Function at 0x403a00
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x1330
call fcn.00404c90
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
jne 0x403b55
mov eax, dword [esi + 8]
test eax, eax
je 0x403ac1
mov eax, dword [esi + 0xc]
test eax, eax
je 0x403ac1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.VDMEnumTaskWOWEx
push eax
call edi
mov eax, dword [esi + 8]
push str.EnumProcesses
push eax
call edi
mov ecx, dword [esi + 8]
push str.GetModuleFileNameEx
push ecx
call edi
mov edx, dword [esi + 8]
mov ebx, eax
push str.GetModuleBaseName
push edx
mov dword [esp + 0x1c], ebx
call edi
mov eax, dword [esi + 8]
push str.EnumProcessModules
push eax
call edi
test ebx, ebx
mov edi, eax
je 0x403ac1
test edi, edi
je 0x403ac1
mov ecx, dword [esp + 0x1344]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x403ac1
lea edx, [esp + 0x10]
lea eax, [esp + 0x340]
push edx
push 0x1000
push eax
push ebx
call edi
mov edx, dword [esp + 0x10]
shr edx, 2
test eax, eax
mov dword [esp + 0x10], edx
jne 0x403ad0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1330
ret 4
mov eax, dword [esp + 0x10]
xor ebp, ebp
test eax, eax
jbe 0x403b3c
lea edi, [esp + 0x340]
mov edx, dword [edi]
lea ecx, [esp + 0x23c]
push 0x104
push ecx
push edx
push ebx
call dword [esp + 0x24]
test eax, eax
je 0x403aba
lea eax, [esp + 0x23c]
push 0x5c
push eax
call fcn.00404bd7
add esp, 8
test eax, eax
je 0x403b11
inc eax
mov edx, dword [esi]
lea ecx, [esp + 0x23c]
push ecx
mov ecx, dword [esp + 0x1348]
push eax
mov eax, dword [edi]
push eax
push ecx
mov ecx, esi
call dword [edx + 8]
test eax, eax
je 0x403b3c
mov eax, dword [esp + 0x10]
inc ebp
add edi, 4
cmp ebp, eax
jb 0x403ae1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1330
ret 4
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Module32First
push edi
mov ebp, eax
call ebx
push str.Module32Next
push edi
mov dword [esp + 0x18], eax
call ebx
test ebp, ebp
mov dword [esp + 0x14], eax
je 0x403ac1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x403ac1
test eax, eax
je 0x403ac1
mov ebx, dword [esp + 0x1344]
mov dword [esp + 0x18], 0x224
push ebx
push 8
call ebp
lea edx, [esp + 0x18]
mov edi, eax
push edx
push edi
call dword [esp + 0x18]
mov eax, dword [esi]
lea ecx, [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x3c]
push edx
push ecx
push ebx
mov ecx, esi
call dword [eax + 8]
test eax, eax
jne 0x403bfd
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1330
ret 4
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push edi
call ebp
test eax, eax
je 0x403c37
mov eax, dword [esi]
lea ecx, [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x3c]
push edx
push ecx
push ebx
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x403c37
lea edx, [esp + 0x18]
push edx
push edi
call ebp
test eax, eax
jne 0x403c0d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1330
ret 4