Function at 0x4810c0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x54515d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4b0
mov eax, dword [0x5ab980]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], eax
xor esi, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x4c8], esi
mov eax, dword [str.unknown]
mov ecx, dword [0x5a0a00]
mov dword [esp + 0x218], eax
mov dword [esp + 0x21c], ecx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x220]
push 0xa
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x4cc], 1
mov dword [esp + 0x20], esi
call fcn.00510deb
push esi
lea ecx, [esp + 0x320]
mov byte [esp + 0x4cc], 2
call fcn.0042c900
mov edx, dword [0x5ab980]
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x4d4]
mov byte [esp + 0x4c8], 4
call fcn.0051286f
lea eax, [esp + 0x184]
mov dword [esp + 0x184], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4812f2
mov edi, dword [esp + 0x194]
xor ecx, ecx
cmp edi, 2
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sete cl
push str.CreateToolhelp32Snapshot
push str.Kernel32.DLL
mov dword [esp + 0x28], ecx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Process32First
push str.Kernel32.DLL
mov ebp, eax
call edi
push eax
call esi
push str.Process32Next
push str.Kernel32.DLL
mov ebx, eax
call edi
push eax
call esi
test ebp, ebp
mov dword [esp + 0x2c], eax
je 0x4812f2
test ebx, ebx
je 0x4812f2
test eax, eax
je 0x4812f2
push 0
push 2
call ebp
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4812f2
push str.ZAPLUS.EXE
lea ecx, [esp + 0x38]
call fcn.00510f1c
push str.VSMON.EXE
lea ecx, [esp + 0x38]
call fcn.00510f1c
push str.ZONEALARM.EXE
lea ecx, [esp + 0x38]
call fcn.00510f1c
push str.ZLCLIENT.EXE
lea ecx, [esp + 0x38]
call fcn.00510f1c
push str.MCAGENT.EXE
lea ecx, [esp + 0x38]
call fcn.00510f1c
push str.NMAIN.EXE
lea ecx, [esp + 0x38]
call fcn.00510f1c
push str.NISUM.EXE
lea ecx, [esp + 0x38]
call fcn.00510f1c
push str.NISERV.EXE
lea ecx, [esp + 0x38]
call fcn.00510f1c
push str.IAMAPP.EXE
lea ecx, [esp + 0x38]
call fcn.00510f1c
push str.BLACKD.EXE
lea ecx, [esp + 0x38]
call fcn.00510f1c
push str.BLACKICE.EXE
lea ecx, [esp + 0x38]
call fcn.00510f1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x481368
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4812f2
push str.EnumProcessModules
push edi
call esi
push str.GetModuleFileNameExA
push edi
mov dword [esp + 0x30], eax
call esi
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x54], eax
test ecx, ecx
je 0x4812e5
test eax, eax
jne 0x48136c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c8], 3
call fcn.005128e4
lea ecx, [esp + 0x31c]
mov byte [esp + 0x4c8], 2
call fcn.0042caf0
lea ecx, [esp + 0x34]
mov byte [esp + 0x4c8], 1
call fcn.00510e5f
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c8], 0
call fcn.005128e4
lea ecx, [esp + 0x14]
mov dword [esp + 0x4c8], 0xffffffff
call fcn.005128e4
xor eax, eax
mov ecx, dword [esp + 0x4c0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4bc
ret
mov edi, dword [esp + 0x2c]
lea edx, [esp + 0x5c]
mov dword [esp + 0x5c], 0x128
push edx
push ebp
call ebx
test eax, eax
je 0x4814e8
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4814e8
mov eax, dword [esp + 0x64]
push eax
push 0
push 0x400
call ebx
mov esi, eax
test esi, esi
je 0x4814ce
mov ecx, dword [esp + 0x4d0]
mov eax, dword [esp + 0x64]
cmp eax, ecx
je 0x4814ce
lea edx, [esp + 0x80]
lea ecx, [esp + 0x10]
push edx
call fcn.00512a6d
mov eax, dword [esp + 0x20]
test eax, eax
je 0x481448
lea eax, [esp + 0x58]
lea ecx, [esp + 0x50]
push eax
push 4
push ecx
push esi
call dword [esp + 0x38]
test eax, eax
je 0x481489
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x218]
push 0x104
push edx
push eax
push esi
call dword [esp + 0x64]
lea ecx, [esp + 0x218]
push ecx
lea ecx, [esp + 0x34]
call fcn.00512952
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
mov byte [esp + 0x4d4], 5
call fcn.004222e0
add esp, 0xc
mov byte [esp + 0x4c8], 4
lea ecx, [esp + 0x30]
jmp 0x481484
lea edx, [esp + 0x80]
lea ecx, [esp + 0x24]
push edx
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x28]
push ecx
push edx
mov byte [esp + 0x4d4], 6
call fcn.004222e0
add esp, 0xc
mov byte [esp + 0x4c8], 4
lea ecx, [esp + 0x24]
call fcn.005128e4
lea ecx, [esp + 0x10]
call fcn.00512e06
mov eax, dword [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x3c]
call fcn.0051111f
test eax, eax
je 0x4814bf
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 1
push ecx
mov ecx, dword [esp + 0x4d8]
call fcn.00512a1d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x5c]
mov dword [esp + 0x5c], 0x128
push edx
push ebp
call dword [esp + 0x34]
test eax, eax
jne 0x48138a
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c8], 3
call fcn.005128e4
lea ecx, [esp + 0x31c]
mov byte [esp + 0x4c8], 2
call fcn.0042caf0
lea ecx, [esp + 0x34]
mov byte [esp + 0x4c8], 1
call fcn.00510e5f
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c8], 0
call fcn.005128e4
lea ecx, [esp + 0x14]
mov dword [esp + 0x4c8], 0xffffffff
call fcn.005128e4
mov eax, dword [esp + 0x1c]
jmp 0x48134f