Function at 0x444a76
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c4
mov dword [ebp - 0x10], 0xef59d06f
mov esi, dword [ebp - 0x8c]
mov edi, dword [ebp - 0x6c]
mov ebx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xc778b7
jg 0x444b1f
cmp eax, 0xb8477b3a
jg 0x444b6d
cmp eax, 0xa657ae37
jg 0x444c2e
cmp eax, 0x99e1112e
jg 0x444d53
cmp eax, 0x88620ca7
je 0x4452d5
cmp eax, 0x8cdc0695
je 0x444f98
cmp eax, 0x97d983c9
jne 0x444abf
imul eax, dword [ebp - 0x14], 0x21000000
add eax, 0x4e1c0000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xc3e5584b
jmp 0x444abf
cmp eax, 0x2fcad01e
jle 0x444bd5
cmp eax, 0x5e8005ca
jg 0x444c78
cmp eax, 0x3c61ed52
jg 0x444da8
cmp eax, 0x2fcad01f
je 0x444fb0
cmp eax, 0x34461859
je 0x444fdb
cmp eax, 0x34bd1268
jne 0x444abf
mov dword [ebp - 0x10], 0xa4f48d1
jmp 0x444abf
cmp eax, 0xd6222b19
jle 0x444cb0
cmp eax, 0xed16efeb
jg 0x444dfc
cmp eax, 0xd6222b1a
je 0x444fe7
cmp eax, 0xdbe08cdf
je 0x445005
cmp eax, 0xe8e81bb5
jne 0x444abf
mov eax, dword [ebp - 0x14]
shl eax, 5
add eax, 0xfffff638
shr eax, 0xb
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x156253e9
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0x400
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
jmp 0x444abf
cmp eax, 0xe8c1cdc
jle 0x444d12
cmp eax, 0x208df622
jg 0x444e54
cmp eax, 0xe8c1cdd
je 0x44501d
cmp eax, 0x156253e9
je 0x445062
cmp eax, 0x18aa780c
jne 0x444abf
mov eax, dword [ebp - 0x14]
shr eax, 5
lea eax, [eax*4 - 0x3d]
shr eax, 8
add eax, 0x63
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x7cf7d653
jmp 0x444abf
cmp eax, 0xaf375a7c
jg 0x444ea8
cmp eax, 0xa657ae38
je 0x445080
cmp eax, 0xa7fd4ba0
je 0x44509c
cmp eax, 0xa8f6b7d7
jne 0x444abf
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x10], 0x689ef95a
jmp 0x444abf
cmp eax, 0x78f4dec7
jg 0x444edb
cmp eax, 0x5e8005cb
je 0x4450c2
cmp eax, 0x689ef95a
je 0x4450ce
cmp eax, 0x6c27be9a
jne 0x444abf
mov dword [ebp - 0x10], 0x34bd1268
jmp 0x444abf
cmp eax, 0xc3e5584a
jg 0x444f34
cmp eax, 0xb8477b3b
je 0x444df0
cmp eax, 0xbdd66765
je 0x4450e5
cmp eax, 0xc2169140
jne 0x444abf
shl esi, 0xc
and esi, 0xfff000
push 0x4a14
push 0x6334
push 0x4018
push esi
call fcn.00445490
add esp, 0x10
push esi
call fcn.00444a76
add esp, 4
mov dword [ebp - 0x10], 0xe8c1cdd
jmp 0x444abf
cmp eax, 0x8a28674
jle 0x444f6a
cmp eax, 0x8a28675
je 0x445123
cmp eax, 0xa4f48d1
je 0x445148
cmp eax, 0xdb71b0c
jne 0x444abf
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], 0xe8e81bb5
jmp 0x444abf
cmp eax, 0x99e1112f
je 0x44516c
cmp eax, 0xa024d5ed
je 0x445193
cmp eax, 0xa129cc60
jne 0x444abf
push 8
push 0x4750ba
push 0xd
push dword [ebp - 0x3c]
call fcn.004455c0
add esp, 0x10
push dword [ebp - 0x4c]
push dword [ebp - 0x1c]
push dword [ebp - 0x3c]
push dword [ebp + 8]
call fcn.00426b63
add esp, 0x10
mov dword [ebp - 0x10], 0x7f9054ae
jmp 0x444abf
cmp eax, 0x3c61ed53
je 0x44519f
cmp eax, 0x3e87969b
je 0x4451ab
cmp eax, 0x59b395a8
jne 0x444abf
shr esi, 5
and esi, 0x7ffff00
