Function at 0x449b90
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x46d3bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x46c
mov eax, dword [0x48e070]
mov dword [esp + 0x468], eax
lea eax, [esp + 0x354]
push eax
mov byte [esp + 7], 0
mov dword [esp + 0x358], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x449dce
mov eax, dword [esp + 0x364]
cmp eax, 2
push ebx
push ebp
push esi
push edi
jne 0x449e23
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.PSAPI.DLL
call esi
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x24], ebx
je 0x449dca
push str.VDMDBG.DLL
call esi
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x2c], ebp
je 0x449dca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push ebx
call esi
push str.EnumProcessModules
push ebx
mov edi, eax
call esi
push str.GetModuleFileNameExW
push ebx
mov dword [esp + 0x1c], eax
call esi
push str.VDMEnumTaskWOWEx
push ebp
mov dword [esp + 0x30], eax
call esi
xor esi, esi
cmp edi, esi
je 0x449e15
cmp dword [esp + 0x14], esi
je 0x449e15
cmp dword [esp + 0x28], esi
je 0x449e15
cmp eax, esi
je 0x449e15
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov eax, 0x400
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
test esi, esi
je 0x449caa
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
add eax, eax
mov dword [esp + 0x18], eax
push eax
push 0
call ebx
push eax
call ebp
mov esi, eax
test esi, esi
je 0x449dff
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
push esi
call edi
test eax, eax
je 0x449df3
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp ecx, eax
je 0x449c90
shr ecx, 2
xor ebp, ebp
test ecx, ecx
mov dword [esp + 0x1c], ecx
jbe 0x449da5
mov edi, edi
mov word [esp + 0x158], 0
mov edx, dword [esi + ebp*4]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x449d50
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push edi
call dword [esp + 0x24]
test eax, eax
je 0x449d49
mov eax, dword [esp + 0x20]
push 0x104
lea edx, [esp + 0x15c]
push edx
push eax
push edi
call dword [esp + 0x38]
test eax, eax
jne 0x449d49
mov word [esp + 0x158], ax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x490]
mov eax, dword [esi + ebp*4]
push ecx
lea edx, [esp + 0x15c]
push edx
push 0
push eax
call dword [esp + 0x49c]
test eax, eax
je 0x449da5
lea ecx, [esp + 0x158]
push str.NTVDM.EXE
push ecx
call dword [sym.imp.MSVCR71.dll_wcslen]
lea edx, [esp + eax*2 + 0x14e]
add esp, 4
push edx
call dword [sym.imp.MSVCR71.dll__wcsicmp]
mov eax, dword [esp + 0x24]
add esp, 8
inc ebp
cmp ebp, eax
jb 0x449cf0
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push eax
call esi
mov ecx, dword [esp + 0x2c]
push ecx
call esi
mov byte [esp + 0x13], 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x46c]
mov al, byte [esp + 3]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x468]
call fcn.004664a7
add esp, 0x478
ret
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push eax
call esi
mov ecx, dword [esp + 0x2c]
push ecx
call esi
jmp 0x449dca
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call esi
push ebp
call esi
jmp 0x449dca
cmp eax, 1
jne 0x449dc5
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x449dca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push ebx
call esi
push str.Process32First
push ebx
mov edi, eax
call esi
push str.Process32Next
push ebx
mov ebp, eax
call esi
mov esi, eax
test esi, esi
mov dword [esp + 0x20], esi
je 0x449f37
test ebp, ebp
je 0x449f37
test edi, edi
je 0x449f37
push 0
push 2
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x449f37
lea edx, [esp + 0x30]
push edx
push edi
mov dword [esp + 0x38], 0x128
call ebp
test eax, eax
je 0x449f2b
mov ebp, dword [esp + 0x490]
jmp 0x449eb0
mov esi, dword [esp + 0x20]
nop
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
lea eax, [esp + 0x14]
push eax
push 0x104
lea ecx, [esp + 0x5c]
push ecx
push 0
mov dword [esp + 0x494], 0
call fcn.00447510
add esp, 0x10
push ebp
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::GetBuffer]
mov edx, dword [esp + 0x3c]
push eax
push 0
push edx
call dword [esp + 0x49c]
test eax, eax
je 0x449f10
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x38], 0x128
call esi
mov esi, eax
jmp 0x449f12
xor esi, esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x484], 0xffffffff
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
test esi, esi
jne 0x449eab
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x449dc5
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x449dca