Function at 0x44e4d0
Capabilities:
Check for time delay via gettickcount
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454962
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [0x462544]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x1ac]
call fcn.0043b090
mov dword [ebp - 4], 0
mov byte [ebp - 0x2b4], 0
push 0x103
push 0
lea eax, [ebp - 0x2b3]
push eax
call fcn.00409d80
add esp, 0xc
mov dword [ebp - 0x13c], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
jne 0x44e573
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ac]
call fcn.0043b020
mov eax, dword [ebp - 0x2b8]
jmp 0x44e7a1
lea ecx, [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x14c]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x44e5be
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ac]
call fcn.0043b020
mov eax, dword [ebp - 0x2bc]
jmp 0x44e7a1
lea ecx, [ebp - 0x118]
push ecx
call fcn.00422f10
add esp, 4
mov dword [ebp - 0x148], eax
mov edx, dword [ebp - 0x134]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x44e74a
cmp dword [ebp + 8], 2
jne 0x44e641
push str.csrss.exe
lea eax, [ebp - 0x118]
push eax
call fcn.0041fa6a
add esp, 8
test eax, eax
je 0x44e62d
push str.winlogon.exe
lea ecx, [ebp - 0x118]
push ecx
call fcn.0041fa6a
add esp, 8
test eax, eax
jne 0x44e63c
push 0xffffffffffffffff
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x44e73d
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call fcn.0044da20
add esp, 0xc
test eax, eax
jne 0x44e73d
push 0xffffffffffffffff
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x118]
push ecx
push 0xd
mov ecx, dword [0x465158]
call fcn.0043c3e0
push eax
push 0x104
lea edx, [ebp - 0x2b4]
push edx
call fcn.00401090
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x465280], eax
jae 0x44e73d
cmp dword [ebp + 8], 1
je 0x44e73d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x2710
mov dword [0x465280], eax
cmp dword [0x464b00], 0
jne 0x44e6e2
push 0x104
call fcn.0043aab0
add esp, 4
mov dword [0x464b00], eax
cmp dword [0x464afc], 0
jne 0x44e6fd
push 0x104
call fcn.0043aab0
add esp, 4
mov dword [0x464afc], eax
lea eax, [ebp - 0x2b4]
push eax
mov ecx, dword [0x464b00]
push ecx
call fcn.00409e90
add esp, 8
push str.WARNING_
mov edx, dword [0x464afc]
push edx
call fcn.00409e90
add esp, 8
cmp dword [0x464b40], 0
je 0x44e73d
push 9
mov ecx, dword [0x464b40]
call fcn.00440370
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x14c]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x44e5be
mov eax, dword [0x465284]
add eax, 1
mov dword [0x465284], eax
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2c0], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ac]
call fcn.0043b020
mov eax, dword [ebp - 0x2c0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409d69
mov esp, ebp
pop ebp
ret