Function at 0x448b20
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x2ec
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0x2e8], eax
mov eax, dword [esp + 0x2f0]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x448b71
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.0062016f
add esp, 0x2ec
ret 4
mov eax, dword [esp + 0x38]
push ebx
push ebp
push esi
push edi
cmp eax, 2
jne 0x448d8d
push str.PSAPI.DLL
call fcn.00447f30
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
test edi, edi
je 0x448e65
push str.VDMDBG.DLL
call fcn.00447f30
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x448e65
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push edi
call esi
push str.EnumProcessModules
push edi
mov dword [esp + 0x30], eax
call esi
push str.GetModuleFileNameExA
mov ebx, eax
push edi
mov dword [esp + 0x38], ebx
call esi
mov edx, dword [esp + 0x10]
push str.VDMEnumTaskWOWEx
mov ebp, eax
push edx
mov dword [esp + 0x3c], ebp
call esi
cmp dword [esp + 0x28], 0
je 0x448d78
test ebx, ebx
je 0x448d78
test ebp, ebp
je 0x448d78
test eax, eax
je 0x448d78
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov eax, 0x400
mov dword [esp + 0x18], eax
xor esi, esi
lea ebx, [ebx]
test esi, esi
je 0x448c4a
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
add eax, eax
mov dword [esp + 0x18], eax
push eax
push 0
call ebx
push eax
call ebp
mov esi, eax
test esi, esi
je 0x448d42
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push ecx
push esi
call dword [esp + 0x34]
test eax, eax
je 0x448d57
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp ecx, eax
je 0x448c30
shr ecx, 2
xor ebp, ebp
mov dword [esp + 0x1c], ecx
test ecx, ecx
jbe 0x448d1a
mov byte [esp + 0x1f4], 0
mov ecx, dword [esi + ebp*4]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x448ced
lea edx, [esp + 0x18]
push edx
push 4
lea eax, [esp + 0x34]
push eax
push edi
call dword [esp + 0x40]
test eax, eax
je 0x448ce6
mov edx, dword [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1f8]
push ecx
push edx
push edi
call dword [esp + 0x44]
test eax, eax
jne 0x448ce6
mov byte [esp + 0x1f4], al
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + ebp*4]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x1fc]
push edx
call fcn.004489d0
test eax, eax
jne 0x448d16
inc ebp
cmp ebp, dword [esp + 0x1c]
jb 0x448c90
mov edi, dword [esp + 0x14]
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x448e67
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
jmp 0x448e65
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
jmp 0x448e65
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
jmp 0x448e65
cmp eax, 1
jne 0x448e65
push str.Kernel32.DLL
call fcn.00447f30
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
test edi, edi
je 0x448e65
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push edi
call esi
push str.Process32First
push edi
mov ebp, eax
call esi
push str.Process32Next
push edi
mov ebx, eax
call esi
mov edi, eax
test edi, edi
je 0x448e5a
test ebx, ebx
je 0x448e5a
test ebp, ebp
je 0x448e5a
push 0
push 2
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x448e5a
lea eax, [esp + 0xcc]
push eax
mov ebp, 0x128
push esi
mov dword [esp + 0xd4], ebp
call ebx
test eax, eax
je 0x448e48
lea ecx, [ecx]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
lea eax, [esp + 0xf8]
push eax
call fcn.004489d0
test eax, eax
jne 0x448e48
lea ecx, [esp + 0xcc]
push ecx
push esi
mov dword [esp + 0xd4], ebp
call edi
test eax, eax
jne 0x448e10
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x448e67
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x2f8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0062016f
add esp, 0x2ec
ret 4