0], 0
mov dword [rsp + 0xfe0], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x410228
mov eax, 0x25e
jmp 0x410282
mov eax, dword [rsp + 0xff0]
mov qword [rsp + 0x1640], r12
mov qword [rsp + 0x1638], r13
cmp eax, 2
mov qword [rsp + 0x1630], r14
mov qword [rsp + 0x1628], r15
je 0x410474
cmp eax, 1
je 0x4102ba
mov eax, 0x25f
mov r14, qword [rsp + 0x1630]
mov r13, qword [rsp + 0x1638]
mov r12, qword [rsp + 0x1640]
mov r15, qword [rsp + 0x1628]
mov rbx, qword [rsp + 0x1670]
mov rbp, qword [rsp + 0x1678]
mov rdi, qword [rsp + 0x1648]
mov rsi, qword [rsp + 0x1650]
mov rcx, qword [rsp + 0x1610]
xor rcx, rsp
call fcn.00434a90
add rsp, 0x1658
ret
lea rcx, str.Kernel32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
je 0x410447
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbp
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbp
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbp
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test r15, r15
mov rsi, rax
je 0x410461
test rdi, rdi
je 0x410461
test rax, rax
je 0x410461
test r14, r14
je 0x410461
test r13, r13
je 0x410461
xor edx, edx
lea ecx, [rdx + 2]
call r13
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x410461
lea rdx, [rsp + 0x1080]
mov rcx, rax
mov dword [rsp + 0x1080], 0x130
call rdi
test eax, eax
je 0x410447
nop
nop
nop
mov edx, dword [rsp + 0x1088]
mov ecx, 8
call r13
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x410461
lea rdx, [rsp + 0x11b0]
mov rcx, rax
mov dword [rsp + 0x11b0], 0x238
call r14
test eax, eax
je 0x410426
nop
nop
lea rcx, [rsp + 0x12e0]
lea rdi, [rsp + 0x13f0]
sub rdi, rcx
movzx edx, byte [rcx]
movzx eax, byte [rcx + rdi]
sub edx, eax
jne 0x410406
add rcx, 1
test eax, eax
jne 0x4103f3
test edx, edx
je 0x41044e
lea rdx, [rsp + 0x11b0]
mov rcx, rbx
mov dword [rsp + 0x11b0], 0x238
call rsi
test eax, eax
jne 0x4103e0
lea rdx, [rsp + 0x1080]
mov rcx, r12
mov dword [rsp + 0x1080], 0x130
call r15
test eax, eax
jne 0x4103a0
xor eax, eax
jmp 0x410262
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x410262
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x25d
jmp 0x410262
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str.KERNEL32.DLL
mov dword [rsp + 0x20], 0
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x4104cb
lea rdx, str.ProcessIdToSessionId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x4104b9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4104cb
lea rdx, [rsp + 0x20]
mov ecx, ebx
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.PSAPI.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov r13, rax
je 0x4106c4
lea rdx, str.EnumProcesses
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumProcessModules
mov rcx, r13
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExA
mov rcx, r13
mov rbx, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rdi, rdi
mov r15, rax
je 0x4106bb
test rbx, rbx
je 0x4106bb
test rax, rax
je 0x4106bb
lea r8, [rsp + 0x24]
lea rcx, [rsp + 0x40]
mov edx, 0x3e8
call rdi
test eax, eax
je 0x4106bb
mov r14d, dword [rsp + 0x24]
mov r12d, 0
shr r14d, 2
je 0x410447
lea rbp, [rsp + 0x40]
movabs rax, 0x6e776f6e6b6e55
nop
nop
mov r8d, dword [rbp]
xor edx, edx
mov ecx, 0x410
mov qword [rsp + 0x1500], rax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rdi, rax
je 0x4105d3
lea r9, [rsp + 0x24]
lea rdx, [rsp + 0x38]
mov r8d, 8
mov rcx, rax
call rbx
test eax, eax
je 0x4105d3
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x1500]
mov r9d, 0x104
mov rcx, rdi
call r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1500]
call fcn.0043a8a0
lea rdi, [rsp + 0x13f0]
sub rdi, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x410607
add rax, 1
test ecx, ecx
jne 0x4105f4
test edx, edx
jne 0x410681
mov r8d, dword [rbp]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [rbp]
lea rcx, str.KERNEL32.DLL
mov rsi, rax
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x41066d
lea rdx, str.ProcessIdToSessionId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x41065b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x41066d
lea rdx, [rsp + 0x28]
mov ecx, ebx
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x20], eax
jne 0x4106a1
test rsi, rsi
jne 0x4106a8
mov rbx, qword [rsp + 0x30]
add r12d, 1
add rbp, 4
cmp r12d, r14d
jae 0x410447
movabs rax, 0x6e776f6e6b6e55
jmp 0x410580
mov rbx, qword [rsp + 0x30]
jmp 0x410681
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x410262
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x25d
jmp 0x410262
mov eax, 0x278
jmp 0x410292