Function at 0x437fe0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb98
mov eax, dword [0x465100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0xfa0
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
mov dword [ebp - 0xb80], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [edi - 1]
cmp eax, 0x103
ja 0x43843e
push esi
xor esi, esi
test edi, edi
jle 0x438050
lea ecx, [ebp - 0x20c]
sub ebx, ecx
lea edx, [ebx + esi*2]
movzx eax, word [ebp + edx - 0x20c]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov word [ebp + esi*2 - 0x20c], ax
inc esi
cmp esi, edi
jl 0x438031
lea edx, [ebp - 0x528]
xor ecx, ecx
push edx
mov word [ebp + edi*2 - 0x20c], cx
mov dword [ebp - 0x528], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x43808d
pop esi
pop edi
mov eax, 0x25e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b634
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x518]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, 2
je 0x4380bf
cmp eax, 1
je 0x438257
pop esi
pop edi
mov eax, 0x25f
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b634
mov esp, ebp
pop ebp
ret 4
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43840e
push str.EnumProcesses
push edi
call ebx
push str.EnumProcessModules
push edi
mov esi, eax
call ebx
push str.GetModuleBaseNameW
push edi
mov dword [ebp - 0xb88], eax
call ebx
mov dword [ebp - 0xb90], eax
test esi, esi
je 0x438407
cmp dword [ebp - 0xb88], 0
je 0x438407
test eax, eax
je 0x438407
mov ecx, dword [ebp - 0xb80]
lea eax, [ebp - 0xb94]
push eax
push 0x3e8
push ecx
call esi
test eax, eax
jne 0x43815c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0xb80]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
mov eax, 0x25d
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b634
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0xb94]
shr eax, 2
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xb84], 0
test eax, eax
je 0x43825d
lea ecx, [ecx]
push 0x454820
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 0xb80]
mov edx, dword [ebp - 0xb84]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4381ea
lea ecx, [ebp - 0xb94]
push ecx
push 4
lea edx, [ebp - 0xb98]
push edx
push esi
call dword [ebp - 0xb88]
test eax, eax
je 0x4381ea
mov ecx, dword [ebp - 0xb98]
push 0x104
lea eax, [ebp - 0x414]
push eax
push ecx
push esi
call dword [ebp - 0xb90]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.USER32.dll_CharUpperW]
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43822b
mov eax, dword [ebp - 0xb84]
inc eax
mov dword [ebp - 0xb84], eax
cmp eax, dword [ebp - 0xb8c]
jb 0x438180
jmp 0x43825d
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0xb80]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b634
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xb80]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x518], 1
jne 0x43833f
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43840e
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Process32FirstW
mov esi, eax
push edi
mov dword [ebp - 0xb8c], esi
call ebx
push str.Process32NextW
push edi
mov dword [ebp - 0xb88], eax
call ebx
push str.Module32FirstW
push edi
mov dword [ebp - 0xb80], eax
call ebx
push str.Module32NextW
push edi
mov dword [ebp - 0xb84], eax
call ebx
cmp dword [ebp - 0xb80], 0
mov dword [ebp - 0xb90], eax
je 0x438407
cmp dword [ebp - 0xb88], 0
je 0x438407
test eax, eax
je 0x438407
cmp dword [ebp - 0xb84], 0
je 0x438407
test esi, esi
je 0x438407
push 0
push 2
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x438407
lea ecx, [ebp - 0xb7c]
push ecx
push ebx
mov dword [ebp - 0xb7c], 0x22c
call dword [ebp - 0xb88]
test eax, eax
jne 0x438366
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b634
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0xb8c]
mov edx, dword [ebp - 0xb74]
push edx
push 8
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x438400
lea eax, [ebp - 0x950]
push eax
push esi
mov dword [ebp - 0x950], 0x428
call dword [ebp - 0xb84]
test eax, eax
je 0x4383d4
jmp 0x4383a0
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x930]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x438426
lea eax, [ebp - 0x950]
push eax
push esi
mov dword [ebp - 0x950], 0x428
call dword [ebp - 0xb90]
test eax, eax
jne 0x4383a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xb7c]
push ecx
push ebx
mov dword [ebp - 0xb7c], 0x22c
call dword [ebp - 0xb80]
test eax, eax
jne 0x438360
jmp 0x438338
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
mov eax, 0x25d
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b634
mov esp, ebp
pop ebp
ret 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x43823f
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x278
pop ebx
call fcn.0043b634
mov esp, ebp
pop ebp
ret 4