add esi, 0x7300
push 0x333d
push 0x1320
push esi
push 0x23e3
call fcn.00445490
add esp, 0x10
mov dword [ebp - 0x10], 0x2fcad01f
jmp 0x444abf
cmp eax, 0xed16efec
je 0x4451b7
cmp eax, 0xef59d06f
je 0x4451cf
cmp eax, 0xff542261
jne 0x444abf
push dword [ebp - 0x48]
push dword [ebp - 0x54]
push dword [ebp - 0x64]
call fcn.0044dac0
add esp, 0xc
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x64]
mov word [ecx + eax*2], 0xa
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x48]
add eax, ecx
add eax, 2
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], 0x5e8005cb
jmp 0x444abf
cmp eax, 0x208df623
je 0x4451db
cmp eax, 0x26b24fa0
je 0x4451e7
cmp eax, 0x26bf628f
jne 0x444abf
imul ecx, dword [ebp - 0x14], 0x32
mov eax, ecx
shr eax, 9
imul eax, eax
imul edx, eax, 0x75f7
shr ecx, 0xd
dec edx
add ecx, 0xffffffd9
mov dword [ebp - 0x14], ecx
mov ecx, 0xdbe08cdf
cmp edx, eax
je 0x445140
mov ecx, 0x6c27be9a
jmp 0x445140
cmp eax, 0xaf375a7d
je 0x4451f3
cmp eax, 0xb6d6d64c
je 0x44520b
cmp eax, 0xb8330b2f
jne 0x444abf
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0x10], 0xc4d090b9
jmp 0x444abf
cmp eax, 0x78f4dec8
je 0x445228
cmp eax, 0x7cf7d653
je 0x44523d
cmp eax, 0x7f9054ae
jne 0x444abf
mov eax, dword [ebp - 0x14]
mov ecx, 0xee
add eax, ecx
mov ecx, eax
imul ecx, eax
shl eax, 7
imul edx, ecx, 0x83cf
dec edx
add eax, 0x120
mov dword [ebp - 0x14], eax
mov eax, 0x8a28675
cmp ecx, edx
je 0x445161
mov eax, 0xb8330b2f
jmp 0x445161
cmp eax, 0xc3e5584b
je 0x445268
cmp eax, 0xcd43b188
jne 0x4452c8
push dword [ebp - 0x38]
push dword [ebp - 0x98]
call fcn.0045e881
add esp, 8
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x10], 0xd6222b1a
jmp 0x444abf
cmp eax, 0xc778b8
je 0x445298
cmp eax, 0x7e9f9ac
jne 0x444abf
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x10], 0xa7fd4ba0
jmp 0x444abf
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0xb8330b2f
mov edi, dword [ebp - 0x44]
jmp 0x444abf
push dword [ebp - 0x54]
call fcn.0045ecca
add esp, 4
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
add eax, eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add eax, 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x10], 0x18aa780c
jmp 0x444abf
mov dword [ebp - 0x10], 0x3e87969b
jmp 0x444abf
mov eax, dword [ebp - 0x14]
shr eax, 3
imul eax, eax, 0xc4
shr eax, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x7e9f9ac
jmp 0x444abf
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xb6d6d64c
jmp 0x444abf
push 0x228
push 0
push dword [ebp - 0x90]
call fcn.0044e5c0
add esp, 0xc
mov dword [ebp - 0x2d0], 0x22c
lea eax, [ebp - 0x2d0]
push eax
push dword [ebp - 0x18]
call sub.KERNEL32.dll_Process32FirstW
mov ecx, 0x34461859
test eax, eax
je 0x445140
mov ecx, 0xdb71b0c
jmp 0x445140
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], 0xb8477b3b
jmp 0x444abf
push 0x400
call fcn.0045e524
add esp, 4
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], 0x26b24fa0
jmp 0x444abf
mov ecx, dword [ebp - 0x5c]
