Function at 0x477730
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x784
mov eax, dword [0x510620]
xor eax, esp
mov dword [esp + 0x780], eax
push ebx
push esi
push edi
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x477af6
mov eax, dword [esp + 0x50]
cmp eax, 2
jne 0x477a04
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.PSAPI.DLL
call esi
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x477af6
push str.VDMDBG.DLL
call esi
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x477af6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push ebx
call esi
push str.EnumProcessModules
push ebx
mov dword [esp + 0x24], eax
call esi
push str.GetModuleFileNameExW
push ebx
mov dword [esp + 0x20], eax
call esi
push str.VDMEnumTaskWOWEx
push edi
mov dword [esp + 0x14], eax
call esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
test esi, esi
je 0x4779e1
cmp dword [esp + 0x18], 0
je 0x4779e1
cmp dword [esp + 0xc], 0
je 0x4779e1
test eax, eax
je 0x4779e1
mov edx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, 0x400
mov dword [esp + 0x24], eax
xor edi, edi
test edi, edi
je 0x477836
push edi
push 0
call edx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x24]
mov edx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add eax, eax
mov dword [esp + 0x24], eax
push eax
push 0
call edx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x4779bb
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x28]
push edi
call esi
test eax, eax
je 0x4779aa
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
mov edx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp ecx, eax
je 0x477816
shr ecx, 2
mov dword [esp + 0x3c], ecx
test ecx, ecx
je 0x477970
xor ebx, ebx
xor eax, eax
mov word [esp + 0x388], ax
push dword [edi + ebx*4]
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4778e0
lea eax, [esp + 0x24]
push eax
push 4
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x28]
test eax, eax
je 0x4778d9
push 0x400
lea eax, [esp + 0x38c]
push eax
push dword [esp + 0x30]
push esi
call dword [esp + 0x1c]
test eax, eax
jne 0x4778d9
mov word [esp + 0x388], ax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea eax, [esp + 0x38c]
push eax
push 0
push dword [edi + ebx*4]
call fcn.00477b20
test eax, eax
je 0x47796c
lea ecx, [esp + 0x388]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x477902
sub ecx, edx
sar ecx, 1
push str.NTVDM.EXE
lea eax, [esp + ecx*2 + 0x37a]
push eax
call fcn.0049a920
add esp, 8
test eax, eax
jne 0x477961
mov eax, dword [edi + ebx*4]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
push 0x477b10
mov dword [esp + 0x38], fcn.00477b20
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
push dword [edi + ebx*4]
call dword [esp + 0x2c]
cmp dword [esp + 0x38], 0
jne 0x47796c
inc ebx
cmp ebx, dword [esp + 0x3c]
jb 0x477883
mov ebx, dword [esp + 0x10]
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push ebx
call esi
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x780]
xor ecx, esp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call esi
push dword [esp + 0x14]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x780]
xor ecx, esp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call esi
push edi
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x780]
xor ecx, esp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x477af6
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x477af6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push ebx
call esi
push str.Process32First
push ebx
mov dword [esp + 0x18], eax
call esi
push str.Process32Next
push ebx
mov dword [esp + 0x14], eax
call esi
mov edi, eax
test edi, edi
je 0x477aef
cmp dword [esp + 0xc], 0
je 0x477aef
mov eax, dword [esp + 0x10]
test eax, eax
je 0x477aef
push 0
push 2
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x477aef
lea eax, [esp + 0x158]
mov dword [esp + 0x158], 0x22c
push eax
push esi
call dword [esp + 0x14]
test eax, eax
je 0x477acc
push 0
lea eax, [esp + 0x180]
push eax
push 0
push dword [esp + 0x16c]
call fcn.00477b20
test eax, eax
je 0x477acc
lea eax, [esp + 0x158]
mov dword [esp + 0x158], 0x22c
push eax
push esi
call edi
test eax, eax
jne 0x477a96
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call esi
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x780]
xor ecx, esp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x78c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00494c10
mov esp, ebp
pop ebp
ret