Function at 0x426670
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x68f500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
push esi
push edi
mov esi, dword [eax]
mov ebx, ecx
mov eax, dword [0x6a4ff4]
cmp eax, dword [esi + 4]
jle 0x4266d0
push 0x6a4ff4
call fcn.005ab465
add esp, 4
cmp dword [0x6a4ff4], 0xffffffff
jne 0x4266d0
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x6a4ff4
mov dword [0x6a52e0], eax
call fcn.005ab414
add esp, 4
mov eax, dword [0x694a44]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, dword [esi + 4]
jle 0x426718
push 0x694a44
call fcn.005ab465
add esp, 4
cmp dword [0x694a44], 0xffffffff
jne 0x426718
push str.OpenProcess
push dword [0x6a52e0]
call edi
push 0x694a44
mov dword [0x694a94], eax
call fcn.005ab414
add esp, 4
mov eax, dword [0x6a0fa0]
cmp eax, dword [esi + 4]
jle 0x42675a
push 0x6a0fa0
call fcn.005ab465
add esp, 4
cmp dword [0x6a0fa0], 0xffffffff
jne 0x42675a
push str.CreateToolhelp32Snapshot
push dword [0x6a52e0]
call edi
push 0x6a0fa0
mov dword [0x6a4ff0], eax
call fcn.005ab414
add esp, 4
mov eax, dword [0x6a97a0]
cmp eax, dword [esi + 4]
jle 0x42679c
push 0x6a97a0
call fcn.005ab465
add esp, 4
cmp dword [0x6a97a0], 0xffffffff
jne 0x42679c
push str.Process32FirstW
push dword [0x6a52e0]
call edi
push 0x6a97a0
mov dword [0x694a8c], eax
call fcn.005ab414
add esp, 4
mov eax, dword [0x694cf8]
cmp eax, dword [esi + 4]
jle 0x4267de
push 0x694cf8
call fcn.005ab465
add esp, 4
cmp dword [0x694cf8], 0xffffffff
jne 0x4267de
push str.Process32NextW
push dword [0x6a52e0]
call edi
push 0x694cf8
mov dword [0x694bc8], eax
call fcn.005ab414
add esp, 4
mov eax, dword [0x694ea8]
cmp eax, dword [esi + 4]
jle 0x426820
push 0x694ea8
call fcn.005ab465
add esp, 4
cmp dword [0x694ea8], 0xffffffff
jne 0x426820
push 0x671be4
push dword [0x6a52e0]
call edi
push 0x694ea8
mov dword [0x694a14], eax
call fcn.005ab414
add esp, 4
mov eax, dword [0x6a4ff0]
push 0
push 2
call eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov dword [ebp - 0x240], esi
mov byte [ebp - 0x239], 0
cmp esi, 0xffffffff
je 0x426970
mov ecx, dword [0x694a8c]
lea eax, [ebp - 0x238]
push eax
push esi
mov dword [ebp - 0x238], 0x22c
call ecx
test eax, eax
je 0x426970
nop dword [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0x248], 0
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x244], 0
movups xmmword [ebp - 0x258], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426897
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x258]
call fcn.0040c390
cmp dword [ebx + 0x14], 7
mov eax, ebx
jbe 0x4268c3
mov eax, dword [ebx]
cmp dword [ebp - 0x244], 7
lea edi, [ebp - 0x258]
mov esi, dword [ebp - 0x248]
cmova edi, dword [ebp - 0x258]
cmp esi, dword [ebx + 0x10]
jne 0x426941
test esi, esi
je 0x426904
sub edi, eax
nop dword [eax + eax]
movzx edx, word [edi + eax]
movzx ecx, word [eax]
cmp dx, cx
jne 0x426941
add eax, 2
sub esi, 1
jne 0x4268f0
lea ecx, [ebp - 0x258]
call fcn.0040a850
push dword [ebp - 0x230]
mov eax, dword [0x694a94]
push 0
push 1
call eax
mov ecx, dword [0x694a14]
mov esi, eax
push 0
push esi
call ecx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
push esi
setne byte [ebp - 0x239]
call edi
jmp 0x426952
lea ecx, [ebp - 0x258]
call fcn.0040a850
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x240]
lea eax, [ebp - 0x238]
mov ecx, dword [0x694bc8]
push eax
push esi
call ecx
test eax, eax
jne 0x426870
push esi
call edi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x239]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005ab3d6
mov esp, ebp
pop ebp
ret