Function at 0x448c00
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a930
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x621810]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push 2
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x240], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x244], esi
cmp esi, 0xffffffff
je 0x448c79
lea ecx, [ebp - 0x23c]
push ecx
mov ebx, 0x22c
push esi
mov dword [ebp - 0x23c], ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x448c80
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x448ecc
lea edx, [ebp - 0x23c]
push edx
push esi
mov dword [ebp - 0x23c], ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x448ebf
mov ebx, 1
mov eax, dword [ebp - 0x248]
call fcn.004017ef
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0049065b
add esp, 8
test eax, eax
jne 0x448e9f
mov ecx, dword [ebp - 0x234]
add dword [ebp - 0x240], ebx
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
jne 0x448e8a
test byte [0x6353fc], bl
jne 0x448d91
or dword [0x6353fc], ebx
mov dword [ebp - 4], edi
push 0x635408
mov dword [0x635400], 0x5ff3e8
mov dword [0x635404], edi
mov dword [0x635420], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], bl
push 8
mov dword [0x635400], 0x5ff428
call fcn.0048bf08
add esp, 4
cmp eax, edi
je 0x448d41
mov dword [eax], 0xffffffff
mov byte [eax + 4], bl
mov esi, eax
jmp 0x448d43
xor esi, esi
push 0x635408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x635404]
add dword [0x635420], ebx
cmp eax, edi
je 0x448d66
push eax
call fcn.0048bcc1
add esp, 4
sub dword [0x635420], ebx
push 0x635408
mov dword [0x635404], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x5ae29a
call fcn.0048c9f3
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [0x635400]
mov eax, dword [edx + 8]
push str.OpenProcess_Error_
push str.utilCommonUtils.cpp
push 0x2a4
push 2
push 0x635400
call eax
add esp, 0x14
test byte [0x6353d0], bl
jne 0x448e6e
or dword [0x6353d0], ebx
mov dword [ebp - 4], 2
push 0x6353dc
mov dword [0x6353d4], 0x5ff3e8
mov dword [0x6353d8], edi
mov dword [0x6353f4], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 3
push 8
mov dword [0x6353d4], 0x5ff408
mov byte [0x6353f8], bl
call fcn.0048bf08
add esp, 4
cmp eax, edi
je 0x448e1e
mov dword [eax], 0xffffffff
mov byte [eax + 4], bl
mov esi, eax
jmp 0x448e20
xor esi, esi
push 0x6353dc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x6353d8]
add dword [0x6353f4], ebx
cmp eax, edi
je 0x448e43
push eax
call fcn.0048bcc1
add esp, 4
sub dword [0x6353f4], ebx
push 0x6353dc
mov dword [0x6353d8], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x5ae2ae
call fcn.0048c9f3
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x6353d4]
mov edx, dword [ecx + 4]
push str.OpenProcess_Error_
push 2
push 0x6353d4
call edx
add esp, 0xc
jmp 0x448e99
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x244]
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x448ca1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b951
mov esp, ebp
pop ebp
ret