Function at 0x441eaf
Capabilities:
Enumerate gui resources
Get number of processors
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46e9d5
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x4977b8]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
mov eax, dword [0x4977b8]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
push ebx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x30], esi
and dword [esp + 0x260], 0
test esi, esi
je 0x44210b
lea eax, [esp + 0x44]
push eax
push 0x441e52
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x50], 0
call dword [sym.imp.USER32.dll_EnumWindows]
xor bl, bl
cmp byte [esp + 0x48], bl
je 0x4420e1
xor eax, eax
inc eax
mov byte [edi + 0x58], al
mov eax, dword [edi + 8]
imul eax, eax, 0xa
and dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
test eax, eax
jle 0x441fa7
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [edi + 0x10]
cmp eax, 0x102
movzx ebx, bl
push 1
pop eax
cmovne ebx, eax
mov eax, dword [esp + 0x1c]
dec dword [esp + 0x18]
inc eax
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x44201b
push dword [esp + 0x10]
and ecx, 0xfffffffe
push eax
lea eax, [edi + 0x18]
push eax
call dword [ecx + 4]
add esp, 0xc
test al, al
je 0x441fe6
mov eax, dword [esp + 0x18]
test bl, bl
je 0x441f56
test bl, bl
jne 0x442104
mov ecx, dword [edi + 0x38]
test ecx, ecx
jne 0x44204c
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], str.call_to_empty_boost::function
call fcn.0044a9ea
mov dword [esp + 0x20], vtable.boost::bad_function_call.0
mov byte [esp + 0x260], 2
lea ecx, [esp + 0x20]
jmp 0x442047
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], str.InstallerError
call fcn.0044a9ea
mov dword [esp + 0x20], vtable.installer_error_exception.0
mov dword [esp + 0x2c], 7
push 0x48ad8c
lea eax, [esp + 0x24]
push eax
call fcn.0044fb93
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], str.call_to_empty_boost::function
call fcn.0044a9ea
mov dword [esp + 0x20], vtable.boost::bad_function_call.0
xor eax, eax
inc eax
mov byte [esp + 0x260], al
lea ecx, [esp + 0x20]
call fcn.0043407d
lea eax, [edi + 0x40]
and ecx, 0xfffffffe
push eax
call dword [ecx + 4]
push 8
mov edi, eax
call fcn.0044b329
pop ecx
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x260], 3
test eax, eax
je 0x442083
lea ecx, [esp + 0x4a]
push ecx
push edi
push ecx
mov ecx, eax
call fcn.00443213
mov edi, eax
jmp 0x442085
xor edi, edi
mov dword [esp + 0x18], edi
mov byte [esp + 0x260], 4
test edi, edi
je 0x4420c7
mov eax, dword [edi]
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call dword [eax + 4]
test al, al
jne 0x442131
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
movzx ebx, bl
push 1
pop eax
cmovne ebx, eax
test bl, bl
je 0x442095
xor ecx, ecx
inc ecx
mov byte [esp + 0x260], 0
test edi, edi
je 0x4420dd
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax]
test bl, bl
jne 0x442104
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4420fb
cmp dword [esp + 0x14], 0x103
jne 0x442104
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.0044a9a4
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
inc ecx
cmp dword [esp + 0x10], ecx
je 0x4420ca
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], str.Cancelled
call fcn.0044a9ea
xor eax, eax
inc eax
mov byte [esp + 0x40], al
mov dword [esp + 0x34], vtable.cancel_exception.0
push 0x48adfc
lea eax, [esp + 0x38]
jmp 0x442015