Function at 0x4018a0
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x4018a0
mov eax, 0x246c
call fcn.00426be0
mov eax, dword [0x47ffa0]
xor eax, esp
mov dword [esp + 0x2468], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2478]
push esi
push edi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x401a46
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x401a19
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push ebx
call esi
push str.Process32First
push ebx
mov dword [esp + 0x24], eax
call esi
push str.Process32Next
push ebx
mov edi, eax
call esi
push str.Module32First
push ebx
mov dword [esp + 0x28], eax
call esi
push str.Module32Next
push ebx
mov dword [esp + 0x20], eax
call esi
mov esi, dword [esp + 0x1c]
test esi, esi
mov dword [esp + 0x14], eax
je 0x401a12
test edi, edi
je 0x401a12
cmp dword [esp + 0x20], 0
je 0x401a12
push 0
push 2
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x401a12
lea ecx, [esp + 0x2028]
push ecx
push eax
mov dword [esp + 0x2030], 0x128
call edi
test eax, eax
je 0x401a12
mov edi, 0x224
jmp 0x401985
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x2030]
push edx
push 8
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x4019ee
lea eax, [esp + 0x2150]
push eax
push esi
mov dword [esp + 0x2158], edi
call dword [esp + 0x20]
test eax, eax
je 0x4019ee
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4019b5
sub eax, edx
push eax
lea ecx, [esp + 0x2174]
push ebp
push ecx
call fcn.0044936c
add esp, 0xc
test eax, eax
je 0x401a34
lea edx, [esp + 0x2150]
push edx
push esi
mov dword [esp + 0x2158], edi
call dword [esp + 0x1c]
test eax, eax
jne 0x4019b0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x2028]
push eax
push ecx
mov dword [esp + 0x2030], 0x128
call dword [esp + 0x28]
test eax, eax
jne 0x401981
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x2478]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00426bcd
add esp, 0x246c
ret
mov esi, dword [esp + 0x2030]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x401a1b
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x401a19
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push ebx
call esi
push str.EnumProcessModules
push ebx
mov edi, eax
call esi
push str.GetModuleBaseNameA
mov ebp, eax
push ebx
mov dword [esp + 0x18], ebp
call esi
test edi, edi
mov dword [esp + 0x14], eax
je 0x401a12
test ebp, ebp
je 0x401a12
test eax, eax
je 0x401a12
lea edx, [esp + 0x24]
push edx
push 0x1000
lea eax, [esp + 0x1030]
push eax
call edi
test eax, eax
je 0x401a12
mov ebp, dword [esp + 0x24]
shr ebp, 2
mov edi, 0
je 0x401a12
jmp 0x401ac0
mov ecx, dword [esp + edi*4 + 0x1028]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401b2a
lea edx, [esp + 0x24]
push edx
push 0x1000
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x20]
test eax, eax
je 0x401b23
mov edx, dword [esp + 0x28]
push 0x104
lea ecx, [esp + 0x2378]
push ecx
push edx
push esi
call dword [esp + 0x24]
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x2378]
push ecx
call fcn.00430f7b
add esp, 8
test eax, eax
je 0x401b36
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 1
cmp edi, ebp
jb 0x401ac0
jmp 0x401a12
mov edi, dword [esp + edi*4 + 0x1028]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
jmp 0x401a1b