mov eax, 0x99e1112f
cmp ecx, dword [ebp - 0x94]
ja 0x4450b1
mov eax, 0xed16efec
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x60]
jmp 0x444abf
mov dword [ebp - 0x10], 0x8a28675
jmp 0x444abf
mov eax, dword [ebp - 0x9c]
add eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 0x208df623
jmp 0x444abf
mov eax, dword [ebp - 0x14]
add eax, 0x74
imul ecx, eax, 0x8f
imul eax, eax
imul edx, eax, 0x4bfb
dec edx
add ecx, 0xffffff1b
mov dword [ebp - 0x14], ecx
mov ecx, 0x2fcad01f
cmp edx, eax
je 0x445112
mov ecx, 0xed16efec
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x20], eax
jmp 0x444abf
lea eax, [ebp - 0x2d0]
push eax
push dword [ebp - 0x18]
call sub.KERNEL32.dll_Process32NextW
mov ecx, 0x26bf628f
test eax, eax
je 0x445140
mov ecx, 0x88620ca7
mov dword [ebp - 0x10], ecx
jmp 0x444abf
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4c], 0
mov eax, 0xb8330b2f
je 0x445161
mov eax, 0x97d983c9
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x1c]
jmp 0x444abf
imul eax, dword [ebp - 0x14], 0xb00000
add eax, 0x133fff29
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xa8f6b7d7
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x24], eax
jmp 0x444abf
mov dword [ebp - 0x10], 0x3c61ed53
jmp 0x444abf
mov dword [ebp - 0x10], 0xaf375a7d
jmp 0x444abf
mov dword [ebp - 0x10], 0x8cdc0695
jmp 0x444abf
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], 0x78f4dec8
jmp 0x444abf
mov dword [ebp - 0x10], 0xa657ae38
jmp 0x444abf
mov dword [ebp - 0x10], 0xcd43b188
jmp 0x444abf
mov dword [ebp - 0x10], 0xdbe08cdf
jmp 0x444abf
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x10], 0xe8c1cdd
jmp 0x444abf
mov ecx, dword [ebp - 0x18]
mov eax, 0xb8330b2f
cmp ecx, 0xffffffff
je 0x44521d
mov eax, 0xa024d5ed
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x44]
jmp 0x444abf
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x10], 0xff542261
jmp 0x444abf
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x5c]
mov eax, 0xa8f6b7d7
cmp edx, ecx
ja 0x445254
mov eax, 0xbdd66765
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x24], eax
jmp 0x444abf
push eax
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov word [eax + 0x1a], 0
push 0x1a
push 0x4750a0
push dword [ebp - 0x3c]
call fcn.0044dac0
add esp, 0xc
mov dword [ebp - 0x10], 0xa129cc60
jmp 0x444abf
imul eax, esi, 0x1b3a
shr eax, 0xd
imul esi, eax, 0x4a
push 0x19d6
push 0x2784
push esi
push 0x1080
call fcn.004455c0
add esp, 0x10
mov dword [ebp - 0x10], 0xdb71b0c
jmp 0x444abf
cmp eax, 0xc4d090b9
jne 0x444abf
jmp 0x445304
mov eax, dword [ebp - 0x14]
shl eax, 0xd
add eax, 0x4a000
shr eax, 0x14
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x156253e9
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xa0]
jmp 0x444abc
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x74], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x80], eax
push dword [ebp - 0xa4]
call fcn.0045e17d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret