Function at 0x449ca0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x150
mov eax, dword [str.GetLoginUser__]
mov edx, dword [0x4e7a6c]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 0x14], eax
mov ax, word [0x4e7a70]
mov ecx, dword [0x4e7a68]
mov word [esp + 0x20], ax
mov eax, dword [ebp + 0x119c]
mov dword [esp + 0x18], ecx
mov cl, byte [0x4e7a72]
push esi
push edi
test eax, eax
mov dword [esp + 0x24], edx
mov byte [esp + 0x2a], cl
je 0x44a039
mov eax, dword [ebp + 0x11a0]
test eax, eax
je 0x44a039
mov eax, dword [ebp + 0x11a4]
test eax, eax
je 0x44a039
mov eax, dword [ebp + 0x11a8]
test eax, eax
je 0x44a039
push 0
push 2
mov dword [esp + 0x40], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x2c], esi
jne 0x449d7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e7a40
lea edx, [ebp + 0x55]
push 0xfff
push edx
call fcn.00466ca7
mov edx, dword [0x4d29e4]
mov eax, dword [ebp]
add esp, 0x10
lea ecx, [esp + 0x1c]
push 0xbbb
push ecx
push edx
mov ecx, ebp
call dword [eax + 0x10]
pop edi
pop esi
pop ebp
mov eax, 0x23
pop ebx
add esp, 0x150
ret 0x14
lea eax, [esp + 0x38]
push eax
push esi
call sub.KERNEL32.dll_Process32First
lea ecx, [esp + 0x38]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x449ea0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [str.explorer.exe]
lea eax, [esp + 0x5c]
push edx
push eax
call fcn.00468480
add esp, 8
test eax, eax
je 0x449e89
mov ecx, dword [esp + 0x40]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x449e89
lea edx, [esp + 0x14]
push edx
push 0x20008
push esi
call dword [ebp + 0x11a4]
test eax, eax
push esi
jne 0x449df3
call edi
jmp 0x449e89
call edi
push 0x48
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [esp + 0x14]
mov ebx, eax
lea eax, [esp + 0x34]
push eax
push 0x48
push ebx
push 1
push ecx
call dword [ebp + 0x11a8]
test eax, eax
jne 0x449e2a
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esp + 0x14]
push edx
call edi
jmp 0x449e89
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [esp + 0x168]
mov eax, dword [esp + 0x164]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x174]
push edx
mov edx, dword [esp + 0x174]
push eax
mov eax, dword [ebx]
push ecx
push edx
push eax
push 0
call dword [ebp + 0x11a0]
test eax, eax
je 0x449e82
cmp dword [esp + 0x18], 5
je 0x449e82
mov edx, dword [ebx]
lea ecx, [esp + 0x30]
push ecx
push edx
call dword [ebp + 0x11ac]
test eax, eax
jne 0x449f56
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x38]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x449d9e
lea ebx, [ebp + 0x55]
push 0x4e7a10
push 0xfff
push ebx
call fcn.00466ca7
mov ecx, dword [0x4d29e0]
mov edx, dword [ebp]
add esp, 0xc
lea eax, [esp + 0x1c]
push 0xc02
push eax
push ecx
mov ecx, ebp
call dword [edx + 0x10]
mov edi, dword [str.S_1_5_18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x10]
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x174]
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [str.S_1_5_18]
push ecx
call dword [ebp + 0x119c]
test eax, eax
jne 0x449f99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e79f4
push 0xfff
push ebx
call fcn.00466ca7
mov ecx, dword [0x4d29e4]
mov edx, dword [ebp]
add esp, 0x10
lea eax, [esp + 0x1c]
push 0xc07
push eax
push ecx
mov ecx, ebp
call dword [edx + 0x10]
pop edi
pop esi
pop ebp
mov eax, 0x10
pop ebx
add esp, 0x150
ret 0x14
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x178]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x150
ret 0x14
mov eax, dword [esp + 0x168]
mov ecx, dword [esp + 0x164]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x174]
push eax
mov eax, dword [esp + 0x174]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
push ecx
push 0
call dword [ebp + 0x11a0]
test eax, eax
jne 0x44a01f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e75dc
push 0xfff
push ebx
call fcn.00466ca7
mov ecx, dword [0x4d29e4]
mov edx, dword [ebp]
add esp, 0x10
lea eax, [esp + 0x1c]
push 0xc0f
push eax
push ecx
mov ecx, ebp
call dword [edx + 0x10]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
mov eax, 0x10
pop ebx
add esp, 0x150
ret 0x14
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x150
ret 0x14
push 0x4e79dc
lea ecx, [ebp + 0x55]
push 0xfff
push ecx
call fcn.00466ca7
mov ecx, dword [0x4d29e4]
mov edx, dword [ebp]
add esp, 0xc
lea eax, [esp + 0x1c]
push 0xbaf
push eax
push ecx
mov ecx, ebp
call dword [edx + 0x10]
pop edi
pop esi
pop ebp
mov eax, 0x23
pop ebx
add esp, 0x150
ret 0x14