Function at 0x4010e4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x15a0
call fcn.00402610
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00402940
mov ebx, eax
pop ecx
cmp ebx, 1
jl 0x401415
cmp ebx, 0x104
jg 0x401415
xor edi, edi
test ebx, ebx
jle 0x401146
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1b0]
sub eax, ecx
mov dword [ebp + 8], eax
jmp 0x40112d
mov eax, dword [ebp + 8]
lea esi, [ebp + edi - 0x1b0]
movsx eax, byte [eax + esi]
push eax
call fcn.004027f8
inc edi
pop ecx
cmp edi, ebx
mov byte [esi], al
jl 0x40112a
and byte [ebp + ebx - 0x1b0], 0
lea eax, [ebp - 0xac]
push eax
mov dword [ebp - 0xac], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401415
cmp dword [ebp - 0x9c], 2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x40118e
cmp dword [ebp - 0x9c], 1
je 0x4012b1
jmp 0x401415
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x401415
push str.EnumProcesses
push edi
call esi
push str.EnumProcessModules
push edi
mov ebx, eax
call esi
push str.GetModuleBaseNameA
push edi
mov dword [ebp - 8], eax
call esi
test ebx, ebx
mov dword [ebp - 0xc], eax
je 0x40140e
cmp dword [ebp - 8], 0
je 0x40140e
test eax, eax
je 0x40140e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x15a0]
push 0x3e8
push eax
call ebx
test eax, eax
je 0x40140e
mov eax, dword [ebp - 0x14]
mov dword [ebp + 8], 0
shr eax, 2
mov dword [ebp - 0x10], eax
je 0x4012a4
lea eax, [ebp - 0x15a0]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3dc]
push str.Unknown
push eax
call fcn.00402520
mov eax, dword [ebp - 4]
pop ecx
pop ecx
push dword [eax]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x401266
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
call dword [ebp - 8]
test eax, eax
je 0x401266
lea eax, [ebp - 0x3dc]
push 0x104
push eax
push dword [ebp - 0x18]
push ebx
call dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x3dc]
push eax
call fcn.004026c4
pop ecx
push eax
call fcn.00402640
pop ecx
test eax, eax
pop ecx
je 0x4013b8
inc dword [ebp + 8]
add dword [ebp - 4], 4
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x10]
jb 0x401216
cmp dword [ebp - 0x9c], 1
jne 0x40140e
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x401415
push str.CreateToolhelp32Snapshot
push edi
call esi
push str.Process32First
push edi
mov dword [ebp + 8], eax
call esi
push str.Process32Next
push edi
mov dword [ebp - 8], eax
call esi
push str.Module32First
push edi
mov dword [ebp - 0xc], eax
call esi
push str.Module32Next
push edi
mov dword [ebp - 4], eax
call esi
cmp dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
je 0x40140e
cmp dword [ebp - 8], ebx
je 0x40140e
cmp eax, ebx
je 0x40140e
cmp dword [ebp - 4], ebx
je 0x40140e
cmp dword [ebp + 8], ebx
je 0x40140e
push ebx
push 2
call dword [ebp + 8]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40140e
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x128
push eax
push ebx
call dword [ebp - 8]
test eax, eax
je 0x401407
push dword [ebp - 0x2d0]
push 8
call dword [ebp + 8]
mov esi, eax
cmp esi, 0xffffffff
je 0x401407
lea eax, [ebp - 0x600]
mov dword [ebp - 0x600], 0x224
push eax
push esi
call dword [ebp - 4]
test eax, eax
je 0x4013cb
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x5e0]
push eax
call fcn.00402640
pop ecx
test eax, eax
pop ecx
je 0x4013ec
lea eax, [ebp - 0x600]
mov dword [ebp - 0x600], 0x224
push eax
push esi
call dword [ebp - 0x10]
jmp 0x401384
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + eax*4 - 0x15a0]
jmp 0x401417
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x128
push eax
push ebx
call dword [ebp - 0xc]
jmp 0x401351
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x5f8]
jmp 0x401417
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret