Function at 0x425d30
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x68e500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
push esi
push edi
mov esi, dword [eax]
mov ebx, ecx
mov eax, dword [0x6a3ff4]
cmp eax, dword [esi + 4]
jle 0x425d90
push 0x6a3ff4
call fcn.005aa4e2
add esp, 4
cmp dword [0x6a3ff4], 0xffffffff
jne 0x425d90
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x6a3ff4
mov dword [0x6a42e0], eax
call fcn.005aa491
add esp, 4
mov eax, dword [0x693a44]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, dword [esi + 4]
jle 0x425dd8
push 0x693a44
call fcn.005aa4e2
add esp, 4
cmp dword [0x693a44], 0xffffffff
jne 0x425dd8
push str.OpenProcess
push dword [0x6a42e0]
call edi
push 0x693a44
mov dword [0x693a94], eax
call fcn.005aa491
add esp, 4
mov eax, dword [0x69ffa0]
cmp eax, dword [esi + 4]
jle 0x425e1a
push 0x69ffa0
call fcn.005aa4e2
add esp, 4
cmp dword [0x69ffa0], 0xffffffff
jne 0x425e1a
push str.CreateToolhelp32Snapshot
push dword [0x6a42e0]
call edi
push 0x69ffa0
mov dword [0x6a3ff0], eax
call fcn.005aa491
add esp, 4
mov eax, dword [0x6a87a0]
cmp eax, dword [esi + 4]
jle 0x425e5c
push 0x6a87a0
call fcn.005aa4e2
add esp, 4
cmp dword [0x6a87a0], 0xffffffff
jne 0x425e5c
push str.Process32FirstW
push dword [0x6a42e0]
call edi
push 0x6a87a0
mov dword [0x693a8c], eax
call fcn.005aa491
add esp, 4
mov eax, dword [0x693cf8]
cmp eax, dword [esi + 4]
jle 0x425e9e
push 0x693cf8
call fcn.005aa4e2
add esp, 4
cmp dword [0x693cf8], 0xffffffff
jne 0x425e9e
push str.Process32NextW
push dword [0x6a42e0]
call edi
push 0x693cf8
mov dword [0x693bc8], eax
call fcn.005aa491
add esp, 4
mov eax, dword [0x693ea8]
cmp eax, dword [esi + 4]
jle 0x425ee0
push 0x693ea8
call fcn.005aa4e2
add esp, 4
cmp dword [0x693ea8], 0xffffffff
jne 0x425ee0
push 0x670bb0
push dword [0x6a42e0]
call edi
push 0x693ea8
mov dword [0x693a14], eax
call fcn.005aa491
add esp, 4
mov eax, dword [0x6a3ff0]
push 0
push 2
call eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov dword [ebp - 0x240], esi
mov byte [ebp - 0x239], 0
cmp esi, 0xffffffff
je 0x426030
mov ecx, dword [0x693a8c]
lea eax, [ebp - 0x238]
push eax
push esi
mov dword [ebp - 0x238], 0x22c
call ecx
test eax, eax
je 0x426030
nop dword [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0x248], 0
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x244], 0
movups xmmword [ebp - 0x258], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425f57
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x258]
call fcn.0040bb20
cmp dword [ebx + 0x14], 7
mov eax, ebx
jbe 0x425f83
mov eax, dword [ebx]
cmp dword [ebp - 0x244], 7
lea edi, [ebp - 0x258]
mov esi, dword [ebp - 0x248]
cmova edi, dword [ebp - 0x258]
cmp esi, dword [ebx + 0x10]
jne 0x426001
test esi, esi
je 0x425fc4
sub edi, eax
nop dword [eax + eax]
movzx edx, word [edi + eax]
movzx ecx, word [eax]
cmp dx, cx
jne 0x426001
add eax, 2
sub esi, 1
jne 0x425fb0
lea ecx, [ebp - 0x258]
call fcn.00409f40
push dword [ebp - 0x230]
mov eax, dword [0x693a94]
push 0
push 1
call eax
mov ecx, dword [0x693a14]
mov esi, eax
push 0
push esi
call ecx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
push esi
setne byte [ebp - 0x239]
call edi
jmp 0x426012
lea ecx, [ebp - 0x258]
call fcn.00409f40
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x240]
lea eax, [ebp - 0x238]
mov ecx, dword [0x693bc8]
push eax
push esi
call ecx
test eax, eax
jne 0x425f30
push esi
call edi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x239]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005aa453
mov esp, ebp
pop ebp
ret