Function at 0x476b60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x53c160]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x25c], 0x519150
mov dword [ebp - 0x258], str.tlhelp32.dll
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x230], 0x224
nop
push dword [ebp + edi*4 - 0x25c]
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x244], esi
test esi, esi
je 0x476c27
push str.CreateToolhelp32Snapshot
push esi
call ebx
push str.Module32First
push esi
mov dword [ebp - 0x234], eax
call ebx
push str.Module32Next
push esi
mov dword [ebp - 0x238], eax
call ebx
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x23c], eax
test edx, edx
je 0x476c1e
cmp dword [ebp - 0x238], 0
je 0x476c1e
test eax, eax
jne 0x476d25
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor esi, esi
inc edi
mov dword [ebp - 0x244], esi
cmp edi, 2
jb 0x476bc0
mov eax, dword [ebp - 0x234]
mov edi, dword [ebp - 0x23c]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x238], eax
test esi, esi
je 0x476d30
mov edx, dword [ebp - 0x234]
push dword [ebp + 0xc]
push 8
call edx
mov dword [ebp - 0x23c], eax
cmp eax, 0xffffffff
je 0x476d30
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x234], 0
push ecx
push eax
call dword [ebp - 0x238]
test eax, eax
je 0x476cef
mov esi, dword [ebp - 0x23c]
xor ebx, ebx
nop dword [eax]
push dword [ebp - 0x218]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x24c]
cdq
push edx
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x240]
call fcn.00476900
lea eax, [ebp - 0x230]
inc ebx
push eax
push esi
call edi
test eax, eax
jne 0x476ca0
mov esi, dword [ebp - 0x244]
mov dword [ebp - 0x234], ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push esi
call edi
cmp dword [ebp - 0x234], 0
jle 0x476d36
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp - 0x23c]
jmp 0x476c5f
mov edi, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push str.psapi.dll
mov dword [ebp - 0x23c], 0
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x258], esi
test esi, esi
je 0x476f28
push str.EnumProcessModules
push esi
call ebx
push str.GetModuleFileNameExA
push esi
mov dword [ebp - 0x244], eax
call ebx
push str.GetModuleBaseNameA
push esi
mov dword [ebp - 0x234], eax
call ebx
push str.GetModuleInformation
push esi
mov dword [ebp - 0x248], eax
call ebx
cmp dword [ebp - 0x244], 0
mov dword [ebp - 0x260], eax
je 0x476f25
cmp dword [ebp - 0x234], 0
je 0x476f25
cmp dword [ebp - 0x248], 0
je 0x476f25
test eax, eax
je 0x476f25
push 0x1fa0
call fcn.004d22f2
add esp, 4
mov dword [ebp - 0x238], eax
push 0x1fa0
call fcn.004d22f2
add esp, 4
mov ebx, eax
push 0x1fa0
call fcn.004d22f2
add esp, 4
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x250]
push eax
push 0x1fa0
push dword [ebp - 0x238]
push dword [ebp - 0x240]
call dword [ebp - 0x244]
test eax, eax
je 0x476edb
mov eax, dword [ebp - 0x250]
cmp eax, 0x1fa0
ja 0x476edb
xor edi, edi
test eax, 0xfffffffc
jbe 0x476edb
mov esi, dword [ebp - 0x254]
push 0xc
lea eax, [ebp - 0x26c]
push eax
mov eax, dword [ebp - 0x238]
push dword [eax + edi*4]
push dword [ebp - 0x240]
call dword [ebp - 0x260]
mov eax, dword [ebp - 0x238]
push 0x1fa0
push ebx
mov byte [ebx], 0
push dword [eax + edi*4]
push dword [ebp - 0x240]
call dword [ebp - 0x234]
mov eax, dword [ebp - 0x238]
push 0x1fa0
push esi
mov byte [esi], 0
push dword [eax + edi*4]
push dword [ebp - 0x240]
call dword [ebp - 0x248]
push dword [ebp - 0x268]
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x24c]
cdq
push edx
push eax
push esi
push ebx
push dword [ebp - 0x240]
call fcn.00476900
mov eax, dword [ebp - 0x250]
inc edi
inc dword [ebp - 0x23c]
shr eax, 2
cmp edi, eax
jb 0x476e41
mov esi, dword [ebp - 0x258]
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push dword [ebp - 0x254]
call fcn.004d217e
add esp, 4
push ebx
call fcn.004d217e
add esp, 4
push dword [ebp - 0x238]
call fcn.004d217e
xor eax, eax
add esp, 4
cmp dword [ebp - 0x23c], eax
setne al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret 8
push esi
call edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret 8