Function at 0x40fbe0
Capabilities:
Check os version
Link many functions at runtime
Terminate process

Disassembly:
mov eax, 0x15a4
call fcn.004420b0
mov eax, dword [0x4740f4]
xor eax, esp
mov dword [esp + 0x15a0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x15b0]
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fc06
sub eax, edx
mov ebx, eax
lea eax, [ebx - 1]
cmp eax, 0x103
ja 0x41011f
push esi
xor esi, esi
push edi
test ebx, ebx
jle 0x40fc4b
lea ecx, [esp + 0x13a8]
sub ebp, ecx
lea edi, [esp + esi + 0x13a8]
movsx edx, byte [edi + ebp]
push edx
call fcn.00442cab
inc esi
add esp, 4
cmp esi, ebx
mov byte [edi], al
jl 0x40fc30
lea eax, [esp + 0xfc8]
push eax
mov byte [esp + ebx + 0x13ac], 0
mov dword [esp + 0xfcc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40fc7a
mov eax, 0x25e
jmp 0x40fe96
mov eax, dword [esp + 0xfd8]
cmp eax, 2
je 0x40fc98
cmp eax, 1
je 0x40fc95
mov eax, 0x25f
jmp 0x40fe96
cmp eax, 2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jb 0x40fdf9
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x40fcc3
mov eax, 0x25d
jmp 0x40fe96
push str.EnumProcesses
push ebx
call edi
push str.EnumProcessModules
push ebx
mov esi, eax
call edi
push str.GetModuleBaseNameA
mov ebp, eax
push ebx
mov dword [esp + 0x1c], ebp
call edi
mov dword [esp + 0x18], eax
test esi, esi
je 0x40fecb
test ebp, ebp
je 0x40fecb
test eax, eax
je 0x40fecb
lea ecx, [esp + 0x1c]
push ecx
push 0x3e8
lea edx, [esp + 0x30]
push edx
call esi
test eax, eax
jne 0x40fd25
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x2bd
jmp 0x40fe96
mov ebp, dword [esp + 0x1c]
shr ebp, 2
xor ebx, ebx
test ebp, ebp
jbe 0x40fdf2
jmp 0x40fd40
mov edx, dword [esp + ebx*4 + 0x28]
mov eax, dword [str.Unknown]
mov ecx, dword [0x45e25c]
push edx
push 0
push 0x410
mov dword [esp + 0x14b8], eax
mov dword [esp + 0x14bc], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40fd9d
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [esp + 0x24]
test eax, eax
je 0x40fd9d
mov eax, dword [esp + 0x24]
push 0x104
lea edx, [esp + 0x14b0]
push edx
push eax
push esi
call dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14ac]
push ecx
lea esi, [esp + 0x13ac]
call fcn.00442b30
add esp, 4
jmp 0x40fdc0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x40fde0
test cl, cl
je 0x40fddc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x40fde0
add eax, 2
add esi, 2
test cl, cl
jne 0x40fdc0
xor eax, eax
jmp 0x40fde5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40fe1e
inc ebx
cmp ebx, ebp
jb 0x40fd40
mov eax, dword [esp + 0xfd8]
cmp eax, 1
jne 0x41010a
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x40fed9
mov eax, 0x2be
jmp 0x40fe96
cmp dword [esp + 0x15bc], 0
je 0x40febc
cmp dword [esp + 0xfcc], 5
jne 0x40feaf
mov eax, dword [esp + ebx*4 + 0x28]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40fe86
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
test eax, eax
je 0x40fe6e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x40fe96
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x25a
jmp 0x40fe96
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x25c
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x15a0]
xor ecx, esp
call fcn.0043fd57
add esp, 0x15a4
ret
mov ecx, dword [esp + ebx*4 + 0x28]
push ecx
call fcn.00410400
add esp, 4
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x40fe96
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x2bc
jmp 0x40fe96
push 0x45e22c
push ebx
call edi
push 0x45e21c
push ebx
mov dword [esp + 0x18], eax
call edi
push 0x45e20c
push ebx
mov esi, eax
call edi
push str.Module32First
mov ebp, eax
push ebx
mov dword [esp + 0x28], ebp
call edi
push str.Module32Next
push ebx
mov dword [esp + 0x1c], eax
call edi
mov dword [esp + 0x18], eax
test ebp, ebp
je 0x4100f9
test esi, esi
je 0x4100f9
test eax, eax
je 0x4100f9
cmp dword [esp + 0x14], 0
je 0x4100f9
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4100f9
push 0
push 2
call eax
mov ebp, eax
cmp ebp, 0xffffffff
je 0x410057
lea eax, [esp + 0x105c]
push eax
push ebp
mov dword [esp + 0x1064], 0x128
call esi
test eax, eax
je 0x410038
mov esi, 0x224
jmp 0x40ff80
mov ecx, dword [esp + 0x1064]
push ecx
push 8
call dword [esp + 0x18]
mov edi, eax
cmp edi, 0xffffffff
je 0x410050
lea edx, [esp + 0x1184]
push edx
push edi
mov dword [esp + 0x118c], esi
call dword [esp + 0x1c]
test eax, eax
je 0x410011
jmp 0x40ffc0
lea ecx, [esp + 0x13a8]
lea eax, [esp + 0x11a4]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40fff0
test dl, dl
je 0x40ffec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40fff0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ffd0
xor eax, eax
jmp 0x40fff5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x410068
lea eax, [esp + 0x1184]
push eax
push edi
mov dword [esp + 0x118c], esi
call dword [esp + 0x20]
test eax, eax
jne 0x40ffc0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x105c]
push ecx
push ebp
mov dword [esp + 0x1064], 0x128
call dword [esp + 0x28]
test eax, eax
jne 0x40ff80
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x25b
jmp 0x40fe96
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x2c0
jmp 0x40fe96
cmp dword [esp + 0x15bc], 0
jne 0x41008c
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebp
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x40fe96
mov edx, dword [esp + 0x1064]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4100e7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4100ce
call edi
push ebp
call edi
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x40fe96
call edi
push ebp
call edi
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x25a
jmp 0x40fe96
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebp
call esi
push ebx
jmp 0x40fe8b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x2bf
jmp 0x40fe96
mov ebx, dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x25b
jmp 0x40fe96
mov ecx, dword [esp + 0x15a8]
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x278
call fcn.0043fd57
add esp, 0x15a4
ret