Function at 0x43a0a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb94
mov eax, dword [0x471080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0xfa0
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
mov dword [ebp - 0xb80], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea ecx, [edi - 1]
cmp ecx, 0x103
ja 0x43a50c
push esi
xor esi, esi
test edi, edi
jle 0x43a108
nop word [eax + eax]
movzx eax, word [ebx + esi*2]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov word [ebp + esi*2 - 0x20c], ax
inc esi
cmp esi, edi
jl 0x43a0f0
add edi, edi
cmp edi, 0x208
jae 0x43a523
xor eax, eax
mov dword [ebp - 0x528], 0x114
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x43a153
pop esi
pop edi
mov eax, 0x25e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x518]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp ecx, 2
je 0x43a192
cmp ecx, 1
je 0x43a181
pop esi
pop edi
mov eax, 0x25f
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0xb94]
mov ebx, dword [ebp - 0xb80]
jmp 0x43a2ef
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43a217
push str.EnumProcesses
push edi
call esi
push str.EnumProcessModules
mov ebx, eax
push edi
mov dword [ebp - 0xb84], ebx
call esi
push str.GetModuleBaseNameW
push edi
mov dword [ebp - 0xb88], eax
call esi
mov dword [ebp - 0xb8c], eax
test ebx, ebx
je 0x43a500
cmp dword [ebp - 0xb88], 0
je 0x43a500
test eax, eax
je 0x43a500
mov ebx, dword [ebp - 0xb80]
lea eax, [ebp - 0xb90]
push eax
push 0x3e8
push ebx
call dword [ebp - 0xb84]
test eax, eax
jne 0x43a22f
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
mov eax, 0x25d
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0xb90]
xor esi, esi
shr eax, 2
mov dword [ebp - 0xb84], eax
test eax, eax
je 0x43a2e9
nop dword [eax + eax]
push str.Unknown
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebx + esi*4]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x43a2ac
lea eax, [ebp - 0xb90]
push eax
push 4
lea eax, [ebp - 0xb94]
push eax
push ebx
call dword [ebp - 0xb88]
test eax, eax
je 0x43a2ac
push 0x104
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xb94]
push ebx
call dword [ebp - 0xb8c]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43a498
mov ebx, dword [ebp - 0xb80]
inc esi
cmp esi, dword [ebp - 0xb84]
jb 0x43a250
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x518], 1
jne 0x43a47c
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43a217
push 0x45c9ac
push edi
call esi
push 0x45c9c8
push edi
mov dword [ebp - 0xb88], eax
call esi
push 0x45c9d8
push edi
mov dword [ebp - 0xb80], eax
call esi
push str.Module32FirstW
push edi
mov dword [ebp - 0xb84], eax
call esi
push str.Module32NextW
push edi
mov dword [ebp - 0xb8c], eax
call esi
cmp dword [ebp - 0xb84], 0
mov ebx, eax
je 0x43a500
mov esi, dword [ebp - 0xb80]
test esi, esi
je 0x43a500
test ebx, ebx
je 0x43a500
cmp dword [ebp - 0xb8c], 0
je 0x43a500
mov eax, dword [ebp - 0xb88]
test eax, eax
je 0x43a500
push 0
push 2
call eax
mov dword [ebp - 0xb80], eax
cmp eax, 0xffffffff
je 0x43a500
lea ecx, [ebp - 0xb7c]
mov dword [ebp - 0xb7c], 0x22c
push ecx
push eax
call esi
test eax, eax
je 0x43a470
nop dword [eax]
push dword [ebp - 0xb74]
push 8
call dword [ebp - 0xb88]
mov esi, eax
cmp esi, 0xffffffff
je 0x43a4f4
lea eax, [ebp - 0x950]
mov dword [ebp - 0x950], 0x428
push eax
push esi
call dword [ebp - 0xb8c]
test eax, eax
je 0x43a444
nop word [eax + eax]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x930]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43a4c4
lea eax, [ebp - 0x950]
mov dword [ebp - 0x950], 0x428
push eax
push esi
call ebx
test eax, eax
jne 0x43a410
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xb7c]
mov dword [ebp - 0xb7c], 0x22c
push eax
push dword [ebp - 0xb80]
call dword [ebp - 0xb84]
test eax, eax
jne 0x43a3d0
push dword [ebp - 0xb80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xb80]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
push dword [ebp - 0xb80]
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0xb80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x43a217
mov ecx, dword [ebp - 4]
mov eax, 0x278
pop edi
xor ecx, ebp
pop ebx
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
call fcn.0043dfe4
int3