Function at 0x44f520
Capabilities:
Check for time delay via gettickcount
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x29dc
call fcn.004b7400
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, esi
call fcn.00428560
mov dword [esp + 0x24], eax
test eax, eax
jne 0x44f55e
push esi
push eax
push str.Parameter_1_invalid.
mov ecx, edi
call fcn.004478f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
dec eax
cmp eax, 4
ja case.default.0x44f568
jmp dword [eax*4 + 0x44ff30]
mov ebx, dword [ebp + 0xc]
cmp word [ebx], 0
je 0x44f74e
mov eax, dword [0x4ea22c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test al, 1
jne 0x44f5b2
push str.CreateToolhelp32Snapshot
or eax, 1
push str.kernel32
mov dword [0x4ea22c], eax
call edi
push eax
call esi
mov dword [0x4ea230], eax
mov eax, dword [0x4ea22c]
test al, 2
jne 0x44f5d7
push str.Process32FirstW
or eax, 2
push str.kernel32
mov dword [0x4ea22c], eax
call edi
push eax
call esi
mov dword [0x4ea234], eax
mov eax, dword [0x4ea22c]
test al, 4
jne 0x44f5f9
push str.Process32NextW
or eax, 4
push str.kernel32
mov dword [0x4ea22c], eax
call edi
push eax
call esi
mov dword [0x4ea238], eax
jmp 0x44f5fe
mov eax, dword [0x4ea238]
mov ecx, dword [0x4ea230]
test ecx, ecx
je 0x44f731
cmp dword [0x4ea234], 0
je 0x44f731
test eax, eax
je 0x44f731
push 0
push 2
mov dword [esp + 0x30], 0x22c
call ecx
mov esi, eax
lea eax, [esp + 0x28]
push eax
push esi
mov dword [esp + 0x18], esi
call dword [0x4ea234]
push 0
push 0
push 1
xor edx, edx
mov ecx, ebx
call fcn.0049c490
add esp, 0xc
test eax, eax
je 0x44f662
mov ecx, ebx
call fcn.00404b50
mov ebx, eax
jmp 0x44f664
xor ebx, ebx
lea eax, [esp + 0x28]
push eax
push esi
call dword [0x4ea238]
test eax, eax
je 0x44f72a
test ebx, ebx
je 0x44f686
cmp ebx, dword [esp + 0x30]
je 0x44f735
lea eax, [esp + 0x1128]
push eax
lea eax, [esp + 0x8ec]
push eax
lea eax, [esp + 0x1970]
push eax
lea eax, [esp + 0x1b84]
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath]
lea edx, [esp + 0x113c]
add esp, 0x14
mov esi, edx
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x44f6c0
lea edi, [esp + 0x8e8]
sub edx, esi
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x44f6e0
push dword [ebp + 0xc]
mov ecx, edx
lea eax, [esp + 0x8ec]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x44f73e
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push esi
call dword [0x4ea238]
test eax, eax
jne 0x44f678
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x44f756
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44f756
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x30]
jmp 0x44f756
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
push 0x18
push 0
push ebx
mov ecx, dword [0x4e5b90]
call fcn.00401510
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [0x4ea22c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test al, 1
jne 0x44f7aa
push str.CreateToolhelp32Snapshot
or eax, 1
push str.kernel32
mov dword [0x4ea22c], eax
call edi
push eax
call esi
mov dword [0x4ea230], eax
mov eax, dword [0x4ea22c]
test al, 2
jne 0x44f7cf
push str.Process32FirstW
or eax, 2
push str.kernel32
mov dword [0x4ea22c], eax
call edi
push eax
call esi
mov dword [0x4ea234], eax
mov eax, dword [0x4ea22c]
test al, 4
jne 0x44f7f1
push str.Process32NextW
or eax, 4
push str.kernel32
mov dword [0x4ea22c], eax
call edi
push eax
call esi
mov dword [0x4ea238], eax
jmp 0x44f7f6
mov eax, dword [0x4ea238]
mov ecx, dword [0x4ea230]
test ecx, ecx
je case.0x44f9e3.67
cmp dword [0x4ea234], 0
je case.0x44f9e3.67
test eax, eax
je case.0x44f9e3.67
push 0
push 2
mov dword [esp + 0x260], 0x22c
call ecx
mov esi, eax
lea eax, [esp + 0x258]
push eax
push esi
mov dword [esp + 0x18], esi
call dword [0x4ea234]
mov ebx, dword [ebp + 0xc]
xor edx, edx
push 0
push 0
push 1
mov ecx, ebx
call fcn.0049c490
