Function at 0x4188c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45a150
push 0x430418
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x1e34
call fcn.004302f0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
xor esi, esi
mov dword [ebp - 0x30], esi
mov byte [ebp - 0x31c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x31b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0xf0], 0x94
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x418c7c
mov eax, dword [ebp - 0xe0]
cmp eax, 2
jne 0x418b9e
cmp dword [ebp - 0xec], 4
jne 0x418b9e
mov dword [ebp - 4], ebx
push str.PSAPI.DLL
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call edi
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x418b40
push str.VDMDBG.DLL
call edi
mov dword [ebp - 0x24], eax
test eax, eax
je 0x418b40
push str.EnumProcesses
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x44], eax
push str.EnumProcessModules
push ebx
call edi
mov ebx, eax
mov dword [ebp - 0x4c], ebx
push str.GetModuleBaseNameA
mov ecx, dword [ebp - 0x1c]
push ecx
call edi
mov dword [ebp - 0x38], eax
push str.VDMEnumTaskWOWEx
mov edx, dword [ebp - 0x24]
push edx
call edi
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x44]
test edi, edi
je 0x418b40
test ebx, ebx
je 0x418b40
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x418b40
test eax, eax
je 0x418b40
mov dword [ebp - 0x28], 0x400
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ebx, [ebx]
test esi, esi
je 0x418a0d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x20]
lea ecx, [eax + eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x28]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov esi, eax
mov dword [ebp - 0x30], esi
test esi, esi
je 0x418b40
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
push esi
call edi
test eax, eax
je 0x418b40
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x28]
je 0x4189f0
mov eax, edx
shr eax, 2
mov dword [ebp - 0x20], eax
xor edi, edi
mov dword [ebp - 0x48], edi
cmp edi, dword [ebp - 0x20]
jae 0x418b40
mov byte [ebp - 0x31c], 0
mov eax, dword [esi + edi*4]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x58], ebx
test ebx, ebx
je 0x418ab2
lea ecx, [ebp - 0x28]
push ecx
push 4
lea edx, [ebp - 0x40]
push edx
push ebx
call dword [ebp - 0x4c]
test eax, eax
je 0x418aab
push 0x104
lea eax, [ebp - 0x31c]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
push ebx
call dword [ebp - 0x38]
test eax, eax
jne 0x418aab
mov byte [ebp - 0x31c], al
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp + 0xc]
push ebx
lea edx, [ebp - 0x31c]
push edx
push 0
mov eax, dword [esi + edi*4]
push eax
call dword [ebp + 8]
test eax, eax
je 0x418b40
push str.NTVDM.EXE
lea ecx, [ebp - 0x31c]
push ecx
call fcn.00431f9e
add esp, 8
test eax, eax
jne 0x418b3a
lea ecx, [ebp - 0x153c]
call fcn.004180d0
mov edx, dword [esi + edi*4]
mov dword [ebp - 0x153c], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1538], eax
mov dword [ebp - 0x1534], ebx
mov dword [ebp - 0x1530], 0
lea ecx, [ebp - 0x153c]
push ecx
push 0x417f00
mov edx, dword [esi + edi*4]
push edx
call dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1530]
test eax, eax
jne 0x418b40
lea eax, [ebp - 0x153c]
push eax
mov ecx, ebx
call fcn.00418830
inc edi
jmp 0x418a4e
mov dword [ebp - 4], 0xffffffff
call fcn.00418b6d
mov eax, dword [ebp - 0x1c]
push eax
call edi
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp eax, 1
je 0x418bb9
cmp eax, 2
jne 0x418c7c
cmp dword [ebp - 0xec], 4
jbe 0x418c7c
mov dword [ebp - 4], 1
push str.Kernel32.DLL
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, ebx
je 0x418d96
cmp dword [ebp - 0xe0], 2
jne 0x418bf5
push str.VDMDBG.DLL
call esi
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x418d96
push str.CreateToolhelp32Snapshot
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov ebx, eax
mov dword [ebp - 0x5c], ebx
push str.Process32First
push edi
call esi
mov dword [ebp - 0x34], eax
push str.Process32Next
push edi
call esi
mov dword [ebp - 0x50], eax
test eax, eax
je 0x418d96
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x418d96
test ebx, ebx
je 0x418d96
cmp dword [ebp - 0xe0], 2
jne 0x418c58
push str.VDMEnumTaskWOWEx
mov ecx, dword [ebp - 0x24]
push ecx
call esi
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x418d96
push 0
push 2
call ebx
mov ebx, eax
mov dword [ebp - 0x54], ebx
cmp ebx, 0xffffffff
jne 0x418c91
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
lea edx, [ebp - 0x10]
push edx
call fcn.0043018a
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x218], 0x128
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [ebp - 0x34]
mov esi, eax
mov dword [ebp - 0x3c], esi
jmp 0x418cb0
test esi, esi
je 0x418d96
lea ecx, [ebp - 0x1e4c]
call fcn.004180d0
lea ecx, [ebp - 0x1e4c]
push ecx
lea edx, [ebp - 0x1f4]
push edx
push 0
mov eax, dword [ebp - 0x210]
push eax
mov esi, dword [ebp + 8]
call esi
test eax, eax
je 0x418d8c
push str.NTVDM.EXE
lea ecx, [ebp - 0x1f4]
push ecx
call fcn.00431f9e
add esp, 8
test eax, eax
jne 0x418d59
lea ecx, [ebp - 0xc2c]
call fcn.004180d0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0xc2c], eax
mov dword [ebp - 0xc28], esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc24], edi
mov dword [ebp - 0xc20], 0
lea edx, [ebp - 0xc2c]
push edx
push 0x417f00
push eax
call dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc20]
test eax, eax
jne 0x418d93
lea eax, [ebp - 0xc2c]
push eax
mov ecx, edi
call fcn.00418830
jmp 0x418d5c
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x218], 0x128
lea ecx, [ebp - 0x218]
push ecx
push ebx
call dword [ebp - 0x50]
mov esi, eax
mov dword [ebp - 0x3c], esi
lea edx, [ebp - 0x1e4c]
push edx
mov ecx, edi
call fcn.00418830
mov edi, dword [ebp - 0x1c]
jmp 0x418cb0
xor esi, esi
jmp 0x418ca8
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.00418daa
jmp 0x418b4c