Function at 0x44d644
Capabilities:
Enumerate processes

Disassembly:
push 0x26c
mov eax, 0x4b165f
call fcn.00473acf
mov dword [ebp - 0x248], ecx
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
call fcn.00477234
push eax
call fcn.00479004
pop ecx
pop ecx
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x254]
push eax
call fcn.0043fa9a
mov dword [ebp - 4], esi
push esi
push 2
mov dword [ebp - 0x24c], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
push 0x4f930c
lea ecx, [ebp - 0x250]
mov edi, eax
call fcn.0040a6cc
mov byte [ebp - 4], 2
jmp 0x44d78d
lea eax, [ebp - 0x218]
push eax
call fcn.00413682
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x250]
call fcn.0040a8e3
push ecx
mov ecx, esp
mov dword [ebp - 0x240], esp
push 0x4c564c
call fcn.00418464
mov byte [ebp - 4], 3
push ecx
lea eax, [ebp - 0x254]
mov ecx, esp
mov dword [ebp - 0x244], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 4
lea eax, [ebp - 0x278]
push eax
mov byte [ebp - 4], 2
call fcn.0041d468
add esp, 0xc
mov byte [ebp - 4], 5
xor edi, edi
cmp dword [ebp - 0x274], esi
jle 0x44d76f
cmp edi, esi
jl 0x44d7dc
cmp edi, dword [ebp - 0x274]
jge 0x44d7dc
mov eax, dword [ebp - 0x278]
lea eax, [eax + edi*4]
push dword [eax]
lea ecx, [ebp - 0x250]
call fcn.004286e1
test eax, eax
je 0x44d797
inc edi
cmp edi, dword [ebp - 0x274]
jl 0x44d738
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
mov edi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x278]
call fcn.0042ecc3
cmp edi, esi
jne 0x44d6c7
jmp 0x44d7b0
mov dword [ebp - 0x24c], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x278]
call fcn.0042ecc3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24c], esi
je 0x44d7eb
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
call fcn.00409a10
jmp 0x44dbb8
push esi
push esi
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x260]
push eax
call fcn.0043f94a
mov byte [ebp - 4], 8
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x258]
push eax
call fcn.0043f99e
mov byte [ebp - 4], 9
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x25c]
push eax
call fcn.0043f9f2
mov byte [ebp - 4], 0xa
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x264]
push eax
call fcn.0043fa46
mov byte [ebp - 4], 0xb
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x244]
push eax
call fcn.0043faee
mov byte [ebp - 4], 0xc
push dword [eax]
call fcn.004790bf
pop ecx
call fcn.00479150
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.00409a10
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x244]
push eax
call fcn.0043fb42
mov byte [ebp - 4], 0xe
push dword [eax]
call fcn.004790bf
pop ecx
call fcn.00479150
mov dword [ebp - 0x26c], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.00409a10
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x244]
push eax
call fcn.0043fb96
mov byte [ebp - 4], 0x10
push dword [eax]
call fcn.004790bf
pop ecx
call fcn.00479150
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.00409a10
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x240]
push eax
call fcn.0043fbea
mov byte [ebp - 4], 0x12
push dword [eax]
call fcn.004790bf
pop ecx
call fcn.00479150
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.00409a10
mov eax, dword [ebp - 0x260]
mov eax, dword [eax - 0xc]
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 0x61a8
mov edi, str.about:blank
je 0x44d9c6
cmp dword [ebp - 0x24c], 0
jle 0x44d9c6
call fcn.00479016
cdq
idiv dword [ebp - 0x24c]
inc edx
cmp edx, 1
jne 0x44d9c6
push edx
push ecx
lea eax, [ebp - 0x260]
mov ecx, esp
mov dword [ebp - 0x240], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x248]
call fcn.004417f7
call fcn.00479016
cdq
mov ecx, 0x2710
idiv ecx
add edx, ebx
push edx
call esi
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x240], esp
push edi
call fcn.00418464
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x248]
call fcn.004417f7
mov eax, dword [ebp - 0x258]
cmp dword [eax - 0xc], 0
je 0x44da4c
cmp dword [ebp - 0x26c], 0
jle 0x44da4c
call fcn.00479016
cdq
idiv dword [ebp - 0x26c]
inc edx
cmp edx, 1
jne 0x44da4c
push edx
push ecx
lea eax, [ebp - 0x258]
mov ecx, esp
mov dword [ebp - 0x240], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x248]
call fcn.004417f7
call fcn.00479016
cdq
mov ecx, 0x2710
idiv ecx
add edx, ebx
push edx
call esi
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x240], esp
push edi
call fcn.00418464
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x248]
call fcn.004417f7
mov eax, dword [ebp - 0x25c]
cmp dword [eax - 0xc], 0
je 0x44dad2
cmp dword [ebp - 0x268], 0
jle 0x44dad2
call fcn.00479016
cdq
idiv dword [ebp - 0x268]
inc edx
cmp edx, 1
jne 0x44dad2
push edx
push ecx
lea eax, [ebp - 0x25c]
mov ecx, esp
mov dword [ebp - 0x240], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x248]
call fcn.004417f7
call fcn.00479016
cdq
mov ecx, 0x2710
idiv ecx
add edx, ebx
push edx
call esi
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x240], esp
push edi
call fcn.00418464
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x248]
call fcn.004417f7
mov eax, dword [ebp - 0x264]
cmp dword [eax - 0xc], 0
je 0x44db58
cmp dword [ebp - 0x244], 0
jle 0x44db58
call fcn.00479016
cdq
idiv dword [ebp - 0x244]
inc edx
cmp edx, 1
jne 0x44db58
push edx
push ecx
lea eax, [ebp - 0x264]
mov ecx, esp
mov dword [ebp - 0x240], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x248]
call fcn.004417f7
call fcn.00479016
cdq
mov ecx, 0x2710
idiv ecx
add edx, ebx
push edx
call esi
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x240], esp
push edi
call fcn.00418464
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x248]
call fcn.004417f7
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x25c]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x258]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x260]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
call fcn.00409a10
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x254]
add ecx, 0xfffffff0
call fcn.00409a10
call fcn.00473b52
ret