Function at 0x4438dc
Capabilities:
Enumerate processes

Disassembly:
push ebp
push ebx
mov edx, 0x97
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4438e3
call fcn.0057b2e0
mov edx, dword [esp + 0x268]
lea ecx, [esp]
call fcn.0050d0f0
mov dword [section..data], 0x17000d7
mov dword [section..data], 0x17000e3
mov dword [esp + 0xc], 0
mov dword [section..data], 0x17000e4
mov dword [esp + 0x10], 0
mov dword [section..data], 0x17000e7
mov dword [esp + 0x1c], 0
mov dword [section..data], 0x17000e8
mov dword [esp + 0x20], 0
mov dword [section..data], 0x17000eb
mov dword [esp + 0x254], 1
mov dword [section..data], 0x17000ee
mov dword [section..data], 0x17000f0
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push 0x1f4
call fcn.0056a2d0
lea eax, [esp + 0x18]
push eax
call fcn.0057b350
mov dword [section..data], 0x17000f1
push dword [esp + 0x14]
call fcn.00569960
mov dword [esp + 0x18], eax
mov dword [section..data], 0x17000f3
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 8]
call fcn.0056dd91
lea eax, [esp + 8]
push eax
call fcn.0057b350
mov dword [section..data], 0x17000f4
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 8]
call fcn.0056dda3
lea eax, [esp + 0xc]
push eax
call fcn.0057b350
mov dword [section..data], 0x17000f6
push edx
call fcn.0057b460
pop edx
push eax
push 3
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.Filename__
push edx
call fcn.0057b230
mov edx, dword [esp + 0xc]
push edx
call fcn.0057b230
mov edx, str._____ExePath__
push edx
call fcn.0057b230
mov edx, dword [esp + 0x14]
push edx
call fcn.0057b230
mov edx, str.__ExeFile__
push edx
call fcn.0057b230
mov edx, dword [esp + 0x10]
push edx
call fcn.0057b230
mov edx, 0x67df2c
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str._GetProcData
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x17000f8
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x10], eax
mov dword [section..data], 0x17000fa
mov ebx, dword [esp + 0x10]
cmp ebx, 0xffffffff
jne 0x443b0f
mov dword [section..data], 0x17000fb
push 0
mov eax, str.Failed_to_exec_CreateToolhelp32Snapshot___InvalidHandleValue
push eax
mov eax, str._GetProcData
push eax
call fcn.0044386c
mov dword [section..data], 0x17000fc
mov dword [esp + 0x254], 0xfffff7cb
mov dword [section..data], 0x17000fd
jmp 0x444365
mov dword [section..data], 0x17000fe
mov dword [section..data], 0x1700100
lea ebp, [esp + 0x24]
mov dword [ebp], 0x22c
mov dword [section..data], 0x1700101
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32FirstW
and eax, eax
je 0x443b4e
xor eax, eax
jmp 0x443b53
mov eax, 1
and eax, eax
je 0x443c77
mov dword [section..data], 0x1700102
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x250], eax
mov dword [section..data], 0x1700103
mov ebx, dword [esp + 0x250]
cmp ebx, 0x12
jne 0x443bb6
mov dword [section..data], 0x1700104
push 3
mov eax, str.No_running_processes_detected
push eax
mov eax, str._GetProcData
push eax
call fcn.0044386c
mov dword [section..data], 0x1700105
jmp 0x444365
mov dword [section..data], 0x1700106
mov dword [section..data], 0x1700108
push edx
call fcn.0057b460
pop edx
push eax
push 0
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.Failed_to_get_Process32First____
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
mov eax, dword [esp + 0x264]
cdq
push edx
push eax
call fcn.0056a320
pop eax
mov edx, 0x69ad3c
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x260]
call fcn.00442f5c
pop eax
mov edx, 0x67ce72
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str._GetProcData
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x1700109
mov dword [esp + 0x254], 0xfffff7ca
mov dword [section..data], 0x170010a
jmp 0x444365
mov dword [section..data], 0x170010b
mov dword [section..data], 0x170010d
