Function at 0x44ebd0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e98bc
mov eax, dword fs:[0]
push eax
sub esp, 0x7a8
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x7a0], eax
push ebx
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x7b8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push 0x124
lea ecx, [esp + 0x8c]
push ebx
push ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x90], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor cl, cl
mov dword [esp + 0x2c], eax
mov byte [esp + 0x12], cl
cmp eax, 0xffffffff
je 0x44f126
lea edx, [esp + 0x1c]
push edx
call fcn.0044eb60
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
add esp, 4
test eax, eax
setne byte [esp + 0x13]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x64]
push eax
mov dword [esp + 0x88], 0x128
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x68]
push edx
call edi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ebx
lea eax, [esp + 0x3b0]
push eax
push ecx
push edx
call fcn.0044eb00
lea eax, [esp + 0x3bc]
push eax
push str.KillProcess4Ransom_CreateTime__5sec__limit__s_
push 8
call fcn.0043d500
mov ecx, dword [esp + 0x34]
add esp, 0x1c
push 1
push ebx
push ebx
push ecx
call fcn.004e0460
mov ecx, dword [esp + 0x14]
add eax, ecx
adc edx, ebx
add eax, 0xfa0a1f00
adc edx, 0xffffffff
push edx
push str.tc_KiloHigh
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call fcn.00491ff0
mov edx, dword [esp + 0x24]
push edx
push str.tc_KiloLow
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esp + 0x40]
add esp, 0x20
push 1
push ebx
push ebx
push eax
call fcn.004e0460
mov ecx, dword [esp + 0x1c]
add eax, ecx
adc edx, ebx
add eax, 0x23c34600
adc edx, ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x20], edx
lea edx, [esp + 0x84]
push edx
push ebx
mov dword [esp + 0x24], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x44f119
lea eax, [esp + 0x54]
push eax
call esi
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x58]
push edx
call edi
mov eax, dword [esp + 0x44]
push 1
push 0
push 0
push eax
call fcn.004e0460
mov ecx, dword [esp + 0x40]
xor esi, esi
add eax, ecx
adc edx, esi
add eax, 0x1c9c380
adc edx, esi
push edx
push str.tc_LimaHigh
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
call fcn.00491ff0
mov edx, dword [esp + 0x44]
push edx
push str.tc_LimaLow
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov esi, dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 0x20
mov eax, dword [esp + 0x8c]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
test edi, edi
je 0x44f103
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x30]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor bl, bl
cmp byte [esp + 0x13], bl
je 0x44ee39
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x44ee3b
mov bl, 1
cmp dword [esp + 0x8c], 0x28
jbe 0x44f0f8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x8c], eax
je 0x44f0f8
test bl, bl
je 0x44f0f8
mov ebx, dword [sym.imp.KERNEL32.dll_CompareFileTime]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
call ebx
cmp eax, 1
jne 0x44f0f8
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x44f0f8
push 0x50bd94
lea edx, [esp + 0xac]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x44f0f8
push 1
lea eax, [esp + 0xac]
push eax
push edi
call fcn.004defd0
add esp, 0xc
test eax, eax
jne 0x44f0f3
lea ecx, [esp + 0xa8]
push 0x50bd94
push ecx
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea edx, [esp + 0xa8]
push 0x50bd88
push edx
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea eax, [esp + 0xa8]
push str.searchprotocolhost.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea ecx, [esp + 0xa8]
push str.tc_au.exe
push ecx
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea edx, [esp + 0xa8]
push str.tc_restore.exe
push edx
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea eax, [esp + 0xa8]
push str.tc_un2.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea ecx, [esp + 0xa8]
push str.tc_8sr.exe
push ecx
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea edx, [esp + 0xa8]
push str.tc_io32.exe
push edx
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea eax, [esp + 0xa8]
push str.tc_end.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea ecx, [esp + 0xa8]
push str.tc_io32.exe
push ecx
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea edx, [esp + 0xa8]
push str.tc_svr.exe
push edx
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea eax, [esp + 0xa8]
push str.tc_sign.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea ecx, [esp + 0xa8]
push str.tc_end.exe
push ecx
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea edx, [esp + 0xa8]
push str.tc_un.exe
push edx
call esi
add esp, 8
test eax, eax
je 0x44f0f3
lea eax, [esp + 0x30]
push edi
push eax
mov byte [esp + 0x1a], 1
call fcn.0044e720
mov dword [esp + 0x7c8], 0
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push 0
lea ecx, [esp + 0x5b8]
push ecx
push edx
push eax
call fcn.0044eb00
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push 0
lea ecx, [esp + 0x1c8]
push ecx
push edx
push eax
call fcn.0044eb00
lea ecx, [esp + 0x1d4]
push ecx
mov ecx, dword [esp + 0xb8]
lea edx, [esp + 0x5d8]
push edx
movzx edx, byte [esp + 0x43]
lea eax, [esp + 0xd8]
push eax
push ecx
push edx
push str.SendInfoDisplayBlack_KillProcess4Ransom__d___d___s_CreateTime__s_MyBootTime__s_
push 8
call fcn.0043d500
mov eax, dword [esp + 0xd0]
add esp, 0x44
push eax
call fcn.00494cc0
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
push ecx
push bind
push edx
call fcn.00451ad0
add esp, 0x10
mov dword [esp + 0x7c0], 0xffffffff
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x44f0f8
mov byte [esp + 0x12], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x84]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x44edd5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x12]
jmp 0x44f128
mov al, cl
mov ecx, dword [esp + 0x7b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7a0]
xor ecx, esp
call fcn.004e0148
mov esp, ebp
pop ebp
ret