Function at 0x40fbc0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x1668
call fcn.004573e0
sub rsp, rax
mov rax, qword [0x00472618]
xor rax, rsp
mov qword [rsp + 0x1620], rax
xor eax, eax
mov qword [rsp + 0x1660], rsi
mov qword [rsp + 0x1658], rdi
mov rdi, rdx
mov rcx, 0xffffffffffffffff
mov rsi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
lea eax, [rcx - 1]
cmp eax, 0x103
ja 0x410148
mov qword [rsp + 0x1680], rbx
mov qword [rsp + 0x1688], rbp
mov qword [rsp + 0x1650], r12
xor r12d, r12d
test ecx, ecx
movsxd rbp, ecx
mov qword [rsp + 0x28], r12
mov rbx, r12
jle 0x40fc6c
lea rax, [rsp + 0x1400]
sub rsi, rax
nop
nop
lea rdi, [rsp + rbx + 0x1400]
movsx ecx, byte [rsi + rdi]
call fcn.0043ac70
add rbx, 1
cmp rbx, rbp
mov byte [rdi], al
jl 0x40fc50
lea rcx, [rsp + 0xff0]
mov byte [rsp + rbp + 0x1400], r12b
mov dword [rsp + 0xff0], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40fc98
mov eax, 0x25e
jmp 0x40fce2
mov eax, dword [rsp + 0x1000]
mov qword [rsp + 0x1648], r13
mov qword [rsp + 0x1640], r14
cmp eax, 2
mov qword [rsp + 0x1638], r15
je 0x40fee8
cmp eax, 1
je 0x40fd22
mov eax, 0x25f
mov r14, qword [rsp + 0x1640]
mov r13, qword [rsp + 0x1648]
mov r15, qword [rsp + 0x1638]
mov rbp, qword [rsp + 0x1688]
mov rbx, qword [rsp + 0x1680]
mov r12, qword [rsp + 0x1650]
mov rdi, qword [rsp + 0x1658]
mov rsi, qword [rsp + 0x1660]
mov rcx, qword [rsp + 0x1620]
xor rcx, rsp
call fcn.00434a90
add rsp, 0x1668
ret
lea rcx, str.Kernel32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
je 0x40febb
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbp
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbp
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbp
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test r15, r15
mov rsi, rax
je 0x40fed5
test rdi, rdi
je 0x40fed5
test rax, rax
je 0x40fed5
test r14, r14
je 0x40fed5
test r13, r13
je 0x40fed5
xor edx, edx
lea ecx, [rdx + 2]
call r13
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x40fed5
lea rdx, [rsp + 0x1090]
mov rcx, rax
mov dword [rsp + 0x1090], 0x130
call rdi
test eax, eax
je 0x40febb
nop
mov edx, dword [rsp + 0x1098]
mov ecx, 8
call r13
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x40fed5
lea rdx, [rsp + 0x11c0]
mov rcx, rax
mov dword [rsp + 0x11c0], 0x238
call r14
test eax, eax
je 0x40fe9a
nop
nop
lea rcx, [rsp + 0x12f0]
lea rdi, [rsp + 0x1400]
sub rdi, rcx
movzx edx, byte [rcx]
movzx eax, byte [rcx + rdi]
sub edx, eax
jne 0x40fe66
add rcx, 1
test eax, eax
jne 0x40fe53
test edx, edx
je 0x40fe88
lea rdx, [rsp + 0x11c0]
mov rcx, rbx
mov dword [rsp + 0x11c0], 0x238
call rsi
test eax, eax
jne 0x40fe40
jmp 0x40fe9a
mov rax, qword [rsp + 0x28]
add eax, 1
cmp eax, 2
mov qword [rsp + 0x28], rax
jge 0x40fec2
lea rdx, [rsp + 0x1090]
mov rcx, r12
mov dword [rsp + 0x1090], 0x130
call r15
test eax, eax
jne 0x40fe00
xor eax, eax
jmp 0x40fcca
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x40fcca
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x25d
jmp 0x40fcca
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str.KERNEL32.DLL
mov dword [rsp + 0x28], r12d
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x40ff3c
lea rdx, str.ProcessIdToSessionId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x40ff2a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40ff3c
lea rdx, [rsp + 0x28]
mov ecx, ebx
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.PSAPI.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov r14, rax
je 0x41013e
lea rdx, str.EnumProcesses
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumProcessModules
mov rcx, r14
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExA
mov rcx, r14
mov rsi, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rdi, rdi
mov rbx, rax
mov qword [rsp + 0x40], rax
je 0x410135
test rsi, rsi
je 0x410135
test rax, rax
je 0x410135
lea r8, [rsp + 0x24]
lea rcx, [rsp + 0x50]
mov edx, 0x3e8
call rdi
test eax, eax
je 0x410135
mov r15d, dword [rsp + 0x24]
mov ebp, r12d
mov r13d, r12d
shr r15d, 2
je 0x40febb
lea r12, [rsp + 0x50]
movabs rax, 0x6e776f6e6b6e55
mov r8d, dword [r12]
xor edx, edx
mov ecx, 0x410
mov qword [rsp + 0x1510], rax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rdi, rax
je 0x410042
lea r9, [rsp + 0x24]
lea rdx, [rsp + 0x38]
mov r8d, 8
mov rcx, rax
call rsi
test eax, eax
je 0x410042
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x1510]
mov r9d, 0x104
mov rcx, rdi
call rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1510]
call fcn.0043a8a0
lea rdi, [rsp + 0x1400]
sub rdi, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x410076
add rax, 1
test ecx, ecx
jne 0x410063
test edx, edx
jne 0x410102
mov r8d, dword [r12]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [r12]
lea rcx, str.KERNEL32.DLL
mov rsi, rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x4100e1
lea rdx, str.ProcessIdToSessionId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x4100cf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4100e1
lea rdx, [rsp + 0x20]
mov ecx, ebx
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x28], eax
jne 0x4100f3
test rsi, rsi
je 0x4100f3
add ebp, 1
cmp ebp, 2
je 0x410122
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
add r13d, 1
add r12, 4
cmp r13d, r15d
jae 0x40febb
movabs rax, 0x6e776f6e6b6e55
jmp 0x40fff0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x40fcca
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x25d
jmp 0x40fcca
mov eax, 0x278
jmp 0x40fcfa