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
lea ebp, [esp + 0x34]
lea eax, [ebp + 0x24]
push eax
call fcn.0057ae20
call fcn.0050d222
add dword [esp], edx
call fcn.0056ab00
call fcn.0057b490
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x10]
call fcn.0056ab00
call fcn.0050d250
mov edx, eax
pop ecx
push ecx
call fcn.0050d250
mov ecx, eax
call fcn.0050d1d0
je 0x443fb9
mov dword [section..data], 0x170010e
lea ebp, [esp + 0x24]
push dword [ebp + 8]
pop eax
mov dword [esp + 0xc], eax
mov dword [section..data], 0x170010f
push edx
call fcn.0057b460
pop edx
push eax
push 3
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.Detected_process__
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
mov eax, dword [esp + 0x20]
cdq
push edx
push eax
call fcn.0056a320
pop eax
mov edx, 0x67df2c
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str._GetProcData
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x1700111
push dword [esp + 8]
mov edx, 0x67a5ae
pop ecx
call fcn.0050d1d0
jne 0x443f4b
mov dword [section..data], 0x1700113
lea eax, [esp + 0x258]
push eax
push dword [esp + 8]
push dword [esp + 0x14]
call fcn.00444423
mov dword [esp + 0x250], eax
mov dword [section..data], 0x1700114
mov ebx, dword [esp + 0x250]
cmp ebx, 1
jge 0x443e73
mov dword [section..data], 0x1700115
push edx
call fcn.0057b460
pop edx
push eax
push 0
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.Getting_fullpath_from_pid_failed____
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x260]
call fcn.004430b9
pop eax
mov edx, 0x67df2c
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str._GetProcData
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x1700116
push dword [esp + 0x250]
pop eax
mov dword [esp + 0x254], eax
mov dword [section..data], 0x1700117
jmp 0x444365
mov dword [section..data], 0x1700118
mov dword [section..data], 0x170011a
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
lea ebp, [esp + 0x260]
push dword [ebp]
call fcn.0056ab00
call fcn.0057b490
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0xc]
call fcn.0056ab00
call fcn.0050d250
mov edx, eax
pop ecx
push ecx
call fcn.0050d250
mov ecx, eax
call fcn.0050d1d0
je 0x443f35
mov dword [section..data], 0x170011b
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x443f03
mov ebx, dword [esp + 0x270]
cmp ebx, 1
jne 0x443f03
mov eax, 1
jmp 0x443f05
xor eax, eax
and eax, eax
je 0x443f18
mov dword [section..data], 0x170011c
jmp 0x444365
mov dword [section..data], 0x170011d
mov dword [section..data], 0x170011e
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x170011f
mov dword [section..data], 0x1700120
jmp 0x443faf
mov dword [section..data], 0x1700120
mov dword [section..data], 0x1700121
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x443f7d
mov ebx, dword [esp + 0x270]
cmp ebx, 1
jne 0x443f7d
mov eax, 1
jmp 0x443f7f
xor eax, eax
and eax, eax
je 0x443f92
mov dword [section..data], 0x1700122
jmp 0x444365
mov dword [section..data], 0x1700123
mov dword [section..data], 0x1700125
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x1700126
mov dword [section..data], 0x1700127
mov dword [section..data], 0x1700129
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32NextW
and eax, eax
je 0x444348
mov dword [section..data], 0x170012a
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
lea ebp, [esp + 0x34]
lea eax, [ebp + 0x24]
push eax
call fcn.0057ae20
call fcn.0050d222
add dword [esp], edx
call fcn.0056ab00
call fcn.0057b490
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x10]
call fcn.0056ab00
call fcn.0050d250
mov edx, eax
pop ecx
push ecx
call fcn.0050d250
mov ecx, eax
call fcn.0050d1d0
je 0x44432f
mov dword [section..data], 0x170012b
lea ebp, [esp + 0x24]
push dword [ebp + 8]
pop eax
mov dword [esp + 0xc], eax
mov dword [section..data], 0x170012c
