Function at 0x417740
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x248
push ebp
push 4
push 0x1000
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 4], ebp
jne 0x417778
mov eax, dword [esp + 0x250]
mov dword [eax], ebp
xor eax, eax
pop ebp
add esp, 0x248
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.psapi.dll
call esi
mov edi, eax
test edi, edi
mov dword [esp + 0x1c], edi
je 0x4178fd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcessModules
push edi
call esi
push str.GetModuleBaseNameA
push edi
mov ebx, eax
call esi
push str.GetModuleInformation
push edi
mov dword [esp + 0x1c], eax
call esi
add ebp, 0xf000
test ebx, ebx
mov dword [esp + 0x24], eax
je 0x4178ed
cmp dword [esp + 0x14], 0
je 0x4178ed
test eax, eax
je 0x4178ed
lea ecx, [esp + 0x18]
push ecx
push 0x1000
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x4178ed
mov eax, dword [esp + 0x18]
cmp eax, 0x1000
mov esi, dword [esp + 0x10]
jbe 0x417813
mov eax, 0x1000
mov dword [esp + 0x18], eax
mov ebx, esi
push eax
sub ebx, eax
add ebx, 0x10000
push ebp
push ebx
call fcn.005f8630
mov eax, dword [esp + 0x24]
shr eax, 2
lea edx, [eax + eax*2]
add edx, edx
add edx, edx
mov ebp, esi
sub ebp, edx
add esp, 0xc
add ebp, 0xfff4
mov dword [esp + 0x20], ebp
mov edi, dword [ebx]
mov eax, ebp
sub eax, esi
push eax
push esi
push edi
add ebx, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esp + 0x24]
test eax, eax
je 0x4178b7
push 0xc
lea ecx, [esp + 0x2c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esp + 0x34]
test eax, eax
je 0x4178b7
mov edx, dword [esp + 0x20]
xor ecx, ecx
mov dword [edx], esi
cmp byte [esi], cl
je 0x417895
add esi, 1
cmp byte [esi - 1], 0x2e
lea eax, [esi - 1]
jne 0x417890
mov ecx, eax
cmp byte [esi], 0
jne 0x417882
add esi, 1
test ecx, ecx
je 0x4178a2
mov byte [ecx], 0
lea esi, [ecx + 1]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
add edx, 0xc
mov dword [esp + 0x20], edx
sub dword [esp + 0x18], 4
jne 0x417844
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push eax
mov dword [edx], 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
mov eax, ebp
mov dword [edx], ecx
pop ebp
add esp, 0x248
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebp, dword [esp + 0x10]
jmp 0x417a28
push str.kernel32.dll
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.CreateToolhelp32Snapshot
push ebx
mov dword [esp + 0x18], ebx
call esi
push str.Module32First
push ebx
mov edi, eax
call esi
mov ebx, eax
mov eax, dword [esp + 0x10]
push str.Module32Next
push eax
call esi
test edi, edi
mov dword [esp + 0x1c], eax
je 0x417a1d
test ebx, ebx
je 0x417a1d
test eax, eax
je 0x417a1d
push 0
push 8
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x417a1d
lea ecx, [esp + 0x34]
push ecx
lea edi, [ebp + 0xfff4]
push eax
mov esi, ebp
mov dword [edi], 0
mov dword [esp + 0x3c], 0x224
call ebx
test eax, eax
je 0x4179f1
lea eax, [esp + 0x54]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x417988
sub eax, edx
lea ebx, [edi - 0xc]
add eax, esi
cmp eax, ebx
jae 0x4179f1
lea eax, [esp + 0x54]
mov edx, esi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4179a6
mov edi, ebx
mov dword [edi], esi
mov dl, byte [esi]
add esi, 1
test dl, dl
jne 0x4179b6
cmp byte [esi - 1], 0x2e
lea eax, [esi - 1]
jne 0x4179d1
test eax, eax
je 0x4179d1
mov byte [eax], dl
lea esi, [eax + 1]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x34]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x14]
push edx
push eax
mov dword [edi + 8], ecx
call dword [esp + 0x24]
test eax, eax
jne 0x417981
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x25c]
mov dword [eax], ebp
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x248
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x8000
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
mov dword [edx], 0
xor eax, eax
pop ebp
add esp, 0x248
ret