Function at 0x404a20
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
mov eax, 0x15a0
call fcn.00412d00
push ebx
push ebp
mov ebp, dword [esp + 0x15ac]
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404a38
sub eax, edx
mov ebx, eax
cmp ebx, 1
jl 0x404f47
cmp ebx, 0x104
jg 0x404f47
push esi
xor esi, esi
test ebx, ebx
push edi
jle 0x404a8b
lea eax, [esp + 0x1e4]
sub ebp, eax
lea esp, [esp]
lea edi, [esp + esi + 0x1e4]
movsx ecx, byte [edi + ebp]
push ecx
call fcn.00412cda
add esp, 4
inc esi
cmp esi, ebx
mov byte [edi], al
jl 0x404a70
lea edx, [esp + 0x28]
push edx
mov byte [esp + ebx + 0x1e8], 0
mov dword [esp + 0x2c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x404aba
pop edi
pop esi
pop ebp
mov eax, 0x25e
pop ebx
add esp, 0x15a0
ret
mov eax, dword [esp + 0x38]
cmp eax, 2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x404ae2
cmp eax, 1
je 0x404c42
pop edi
pop esi
pop ebp
mov eax, 0x25f
pop ebx
add esp, 0x15a0
ret
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x404b07
pop edi
pop esi
pop ebp
mov eax, 0x25d
pop ebx
add esp, 0x15a0
ret
push str.EnumProcesses
push ebx
call edi
push str.EnumProcessModules
push ebx
mov esi, eax
call edi
push str.GetModuleBaseNameA
mov ebp, eax
push ebx
mov dword [esp + 0x1c], ebp
call edi
test esi, esi
mov dword [esp + 0x18], eax
je 0x404ce7
test ebp, ebp
je 0x404ce7
test eax, eax
je 0x404ce7
lea eax, [esp + 0x1c]
push eax
push 0x3e8
lea ecx, [esp + 0x618]
push ecx
call esi
test eax, eax
jne 0x404b72
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bd
pop ebx
add esp, 0x15a0
ret
mov ebx, dword [esp + 0x1c]
shr ebx, 2
xor ebp, ebp
test ebx, ebx
jbe 0x404c37
mov ecx, dword [esp + ebp*4 + 0x610]
mov edx, dword [str.Unknown]
mov eax, dword [0x431b48]
push ecx
push 0
push 0x410
mov dword [esp + 0x2f4], edx
mov dword [esp + 0x2f8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x404be3
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x2c]
push eax
push esi
call dword [esp + 0x24]
test eax, eax
je 0x404be3
mov edx, dword [esp + 0x24]
push 0x104
lea ecx, [esp + 0x2ec]
push ecx
push edx
push esi
call dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x2e8]
push eax
lea esi, [esp + 0x1e8]
call fcn.00412afd
add esp, 4
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x404c25
test cl, cl
je 0x404c21
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x404c25
add eax, 2
add esi, 2
test cl, cl
jne 0x404c01
xor eax, eax
jmp 0x404c2a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404c67
inc ebp
cmp ebp, ebx
jb 0x404b83
cmp dword [esp + 0x38], 1
jne 0x404f2c
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
jne 0x404cfe
pop edi
pop esi
pop ebp
mov eax, 0x2be
pop ebx
add esp, 0x15a0
ret
mov eax, dword [esp + ebp*4 + 0x610]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x404ccc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push esi
je 0x404cab
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x15a0
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25a
pop ebx
add esp, 0x15a0
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25c
pop ebx
add esp, 0x15a0
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bc
pop ebx
add esp, 0x15a0
ret
push str.CreateToolhelp32Snapshot
push ebp
call edi
push str.Process32First
push ebp
mov dword [esp + 0x18], eax
call edi
push str.Process32Next
push ebp
mov esi, eax
call edi
push str.Module32First
mov ebx, eax
push ebp
mov dword [esp + 0x28], ebx
call edi
push str.Module32Next
push ebp
mov dword [esp + 0x1c], eax
call edi
test ebx, ebx
mov dword [esp + 0x18], eax
je 0x404f15
test esi, esi
je 0x404f15
test eax, eax
je 0x404f15
mov eax, dword [esp + 0x14]
test eax, eax
je 0x404f15
mov eax, dword [esp + 0x10]
test eax, eax
je 0x404f15
push 0
push 2
call eax
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404e85
lea ecx, [esp + 0xbc]
push ecx
push ebx
mov dword [esp + 0xc4], 0x128
call esi
test eax, eax
je 0x404e60
lea esp, [esp]
mov edx, dword [esp + 0xc4]
push edx
push 8
call dword [esp + 0x18]
mov edi, eax
cmp edi, 0xffffffff
je 0x404e7e
lea eax, [esp + 0x3ec]
push eax
push edi
mov dword [esp + 0x3f4], 0x224
call dword [esp + 0x1c]
test eax, eax
je 0x404e39
jmp 0x404de0
lea esi, [esp + 0x1e4]
lea eax, [esp + 0x40c]
mov edi, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x404e14
test cl, cl
je 0x404e10
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x404e14
add eax, 2
add esi, 2
test cl, cl
jne 0x404df0
xor eax, eax
jmp 0x404e19
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404e9c
lea eax, [esp + 0x3ec]
push eax
push edi
mov dword [esp + 0x3f4], 0x224
call dword [esp + 0x20]
test eax, eax
jne 0x404de0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xbc]
push ecx
push ebx
mov dword [esp + 0xc4], 0x128
call dword [esp + 0x28]
test eax, eax
jne 0x404da0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25b
pop ebx
add esp, 0x15a0
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2c0
pop ebx
add esp, 0x15a0
ret
mov edx, dword [esp + 0xc4]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x404f03
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x404ee4
call edi
push ebx
call edi
push esi
call edi
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x15a0
ret
call edi
push ebx
call edi
push esi
call edi
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25a
pop ebx
add esp, 0x15a0
ret
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
push ebp
jmp 0x404cd1
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x2bf
pop ebx
add esp, 0x15a0
ret
mov ebp, dword [esp + 0x10]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 0x25b
pop ebx
add esp, 0x15a0
ret
pop ebp
mov eax, 0x278
pop ebx
add esp, 0x15a0
ret