Function at 0x402131
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510bce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6ac
push edi
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x354], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x114]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x114]
push edx
call fcn.00401fca
add esp, 4
push ecx
mov ecx, esp
mov dword [ebp - 0x6a0], esp
lea eax, [ebp - 0x114]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x6a8], eax
lea ecx, [ebp - 0x6a4]
push ecx
call fcn.00402805
add esp, 8
mov dword [ebp - 0x6ac], eax
mov edx, dword [ebp - 0x6ac]
mov dword [ebp - 0x6b0], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x6b0]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x568]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6a4]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x568]
push ecx
call fcn.00401fca
add esp, 4
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0x69c], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x698]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x348], 0
mov ecx, 0x88
xor eax, eax
lea edi, [ebp - 0x344]
rep stosd dword es:[edi], eax
push 0x51a240
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0
je 0x402516
push str.CreateToolhelp32Snapshot
mov edx, dword [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x5b84d8], eax
push str.Process32First
mov eax, dword [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x5b84dc], eax
push str.Process32Next
mov ecx, dword [ebp - 0x464]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x5b84e0], eax
push str.Module32First
mov edx, dword [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x5b84e4], eax
cmp dword [0x5b84d8], 0
je 0x402309
cmp dword [0x5b84dc], 0
je 0x402309
cmp dword [0x5b84e0], 0
je 0x402309
cmp dword [0x5b84e4], 0
je 0x402309
mov dword [ebp - 0x6b4], 1
jmp 0x402313
mov dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
je 0x4024f5
mov dword [ebp - 0x354], 1
mov dword [ebp - 0x69c], 0x128
push 0
push 2
call dword [0x5b84d8]
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x69c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
call dword [0x5b84dc]
lea eax, [ebp - 0x678]
push eax
call fcn.00401fca
add esp, 4
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x678]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4023c1
lea eax, [ebp - 0x568]
push eax
lea ecx, [ebp - 0x678]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4023f3
push 0x51a29c
lea edx, [ebp - 0x568]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4023f3
mov eax, dword [ebp - 0x694]
push eax
call fcn.004027a8
add esp, 4
test eax, eax
je 0x4023f3
mov ecx, dword [ebp - 0x124]
add ecx, 1
mov dword [ebp - 0x124], ecx
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4024cc
mov dword [ebp - 0x348], 0x224
mov edx, dword [ebp - 0x694]
push edx
push 8
call dword [0x5b84d8]
mov dword [ebp - 0x56c], eax
lea eax, [ebp - 0x348]
push eax
mov ecx, dword [ebp - 0x56c]
push ecx
call dword [0x5b84e4]
lea edx, [ebp - 0x228]
push edx
call fcn.00401fca
add esp, 4
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x402483
lea edx, [ebp - 0x568]
push edx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4024bf
push 0x51a2a4
lea ecx, [ebp - 0x568]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4024bf
mov edx, dword [ebp - 0x694]
push edx
call fcn.004027a8
add esp, 4
test eax, eax
je 0x4024bf
mov eax, dword [ebp - 0x56c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x124]
add ecx, 1
mov dword [ebp - 0x124], ecx
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4024cc
mov edx, dword [ebp - 0x56c]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x69c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [0x5b84e0]
test eax, eax
jne 0x402364
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp dword [ebp - 0x354], 0
je 0x402516
mov eax, dword [ebp - 0x124]
jmp 0x402799
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x574], 0
mov dword [ebp - 0x350], 0x1000
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x402793
push str.EnumProcesses
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x5b84e8], eax
push str.EnumProcessModules
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x5b84ec], eax
push str.GetModuleFileNameExA
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x5b84f0], eax
mov dword [ebp - 0x45c], 0
cmp dword [0x5b84e8], 0
je 0x4025c8
cmp dword [0x5b84ec], 0
je 0x4025c8
cmp dword [0x5b84f0], 0
je 0x4025c8
mov dword [ebp - 0x6b8], 1
jmp 0x4025d2
mov dword [ebp - 0x6b8], 0
mov ecx, dword [ebp - 0x6b8]
mov dword [ebp - 0x45c], ecx
cmp dword [ebp - 0x45c], 0
je 0x402786
mov edx, dword [ebp - 0x574]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 0x350]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x574], eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x350]
push edx
mov eax, dword [ebp - 0x574]
push eax
call dword [0x5b84e8]
test eax, eax
je 0x402786
mov ecx, dword [ebp - 0x10]
shr ecx, 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x460], 0
jmp 0x402661
mov edx, dword [ebp - 0x460]
add edx, 1
mov dword [ebp - 0x460], edx
mov eax, dword [ebp - 0x460]
cmp eax, dword [ebp - 0x10]
jae 0x402786
mov dword [ebp - 0x120], 0
jmp 0x40268b
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
cmp dword [ebp - 0x120], 0x104
jge 0x4026a7
mov edx, dword [ebp - 0x120]
mov byte [ebp + edx - 0x458], 0
jmp 0x40267c
mov eax, dword [ebp - 0x460]
mov ecx, dword [ebp - 0x574]
mov edx, dword [ecx + eax*4]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 0
je 0x402781
lea eax, [ebp - 0x350]
push eax
push 4
lea ecx, [ebp - 0x34c]
push ecx
mov edx, dword [ebp - 0x570]
push edx
call dword [0x5b84ec]
push 0x104
lea eax, [ebp - 0x458]
push eax
mov ecx, dword [ebp - 0x34c]
push ecx
mov edx, dword [ebp - 0x570]
push edx
call dword [0x5b84f0]
lea eax, [ebp - 0x458]
push eax
call fcn.00401fca
add esp, 4
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x458]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x402774
mov eax, dword [ebp - 0x460]
mov ecx, dword [ebp - 0x574]
mov edx, dword [ecx + eax*4]
push edx
call fcn.004027a8
add esp, 4
test eax, eax
je 0x402774
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp - 0x124]
add eax, 1
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x570]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x402652
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret