Function at 0x4404b0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f65ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x568
mov eax, dword [0x540cc0]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1b0]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
mov dword [ebp - 4], 0
push 5
lea ecx, [ebp - 0x55c]
push ecx
lea ecx, [ebp - 0x1b0]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
mov dword [ebp - 0x568], eax
mov edx, dword [ebp - 0x568]
mov dword [ebp - 0x56c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x1b0]
call dword [0x502474]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x55c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [ebp - 0x1b0]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::MakeLower]
lea ecx, [ebp - 0x1a8]
call dword [0x502480]
mov byte [ebp - 4], 2
push 1
push 0x105
lea ecx, [ebp - 0x2f8]
call sub.pmc.dll_public:_void___thiscall_CMemOper::constructor_int__int_
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x560]
push ecx
call fcn.00430940
add esp, 4
mov dword [ebp - 0x570], eax
mov edx, dword [ebp - 0x570]
mov dword [ebp - 0x574], edx
mov byte [ebp - 4], 4
push 0x104
lea ecx, [ebp - 0x2f8]
call sub.pmc.dll_public:_unsigned_char____thiscall_CMemOper::GetBuffer_void_
push eax
mov ecx, dword [ebp - 0x574]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x560]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [ebp - 0x2f8]
call sub.pmc.dll_public:_unsigned_char____thiscall_CMemOper::GetBuffer_void_
push eax
lea ecx, [ebp - 0x1a8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Append_1]
lea ecx, [ebp - 0x1a8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::MakeLower]
lea ecx, [ebp - 0x1a8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Trim]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14], eax
push 0x128
push 0
lea eax, [ebp - 0x2dc]
push eax
call sub.MSVCR71.dll_memset
add esp, 0xc
mov dword [ebp - 0x2dc], 0x128
lea ecx, [ebp - 0x2dc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x1ac], 0
je 0x440864
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x548]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2d4]
push ecx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0
je 0x44068c
cmp dword [ebp - 0x52c], 0xffffffff
jne 0x4406d7
push 0x128
push 0
lea edx, [ebp - 0x2dc]
push edx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov dword [ebp - 0x2dc], 0x128
lea eax, [ebp - 0x2dc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x1ac], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x548]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
jmp 0x440642
push 0x224
push 0
lea edx, [ebp - 0x524]
push edx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov dword [ebp - 0x524], 0x224
lea eax, [ebp - 0x524]
push eax
mov ecx, dword [ebp - 0x52c]
push ecx
call sub.KERNEL32.dll_Module32First
lea ecx, [ebp - 0x528]
call dword [0x502480]
mov byte [ebp - 4], 6
push 1
push 0x105
lea ecx, [ebp - 0x544]
call sub.pmc.dll_public:_void___thiscall_CMemOper::constructor_int__int_
mov byte [ebp - 4], 7
push 0x104
lea ecx, [ebp - 0x544]
call sub.pmc.dll_public:_unsigned_char____thiscall_CMemOper::GetBuffer_void_
push eax
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea ecx, [ebp - 0x544]
call sub.pmc.dll_public:_unsigned_char____thiscall_CMemOper::GetBuffer_void_
push eax
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Append_1]
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::MakeLower]
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Trim]
push 0
lea ecx, [ebp - 0x1a8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Find_1]
test eax, eax
jne 0x4407ed
lea ecx, [ebp - 0x548]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::MakeLower]
lea ecx, [ebp - 0x548]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Trim]
push 0
lea ecx, [ebp - 0x1b0]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [ebp - 0x548]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Find_1]
test eax, eax
jne 0x4407ed
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0x1a4], ecx
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x52c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x128
push 0
lea ecx, [ebp - 0x2dc]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov dword [ebp - 0x2dc], 0x128
lea edx, [ebp - 0x2dc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x1ac], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x544]
call sub.pmc.dll_public:_void___thiscall_CMemOper::destructor_void_
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x548]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
jmp 0x440642
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x54c], 0
jmp 0x440895
mov edx, dword [ebp - 0x54c]
add edx, 1
mov dword [ebp - 0x54c], edx
mov eax, dword [ebp - 0x54c]
cmp eax, dword [ebp - 0x10]
jge 0x44092c
mov ecx, dword [ebp - 0x54c]
mov edx, dword [ebp + ecx*4 - 0x1a4]
push edx
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 0
je 0x4408d7
cmp dword [ebp - 0x550], 0xffffffff
jne 0x4408d9
jmp 0x440886
mov eax, dword [ebp - 0x54c]
mov ecx, dword [ebp - 0x2e0]
cmp ecx, dword [ebp + eax*4 - 0x1a4]
jne 0x4408f0
jmp 0x440886
push 0
mov edx, dword [ebp - 0x550]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x554], 0
jne 0x440927
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x558], eax
jmp 0x440886
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x564], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2f8]
call sub.pmc.dll_public:_void___thiscall_CMemOper::destructor_void_
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1a8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b0]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, dword [ebp - 0x564]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x1b4]
call fcn.004f2f91
mov esp, ebp
pop ebp
ret