add esp, 0xc
test eax, eax
je 0x44f863
mov ecx, ebx
call fcn.00404b50
mov ebx, eax
jmp 0x44f865
xor ebx, ebx
lea eax, [esp + 0x258]
push eax
push esi
call dword [0x4ea238]
test eax, eax
je 0x44f93d
nop dword [eax]
test ebx, ebx
je 0x44f891
cmp ebx, dword [esp + 0x260]
je 0x44f963
lea eax, [esp + 0x1338]
push eax
lea eax, [esp + 0xafc]
push eax
lea eax, [esp + 0x1d90]
push eax
lea eax, [esp + 0x1fa4]
push eax
lea eax, [esp + 0x28c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath]
lea edx, [esp + 0x134c]
add esp, 0x14
mov esi, edx
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x44f8d0
lea edi, [esp + 0xaf8]
sub edx, esi
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x44f8f0
push dword [ebp + 0xc]
mov ecx, edx
lea eax, [esp + 0xafc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x44f96e
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x258]
push eax
push esi
call dword [0x4ea238]
test eax, eax
jne 0x44f880
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x4e5b90]
push 1
push 0
push 0xffffffffffffffff
push 0x4b9cc4
call fcn.004a05c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
jmp 0x44f981
push dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ebx, dword [esp + 0x260]
test ebx, ebx
je case.0x44f9e3.67
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x1c], eax
test eax, eax
je case.0x44f9e3.67
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esp + 0x1c]
mov esi, eax
call edi
xor ecx, ecx
test esi, esi
push 0x18
cmovne ecx, ebx
push 0
push ecx
jmp 0x44f75b
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towupper]
movzx eax, ax
add esp, 4
add eax, 0xffffffbf
cmp eax, 0x11
ja case.0x44f9e3.67
movzx eax, byte [eax + 0x44ff60]
jmp dword [eax*4 + 0x44ff44]
mov dword [esp + 0x10], 0x40
jmp 0x44fa24
mov dword [esp + 0x10], 0x4000
jmp 0x44fa24
mov dword [esp + 0x10], 0x20
jmp 0x44fa24
mov dword [esp + 0x10], 0x8000
jmp 0x44fa24
mov dword [esp + 0x10], 0x80
jmp 0x44fa24
mov dword [esp + 0x10], pe_nt_image_headers32
mov ebx, dword [ebp + 0xc]
cmp word [ebx], 0
je 0x44fc17
mov eax, dword [0x4ea22c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test al, 1
jne 0x44fa67
push str.CreateToolhelp32Snapshot
or eax, 1
push str.kernel32
mov dword [0x4ea22c], eax
call edi
push eax
call esi
mov dword [0x4ea230], eax
mov eax, dword [0x4ea22c]
test al, 2
jne 0x44fa8c
push str.Process32FirstW
or eax, 2
push str.kernel32
mov dword [0x4ea22c], eax
call edi
push eax
call esi
mov dword [0x4ea234], eax
mov eax, dword [0x4ea22c]
test al, 4
jne 0x44faae
push str.Process32NextW
or eax, 4
push str.kernel32
mov dword [0x4ea22c], eax
call edi
push eax
call esi
mov dword [0x4ea238], eax
jmp 0x44fab3
mov eax, dword [0x4ea238]
mov ecx, dword [0x4ea230]
test ecx, ecx
je 0x44fbf5
cmp dword [0x4ea234], 0
je 0x44fbf5
test eax, eax
je 0x44fbf5
push 0
push 2
mov dword [esp + 0x490], 0x22c
call ecx
mov esi, eax
lea eax, [esp + 0x488]
push eax
push esi
mov dword [esp + 0x20], esi
call dword [0x4ea234]
push 0
push 0
push 1
xor edx, edx
mov ecx, ebx
call fcn.0049c490
add esp, 0xc
test eax, eax
je 0x44fb1d
mov ecx, ebx
call fcn.00404b50
mov ebx, eax
jmp 0x44fb1f
xor ebx, ebx
lea eax, [esp + 0x488]
push eax
push esi
call dword [0x4ea238]
test eax, eax
je 0x44fbed
test ebx, ebx
je 0x44fb47
cmp ebx, dword [esp + 0x490]
je 0x44fbf9
lea eax, [esp + 0x1548]
push eax
lea eax, [esp + 0xd0c]
push eax
lea eax, [esp + 0x21b0]
push eax
lea eax, [esp + 0x23c4]
push eax
lea eax, [esp + 0x4bc]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath]
lea edx, [esp + 0x155c]
add esp, 0x14
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x44fb81
lea edi, [esp + 0xd08]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x44fba0
push dword [ebp + 0xc]
mov ecx, edx
lea eax, [esp + 0xd0c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x44fc03
