Function at 0x44791c
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
mov eax, 0x4e0b1e
call fcn.004d1ec0
sub esp, 0x484
mov eax, dword [0x52f220]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor eax, ebp
push 0x4ed79d
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x490], ecx
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
xor edi, edi
mov dword [ebx], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
mov dword [ebp - 0x464], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x218]
push str.Program_Manager
push eax
call dword [sym.imp.MSVCR71.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x447991
mov dword [ebx], edi
jmp 0x447b1f
cmp dword [ebp - 0x464], edi
je 0x447b1f
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
call esi
push 1
mov dword [ebp - 0x468], eax
call esi
cmp dword [ebp - 0x468], edi
mov dword [ebp - 0x48c], eax
jle 0x447b1e
cmp eax, edi
jle 0x447b1e
lea eax, [ebp - 0x478]
push eax
push dword [ebp - 0x464]
mov dword [ebp - 0x478], edi
mov dword [ebp - 0x474], edi
mov dword [ebp - 0x470], edi
mov dword [ebp - 0x46c], edi
call dword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
je 0x447b1e
mov eax, dword [ebp - 0x478]
mov esi, dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x480]
push eax
push dword [ebp - 0x464]
call esi
test eax, eax
je 0x447b1e
lea eax, [ebp - 0x488]
push eax
push dword [ebp - 0x464]
call esi
test eax, eax
je 0x447b1e
mov eax, dword [ebp - 0x480]
cmp eax, edi
mov ecx, dword [ebp - 0x47c]
mov edx, dword [ebp - 0x488]
mov esi, dword [ebp - 0x484]
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], ecx
mov dword [ebp - 0x470], edx
mov dword [ebp - 0x46c], esi
jg 0x447aaf
cmp ecx, edi
jg 0x447aaf
cmp edx, dword [ebp - 0x468]
jl 0x447aaf
cmp esi, dword [ebp - 0x48c]
jl 0x447aaf
xor eax, eax
inc eax
jmp 0x447ab1
xor eax, eax
mov dword [ebx], eax
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x464]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x468], edi
je 0x447b1e
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x447b1e
lea eax, [ebp - 0x460]
push eax
push esi
mov dword [ebp - 0x460], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, edi
je 0x447b17
mov eax, dword [ebp - 0x468]
cmp eax, dword [ebp - 0x458]
je 0x447b39
lea eax, [ebp - 0x460]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x447af8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d1f17
leave
ret 8
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00454812
pop ecx
pop ecx
push dword [ebp - 0x490]
lea ecx, [ebp - 0x234]
push dword [ebp - 0x220]
mov dword [ebp - 4], edi
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call fcn.004519f2
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x447b1e