Function at 0x402920
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x45bd7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a8
push ebx
push str.kernel32.dll
mov dword [esp + 0x2b8], 0
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x402b80
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push edi
push str.CreateToolhelp32Snapshot
push ebx
call esi
push str.Process32First
push ebx
mov edi, eax
call esi
push str.Process32Next
push ebx
mov ebp, eax
call esi
push str.Module32First
push ebx
mov dword [esp + 0x2c], eax
call esi
push str.Module32Next
push ebx
call esi
push 0
push 2
call edi
mov esi, eax
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x90]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x8c]
mov dword [esp + 0x2c], esi
push eax
push esi
mov dword [esp + 0x94], 0x128
call ebp
test eax, eax
je 0x402b6f
mov ebp, dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
mov edi, dword [esp + 0x94]
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
cmp edi, eax
je 0x402b5a
lea ecx, [esp + 0x1b4]
push 0x104
lea edx, [esp + 0xb4]
push ecx
push edx
call ebp
mov al, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
call fcn.00401d20
lea edi, [esp + 0x1b4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x1b8]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401d70
xor esi, esi
lea ecx, [esp + 0x34]
push esi
call fcn.004027e0
lea ecx, [esp + 0x28]
mov byte [esp + 0x2c0], 2
mov dword [esp + 0x34], vtable.std::ctype_char_.0
call fcn.0043e33e
push 0x47815c
lea ecx, [esp + 0x50]
mov byte [esp + 0x2c4], 3
call fcn.0043be6e
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c4], 4
call fcn.00402820
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2c0], 3
call fcn.0043bf27
cmp dword [esp + 0x48], esi
je 0x402ab0
mov edx, dword [esp + 0x44]
push edx
call fcn.0042bce3
add esp, 4
mov dword [esp + 0x48], esi
mov eax, dword [0x4823ec]
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], eax
mov byte [esp + 0x2c0], 2
call fcn.0043e3da
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c0], 5
call fcn.00401ca0
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x402aea
mov ecx, dword [esp + 0x1c]
lea esi, [ecx + eax]
lea ecx, [esp + 0x14]
call fcn.00401ca0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
push esi
push edx
lea ecx, [esp + 0x3c]
call dword [eax + 4]
mov eax, dword [esp + 0x2cc]
test eax, eax
jne 0x402b14
mov eax, 0x4617ac
mov ecx, dword [esp + 0x2d0]
push ecx
push 0
push eax
lea ecx, [esp + 0x20]
call fcn.00402890
cmp eax, 0xffffffff
je 0x402b3a
mov edx, dword [esp + 0x30]
push edx
call fcn.004011b0
add esp, 4
lea ecx, [esp + 0x34]
call fcn.00401760
push 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c4], 0
call fcn.00401d20
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x8c]
push eax
push esi
call dword [esp + 0x2c]
test eax, eax
jne 0x4029d5
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2c0]
pop ebx
test ecx, ecx
je 0x402bbb
mov al, byte [ecx - 1]
test al, al
je 0x402bb1
cmp al, 0xff
je 0x402bb1
dec al
mov byte [ecx - 1], al
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
add esp, 0x2b4
ret
dec ecx
push ecx
call fcn.0044f31a
add esp, 4
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
add esp, 0x2b4
ret