Function at 0x4949f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b8
cmp dword [0x4fd8f0], 0
jne 0x494bbe
cmp dword [0x4fda20], 0
je 0x494a1f
sub esp, 0xc
push str.rndw32slow_gatherer_95:_init_toolkit_n
call fcn.0049d984
add esp, 0x10
sub esp, 0xc
push str.KERNEL32.DLL
call sub.KERNEL32.dll_GetModuleHandleA
add esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x494a46
sub esp, 0xc
push str.rndw32:_cant_get_module_handle_n
call fcn.0049d8b6
sub esp, 8
push str.CreateToolhelp32Snapshot
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd8f0], eax
sub esp, 8
push str.Module32First
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd900], eax
sub esp, 8
push str.Module32Next
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd910], eax
sub esp, 8
push str.Process32First
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd920], eax
sub esp, 8
push str.Process32Next
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd930], eax
sub esp, 8
push str.Thread32First
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd940], eax
sub esp, 8
push str.Thread32Next
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd950], eax
sub esp, 8
push str.Heap32ListFirst
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd960], eax
sub esp, 8
push str.Heap32ListNext
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd970], eax
sub esp, 8
push str.Heap32First
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd980], eax
sub esp, 8
push str.Heap32Next
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd990], eax
cmp dword [0x4fd8f0], 0
je 0x494bb1
cmp dword [0x4fd900], 0
je 0x494bb1
cmp dword [0x4fd910], 0
je 0x494bb1
cmp dword [0x4fd920], 0
je 0x494bb1
cmp dword [0x4fd930], 0
je 0x494bb1
cmp dword [0x4fd940], 0
je 0x494bb1
cmp dword [0x4fd950], 0
je 0x494bb1
cmp dword [0x4fd960], 0
je 0x494bb1
cmp dword [0x4fd970], 0
je 0x494bb1
cmp dword [0x4fd980], 0
je 0x494bb1
cmp dword [0x4fd990], 0
jne 0x494bbe
sub esp, 0xc
push str.rndw32:_failed_to_get_a_toolhep_function_n
call fcn.0049d8b6
sub esp, 8
push 0
push 0xf
mov eax, dword [0x4fd8f0]
call eax
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x494be5
sub esp, 0xc
push str.rndw32:_failed_to_take_a_toolhelp_snapshot_n
call fcn.0049d8b6
mov dword [ebp - 0x28], 0x10
sub esp, 8
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x4fd960]
call eax
add esp, 8
test eax, eax
je 0x494c9c
cmp dword [0x4fda20], 0
je 0x494c21
sub esp, 0xc
push str.rndw32slow_gatherer_95:_walk_heap_n
call fcn.0049d984
add esp, 0x10
sub esp, 4
push dword [ebp + 0xc]
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp + 8]
call eax
add esp, 0x10
mov dword [ebp - 0x58], 0x24
sub esp, 4
push dword [ebp - 0x20]
push dword [ebp - 0x24]
lea eax, [ebp - 0x58]
push eax
mov eax, dword [0x4fd980]
call eax
add esp, 4
test eax, eax
je 0x494c82
sub esp, 4
push dword [ebp + 0xc]
push 0x24
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp + 8]
call eax
add esp, 0x10
sub esp, 0xc
lea eax, [ebp - 0x58]
push eax
mov eax, dword [0x4fd990]
call eax
add esp, 0xc
test eax, eax
je 0x494c82
jmp 0x494c57
sub esp, 8
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x4fd970]
call eax
add esp, 8
test eax, eax
je 0x494c9c
jmp 0x494c21
mov dword [ebp - 0x188], 0x128
sub esp, 8
lea eax, [ebp - 0x188]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x4fd920]
call eax
add esp, 8
test eax, eax
je 0x494d11
cmp dword [0x4fda20], 0
je 0x494cda
sub esp, 0xc
push str.rndw32slow_gatherer_95:_walk_processes_n
call fcn.0049d984
add esp, 0x10
sub esp, 4
push dword [ebp + 0xc]
push 0x128
lea eax, [ebp - 0x188]
push eax
mov eax, dword [ebp + 8]
call eax
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x188]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x4fd930]
call eax
add esp, 8
test eax, eax
je 0x494d11
jmp 0x494cda
mov dword [ebp - 0x188], 0x1c
sub esp, 8
lea eax, [ebp - 0x188]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x4fd940]
call eax
add esp, 8
test eax, eax
je 0x494d83
cmp dword [0x4fda20], 0
je 0x494d4f
sub esp, 0xc
push str.rndw32slow_gatherer_95:_walk_threads_n
call fcn.0049d984
add esp, 0x10
sub esp, 4
push dword [ebp + 0xc]
push 0x1c
lea eax, [ebp - 0x188]
push eax
mov eax, dword [ebp + 8]
call eax
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x188]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x4fd950]
call eax
add esp, 8
test eax, eax
je 0x494d83
jmp 0x494d4f
mov dword [ebp - 0x3b8], 0x224
sub esp, 8
lea eax, [ebp - 0x3b8]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x4fd900]
call eax
add esp, 8
test eax, eax
je 0x494df8
cmp dword [0x4fda20], 0
je 0x494dc1
sub esp, 0xc
push str.rndw32slow_gatherer_95:_walk_modules_n
call fcn.0049d984
add esp, 0x10
sub esp, 4
push dword [ebp + 0xc]
push 0x224
lea eax, [ebp - 0x3b8]
push eax
mov eax, dword [ebp + 8]
call eax
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x3b8]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x4fd910]
call eax
add esp, 8
test eax, eax
je 0x494df8
jmp 0x494dc1
sub esp, 0xc
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
leave
ret