Function at 0x4140c0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x118
mov eax, dword [0x46aa78]
push ebx
push esi
push edi
mov dword [esp + 0x120], eax
mov byte [esp + 0x1c], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
push str.psapi.dll
mov dword [esp + 0x10], esi
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, esi
mov dword [esp + 0x10], ebx
jne 0x413e5f
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x114]
call fcn.00430cd9
add esp, 0x118
ret 8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push str.EnumProcesses
push ebx
call edi
push str.EnumProcessModules
push ebx
mov dword [esp + 0x20], eax
call edi
push str.GetModuleFileNameExA
push ebx
mov ebp, eax
call edi
cmp dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
je 0x413f93
cmp ebp, esi
je 0x413f93
cmp eax, esi
je 0x413f93
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, 0x400
test esi, esi
je 0x413ec5
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add edi, edi
push edi
push 0
call ebx
push eax
call ebp
mov esi, eax
test esi, esi
je 0x413f79
lea eax, [esp + 0x10]
push eax
push edi
push esi
call dword [esp + 0x24]
test eax, eax
je 0x413f80
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x413eb3
shr eax, 2
xor ebp, ebp
test eax, eax
mov dword [esp + 0x10], eax
jbe 0x413f5b
nop
mov byte [esp + 0x20], 0
mov eax, dword [esi + ebp*4]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x413f34
push 0x104
lea ecx, [esp + 0x24]
push ecx
push 0
push edi
call dword [esp + 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x130]
test eax, eax
je 0x413f52
mov ecx, dword [esi + ebp*4]
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x130]
push ecx
push edx
call eax
mov eax, dword [esp + 0x10]
inc ebp
cmp ebp, eax
jb 0x413f00
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x413f9c
mov ecx, dword [esp + 0x14]
push ecx
jmp 0x413f94
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x14]
push edx
jmp 0x413f94
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x124]
pop ebp
pop edi
pop esi
pop ebx
call fcn.00430cd9
add esp, 0x118
ret 8
sub esp, 0x130
mov eax, dword [0x46aa78]
push ebx
push str.Kernel32.dll
mov dword [esp + 0x134], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x413ffa
pop ebx
mov ecx, dword [esp + 0x12c]
call fcn.00430cd9
add esp, 0x130
ret 8
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.CreateToolhelp32Snapshot
push ebx
call esi
push str.Process32First
push ebx
mov edi, eax
call esi
push str.Process32Next
push ebx
mov ebp, eax
call esi
test edi, edi
mov dword [esp + 0x10], eax
je 0x414090
test ebp, ebp
je 0x414090
test eax, eax
je 0x414090
push 0
push 2
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x414097
lea eax, [esp + 0x14]
push eax
mov edi, 0x128
push esi
mov dword [esp + 0x1c], edi
call ebp
test eax, eax
je 0x414082
mov ebp, dword [esp + 0x148]
test ebp, ebp
je 0x414070
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x144]
lea ecx, [esp + 0x38]
push ecx
push edx
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x1c], edi
call dword [esp + 0x18]
test eax, eax
jne 0x414058
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x414099
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
call fcn.00430cd9
add esp, 0x130
ret 8
call fcn.00413d80
cmp eax, 2
jne 0x4140cf
jmp 0x413e00
call fcn.00413d80
cmp eax, 1
jne 0x4140de
jmp 0x413fc0
xor eax, eax
ret 8