push edx
call fcn.0057b460
pop edx
push eax
push 3
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.Detected_process__
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
mov eax, dword [esp + 0x20]
cdq
push edx
push eax
call fcn.0056a320
pop eax
mov edx, str.__for_file__
push edx
call fcn.0057b230
mov edx, dword [esp + 0x10]
push edx
call fcn.0057b230
mov edx, 0x67df2c
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str._GetProcData
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x170012e
push dword [esp + 8]
mov edx, 0x67a5ae
pop ecx
call fcn.0050d1d0
jne 0x4442c3
mov dword [section..data], 0x1700130
lea eax, [esp + 0x258]
push eax
push dword [esp + 8]
push dword [esp + 0x14]
call fcn.00444423
mov dword [esp + 0x250], eax
mov dword [section..data], 0x1700131
mov ebx, dword [esp + 0x250]
cmp ebx, 1
jge 0x4441ea
mov dword [section..data], 0x1700132
push edx
call fcn.0057b460
pop edx
push eax
push 0
push edx
call fcn.0057b460
pop edx
push eax
mov edx, str.Getting_fullpath_from_pid_failed____
push edx
call fcn.0057b230
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0x260]
call fcn.004430b9
pop eax
mov edx, 0x67df2c
push edx
call fcn.0057b230
call fcn.0057b490
mov eax, str._GetProcData
push eax
call fcn.0050d222
add dword [esp + 4], edx
call fcn.0044386c
call fcn.0050d240
mov dword [section..data], 0x1700133
push dword [esp + 0x250]
pop eax
mov dword [esp + 0x254], eax
mov dword [section..data], 0x1700134
jmp 0x444348
mov dword [section..data], 0x1700135
mov dword [section..data], 0x1700137
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
lea ebp, [esp + 0x260]
push dword [ebp]
call fcn.0056ab00
call fcn.0057b490
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 0xc]
call fcn.0056ab00
call fcn.0050d250
mov edx, eax
pop ecx
push ecx
call fcn.0050d250
mov ecx, eax
call fcn.0050d1d0
je 0x4442ad
mov dword [section..data], 0x1700138
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x170013a
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x44428e
mov ebx, dword [esp + 0x270]
cmp ebx, dword [esp + 0x20]
jne 0x44428e
mov eax, 1
jmp 0x444290
xor eax, eax
and eax, eax
je 0x4442a3
mov dword [section..data], 0x170013b
jmp 0x444348
mov dword [section..data], 0x170013c
mov dword [section..data], 0x170013e
mov dword [section..data], 0x170013f
jmp 0x444325
mov dword [section..data], 0x170013f
mov dword [section..data], 0x1700140
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
mov dword [section..data], 0x1700142
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x444309
mov ebx, dword [esp + 0x270]
cmp ebx, dword [esp + 0x20]
jne 0x444309
mov eax, 1
jmp 0x44430b
xor eax, eax
and eax, eax
je 0x44431b
mov dword [section..data], 0x1700143
jmp 0x444348
mov dword [section..data], 0x1700144
mov dword [section..data], 0x1700146
mov dword [section..data], 0x1700147
mov dword [section..data], 0x1700148
jmp 0x443fc3
mov dword [section..data], 0x170014a
push dword [esp + 0x10]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x170014c
mov dword [section..data], 0x170014e
mov ebx, dword [esp + 0x254]
cmp ebx, 1
jge 0x44438e
mov dword [section..data], 0x170014f
mov eax, dword [esp + 0x254]
jmp 0x4443e3
mov dword [section..data], 0x1700150
mov dword [section..data], 0x1700152
mov ebx, dword [esp + 0x26c]
and ebx, ebx
jne 0x4443bd
mov dword [section..data], 0x1700153
mov eax, dword [esp + 0xc]
jmp 0x4443e3
mov dword [section..data], 0x1700154
mov dword [section..data], 0x1700156
mov eax, dword [esp + 0x20]
jmp 0x4443e3
push dword [esp + 0x14]
call fcn.0057b3c0
push dword [esp + 8]
call fcn.0057b3c0
push dword [esp]
call fcn.0057b3c0
lea edx, [esp + 0x258]
push 0x6b474c
push edx
call fcn.005306d3
push dword [esp + 4]
call fcn.0057b3c0
add esp, 0x25c
pop ebx
pop ebp
ret 0xc