Function at 0x43ab80
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb98
mov eax, dword [0x468100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0xfa0
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
mov dword [ebp - 0xb80], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [edi - 1]
cmp eax, 0x103
ja 0x43afde
push esi
xor esi, esi
test edi, edi
jle 0x43abf0
lea ecx, [ebp - 0x20c]
sub ebx, ecx
lea edx, [ebx + esi*2]
movzx eax, word [ebp + edx - 0x20c]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov word [ebp + esi*2 - 0x20c], ax
inc esi
cmp esi, edi
jl 0x43abd1
lea edx, [ebp - 0x528]
xor ecx, ecx
push edx
mov word [ebp + edi*2 - 0x20c], cx
mov dword [ebp - 0x528], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x43ac2d
pop esi
pop edi
mov eax, 0x25e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x518]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, 2
je 0x43ac5f
cmp eax, 1
je 0x43adf7
pop esi
pop edi
mov eax, 0x25f
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 4
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43afae
push str.EnumProcesses
push edi
call ebx
push str.EnumProcessModules
push edi
mov esi, eax
call ebx
push str.GetModuleBaseNameW
push edi
mov dword [ebp - 0xb88], eax
call ebx
mov dword [ebp - 0xb90], eax
test esi, esi
je 0x43afa7
cmp dword [ebp - 0xb88], 0
je 0x43afa7
test eax, eax
je 0x43afa7
mov ecx, dword [ebp - 0xb80]
lea eax, [ebp - 0xb94]
push eax
push 0x3e8
push ecx
call esi
test eax, eax
jne 0x43acfc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0xb80]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
mov eax, 0x25d
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0xb94]
shr eax, 2
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xb84], 0
test eax, eax
je 0x43adfd
lea ecx, [ecx]
push 0x457830
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 0xb80]
mov edx, dword [ebp - 0xb84]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x43ad8a
lea ecx, [ebp - 0xb94]
push ecx
push 4
lea edx, [ebp - 0xb98]
push edx
push esi
call dword [ebp - 0xb88]
test eax, eax
je 0x43ad8a
mov ecx, dword [ebp - 0xb98]
push 0x104
lea eax, [ebp - 0x414]
push eax
push ecx
push esi
call dword [ebp - 0xb90]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.USER32.dll_CharUpperW]
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43adcb
mov eax, dword [ebp - 0xb84]
inc eax
mov dword [ebp - 0xb84], eax
cmp eax, dword [ebp - 0xb8c]
jb 0x43ad20
jmp 0x43adfd
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0xb80]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xb80]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x518], 1
jne 0x43aedf
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43afae
push 0x457804
push edi
call ebx
push 0x4577f4
mov esi, eax
push edi
mov dword [ebp - 0xb8c], esi
call ebx
push 0x4577e4
push edi
mov dword [ebp - 0xb88], eax
call ebx
push str.Module32FirstW
push edi
mov dword [ebp - 0xb80], eax
call ebx
push str.Module32NextW
push edi
mov dword [ebp - 0xb84], eax
call ebx
cmp dword [ebp - 0xb80], 0
mov dword [ebp - 0xb90], eax
je 0x43afa7
cmp dword [ebp - 0xb88], 0
je 0x43afa7
test eax, eax
je 0x43afa7
cmp dword [ebp - 0xb84], 0
je 0x43afa7
test esi, esi
je 0x43afa7
push 0
push 2
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43afa7
lea ecx, [ebp - 0xb7c]
push ecx
push ebx
mov dword [ebp - 0xb7c], 0x22c
call dword [ebp - 0xb88]
test eax, eax
jne 0x43af06
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0xb8c]
mov edx, dword [ebp - 0xb74]
push edx
push 8
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x43afa0
lea eax, [ebp - 0x950]
push eax
push esi
mov dword [ebp - 0x950], 0x428
call dword [ebp - 0xb84]
test eax, eax
je 0x43af74
jmp 0x43af40
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x930]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43afc6
lea eax, [ebp - 0x950]
push eax
push esi
mov dword [ebp - 0x950], 0x428
call dword [ebp - 0xb90]
test eax, eax
jne 0x43af40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xb7c]
push ecx
push ebx
mov dword [ebp - 0xb7c], 0x22c
call dword [ebp - 0xb80]
test eax, eax
jne 0x43af00
jmp 0x43aed8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
mov eax, 0x25d
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x43addf
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x278
pop ebx
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 4