Function at 0x43762b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0x268]
sub esp, 0x2e8
mov eax, dword [0x517774]
xor eax, ebp
mov dword [ebp + 0x264], eax
mov eax, dword [ebp + 0x270]
push esi
xor esi, esi
push 0x103
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x161]
push esi
push eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x74], esi
mov byte [ebp + 0x160], 0
call fcn.00497680
add esp, 0xc
lea eax, [ebp + 0xcc]
push eax
mov dword [ebp + 0xcc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x437814
cmp dword [ebp + 0xdc], 2
push ebx
push edi
jne 0x43782f
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x68], ebx
cmp ebx, esi
je 0x437810
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push ebx
call esi
push str.EnumProcessModules
push ebx
mov dword [ebp - 0x60], eax
call esi
push str.GetModuleFileNameExA
push ebx
mov dword [ebp - 0x80], eax
call esi
xor edi, edi
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x60], edi
je 0x43782c
cmp dword [ebp - 0x80], edi
je 0x43782c
cmp eax, edi
je 0x43782c
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x64], 0x400
test edi, edi
je 0x437727
push edi
push 0
call esi
push eax
call ebx
mov eax, dword [ebp - 0x64]
add eax, eax
mov dword [ebp - 0x64], eax
push dword [ebp - 0x64]
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x437807
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x64]
push edi
call dword [ebp - 0x60]
test eax, eax
je 0x4377ff
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x64]
je 0x437713
shr dword [ebp - 0x6c], 2
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x6c], 0
jbe 0x4377f2
mov eax, dword [ebp - 0x60]
mov byte [ebp + 0x160], 0
push dword [edi + eax*4]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x4377c7
lea ecx, [ebp - 0x64]
push ecx
push 4
lea ecx, [ebp - 0x74]
push ecx
push eax
call dword [ebp - 0x80]
test eax, eax
je 0x4377be
push 0x104
lea eax, [ebp + 0x160]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x7c]
call dword [ebp - 0x70]
test eax, eax
jne 0x4377be
mov byte [ebp + 0x160], al
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x274]
lea eax, [ebp + 0x160]
push eax
mov eax, dword [ebp - 0x60]
push 0
push dword [edi + eax*4]
call dword [ebp - 0x78]
test eax, eax
je 0x4377f2
inc dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x6c]
jb 0x43776c
push edi
push 0
call esi
push eax
call ebx
jmp 0x4378d1
push edi
push 0
call esi
push eax
call ebx
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x264]
xor ecx, ebp
pop esi
call fcn.004974ba
add ebp, 0x268
leave
ret 8
push ebx
jmp 0x43780a
cmp dword [ebp + 0xdc], 1
jne 0x437810
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0x68], edi
cmp edi, esi
je 0x437810
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4de9bc
push edi
call esi
push 0x4de9ac
push edi
mov ebx, eax
call esi
push 0x4de99c
push dword [ebp - 0x68]
mov edi, eax
call esi
mov dword [ebp - 0x70], eax
test eax, eax
je 0x437807
test edi, edi
je 0x437807
test ebx, ebx
je 0x437807
push 0
push 2
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x437807
lea eax, [ebp - 0x5c]
push eax
mov esi, 0x128
push ebx
mov dword [ebp - 0x5c], esi
call edi
jmp 0x4378c6
push dword [ebp + 0x274]
lea eax, [ebp - 0x38]
push eax
push 0
push dword [ebp - 0x54]
call dword [ebp - 0x78]
test eax, eax
je 0x4378c4
lea eax, [ebp - 0x5c]
push eax
push ebx
mov dword [ebp - 0x5c], esi
call dword [ebp - 0x70]
jmp 0x4378c6
xor eax, eax
test eax, eax
jne 0x4378a1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
inc eax
jmp 0x437812