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x488]
push eax
push esi
call dword [0x4ea238]
test eax, eax
jne 0x44fb36
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
xor ebx, ebx
jmp 0x44fc1f
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
jmp 0x44fc1f
push dword [esp + 0x18]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
mov ebx, dword [esp + 0x490]
jmp 0x44fc1f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
test ebx, ebx
je case.0x44f9e3.67
push ebx
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je case.0x44f9e3.67
push dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
test esi, esi
push 0x18
cmovne ecx, ebx
push 0
push ecx
jmp 0x44f75b
mov ecx, dword [ebp + 0x10]
cmp word [ecx], 0
je 0x44fc8f
mov byte [esp + 0x17], 0
call fcn.00426540
mulsd xmm0, qword [0x4dcad8]
cvttsd2si eax, xmm0
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x44fca0
mov eax, dword [esp + 0x20]
mov byte [esp + 0x17], 1
mov dword [esp + 0x10], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x1c], eax
mov eax, dword fs:[0x24]
mov dword [esp + 0x20], eax
mov eax, dword [0x4ea22c]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test al, 1
jne 0x44fcf3
push str.CreateToolhelp32Snapshot
or eax, 1
push str.kernel32
mov dword [0x4ea22c], eax
call ecx
push eax
call esi
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x4ea230], eax
mov eax, dword [0x4ea22c]
test al, 2
jne 0x44fd18
push str.Process32FirstW
or eax, 2
push str.kernel32
mov dword [0x4ea22c], eax
call ecx
push eax
call esi
mov dword [0x4ea234], eax
mov eax, dword [0x4ea22c]
test al, 4
jne 0x44fd3e
push str.Process32NextW
or eax, 4
push str.kernel32
mov dword [0x4ea22c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov dword [0x4ea238], eax
jmp 0x44fd43
mov eax, dword [0x4ea238]
mov ecx, dword [0x4ea230]
test ecx, ecx
je 0x44fe8c
cmp dword [0x4ea234], 0
je 0x44fe8c
test eax, eax
je 0x44fe8c
push 0
push 2
mov dword [esp + 0x6c0], 0x22c
call ecx
mov esi, eax
lea eax, [esp + 0x6b8]
push eax
push esi
mov dword [esp + 0x20], esi
call dword [0x4ea234]
push 0
push 0
push 1
xor edx, edx
mov ecx, ebx
call fcn.0049c490
add esp, 0xc
test eax, eax
je 0x44fdad
mov ecx, ebx
call fcn.00404b50
mov ebx, eax
jmp 0x44fdaf
xor ebx, ebx
lea eax, [esp + 0x6b8]
push eax
push esi
call dword [0x4ea238]
test eax, eax
je 0x44fe83
test ebx, ebx
je 0x44fdd7
cmp ebx, dword [esp + 0x6c0]
je 0x44fe9f
lea eax, [esp + 0x1758]
push eax
lea eax, [esp + 0xf1c]
push eax
lea eax, [esp + 0x25d0]
push eax
lea eax, [esp + 0x27e4]
push eax
lea eax, [esp + 0x6ec]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath]
lea edx, [esp + 0x176c]
add esp, 0x14
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x44fe11
lea edi, [esp + 0xf18]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x44fe30
push dword [ebp + 0xc]
mov ecx, edx
lea eax, [esp + 0xf1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x44feb0
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x6b8]
push eax
push esi
call dword [0x4ea238]
test eax, eax
jne 0x44fdc6
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
cmp dword [esp + 0x24], 4
jne 0x44fecb
test ebx, ebx
jne 0x44f756
jmp 0x44fed3
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x44fe8e
push dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ebx, dword [esp + 0x6c0]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x44fe8e
test ebx, ebx
je case.0x44f9e3.67
cmp byte [esp + 0x17], 0
jne 0x44fef9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub ecx, eax
cmp ecx, 5
jle 0x44f756
mov eax, dword [esp + 0x20]
cmp dword [0x4e7484], eax
jne 0x44ff17
mov edx, 1
lea ecx, [edx + 0x63]
call fcn.00401a20
jmp 0x44fcba
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44fcba
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc