Function at 0x443bd0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448fc7
mov eax, dword fs:[0]
push eax
sub esp, 0x790
mov eax, dword [0x4594d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x280], 0
mov eax, 0x44ea10
lea ecx, [ebp - 0x2d0]
call fcn.00404fe0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x2d0]
push eax
call fcn.00443030
add esp, 8
mov eax, 0x44ea4c
lea ecx, [ebp - 0x278]
call fcn.00404fe0
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x278]
push ecx
call fcn.00443030
add esp, 8
lea ecx, [ebp - 0x2b4]
call fcn.00410ae0
mov byte [ebp - 4], 2
mov eax, str._programfiles_conhost.exe
lea ecx, [ebp - 0x3b8]
call fcn.00404fe0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x3b8]
push edx
lea ebx, [ebp - 0x2b4]
call fcn.0040f7b0
mov byte [ebp - 4], 2
lea esi, [ebp - 0x3b8]
call fcn.00401380
mov eax, str._AppData_BlueFlare_AntivirusBlueFlare_Antivirus.exe
lea ecx, [ebp - 0x3d4]
call fcn.00404fe0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x3d4]
push eax
lea ebx, [ebp - 0x2b4]
call fcn.0040f7b0
mov byte [ebp - 4], 2
lea esi, [ebp - 0x3d4]
call fcn.00401380
mov eax, str._AppData_Wolfram_AntivirusWolfram_Antivirus.exe
lea ecx, [ebp - 0x3f0]
call fcn.00404fe0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3f0]
push ecx
lea ebx, [ebp - 0x2b4]
call fcn.0040f7b0
mov byte [ebp - 4], 2
lea esi, [ebp - 0x3f0]
call fcn.00401380
mov eax, str._AppData_OpenCloud_AntivirusOpenCloud_Antivirus.exe
lea ecx, [ebp - 0x40c]
call fcn.00404fe0
mov byte [ebp - 4], 6
lea edx, [ebp - 0x40c]
push edx
lea ebx, [ebp - 0x2b4]
call fcn.0040f7b0
mov byte [ebp - 4], 2
lea esi, [ebp - 0x40c]
call fcn.00401380
lea esi, [ebp - 0x2d8]
lea edi, [ebp - 0x2b4]
call fcn.0040f860
jmp 0x443d6e
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.00410b70
lea esi, [ebp - 0x41c]
lea edi, [ebp - 0x2b4]
call fcn.0040f880
mov esi, eax
lea edi, [ebp - 0x2d8]
call fcn.0040fd00
movzx ecx, al
test ecx, ecx
je 0x443dab
push 0
lea ecx, [ebp - 0x2d8]
call fcn.00411310
push eax
call fcn.00443030
add esp, 8
jmp 0x443d5a
lea ecx, [ebp - 0x25c]
call fcn.00410ae0
mov byte [ebp - 4], 7
mov eax, str._AppData_
lea ecx, [ebp - 0x438]
call fcn.00404fe0
mov byte [ebp - 4], 8
lea edx, [ebp - 0x438]
push edx
lea ebx, [ebp - 0x25c]
call fcn.0040f7b0
mov byte [ebp - 4], 7
lea esi, [ebp - 0x438]
call fcn.00401380
mov eax, str._LOCALAPPDATA_
lea ecx, [ebp - 0x454]
call fcn.00404fe0
mov byte [ebp - 4], 9
lea eax, [ebp - 0x454]
push eax
lea ebx, [ebp - 0x25c]
call fcn.0040f7b0
mov byte [ebp - 4], 7
lea esi, [ebp - 0x454]
call fcn.00401380
mov eax, str._ALLUSERSPROFILE_
lea ecx, [ebp - 0x470]
call fcn.00404fe0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x470]
push ecx
lea ebx, [ebp - 0x25c]
call fcn.0040f7b0
mov byte [ebp - 4], 7
lea esi, [ebp - 0x470]
call fcn.00401380
mov eax, str._ALLUSERSPROFILE_Application_Data
lea ecx, [ebp - 0x48c]
call fcn.00404fe0
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x48c]
push edx
lea ebx, [ebp - 0x25c]
call fcn.0040f7b0
mov byte [ebp - 4], 7
lea esi, [ebp - 0x48c]
call fcn.00401380
mov eax, str._USERPROFILE_Local_SettingsApplication_Data
lea ecx, [ebp - 0x4a8]
call fcn.00404fe0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x4a8]
push eax
lea ebx, [ebp - 0x25c]
call fcn.0040f7b0
mov byte [ebp - 4], 7
lea esi, [ebp - 0x4a8]
call fcn.00401380
mov eax, str._ALLUSERSPROFILE_pcdfdata
lea ecx, [ebp - 0x4c4]
call fcn.00404fe0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x4c4]
push ecx
lea ebx, [ebp - 0x25c]
call fcn.0040f7b0
mov byte [ebp - 4], 7
lea esi, [ebp - 0x4c4]
call fcn.00401380
mov eax, str._ALLUSERSPROFILE_Application_Datapcdfdata
lea ecx, [ebp - 0x4e0]
call fcn.00404fe0
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x4e0]
push edx
lea ebx, [ebp - 0x25c]
call fcn.0040f7b0
mov byte [ebp - 4], 7
lea esi, [ebp - 0x4e0]
call fcn.00401380
lea esi, [ebp - 0x2e0]
lea edi, [ebp - 0x25c]
call fcn.0040f860
jmp 0x443f54
push 0
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.00410b70
lea esi, [ebp - 0x4f0]
lea edi, [ebp - 0x25c]
call fcn.0040f880
mov esi, eax
lea edi, [ebp - 0x2e0]
call fcn.0040fd00
movzx ecx, al
test ecx, ecx
je 0x443f91
push 1
lea ecx, [ebp - 0x2e0]
call fcn.00411310
push eax
call fcn.00443030
add esp, 8
jmp 0x443f40
mov eax, str._APPDATA_Microsoft
lea ecx, [ebp - 0x29c]
call fcn.00404fe0
mov byte [ebp - 4], 0xf
push 1
lea edx, [ebp - 0x29c]
push edx
call fcn.00443030
add esp, 8
cmp dword [ebp - 0x27c], 0xffffffff
je 0x444b24
mov dword [ebp - 0x244], 0x22c
lea ecx, [ebp - 0x2f8]
call fcn.00410880
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x27c]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x444072
mov edx, dword [ebp - 0x27c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4f4], 0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x2f8]
call fcn.004108f0
mov byte [ebp - 4], 7
lea esi, [ebp - 0x29c]
call fcn.00401380
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x25c]
call fcn.00410b50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2b4]
call fcn.00410b50
mov byte [ebp - 4], 0
lea esi, [ebp - 0x278]
call fcn.00401380
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x2d0]
call fcn.00401380
mov eax, dword [ebp - 0x4f4]
jmp 0x444b82
cmp dword [ebp - 0x23c], 0
je 0x444084
cmp dword [ebp - 0x23c], 4
jne 0x444089
jmp 0x444aed
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x314]
call fcn.00404fe0
mov byte [ebp - 4], 0x11
push str.svchast.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.lsascs.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.windows_antivirus_pro.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.contraviro.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.akm_antivirus_2010_pro.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.cntprot.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.xjr_antivirus.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.sysinternals_antivirus.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.antivirus7.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.defcnt.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.msiexecs.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.milestone_antivirus.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.opencloud_security.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.protect.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.crss.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.svhostu.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.av_security_2012v121.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.system_security_2012v121.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.av_protection_2011v121.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.temp68.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x444319
push str.livesp.exe
lea eax, [ebp - 0x314]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44442f
mov dword [ebp - 0x280], 1
lea eax, [ebp - 0x368]
call fcn.00401360
mov byte [ebp - 4], 0x12
push 1
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x368]
push ecx
sub esp, 0x22c
mov ecx, 0x8b
lea esi, [ebp - 0x244]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.004435f0
add esp, 0x238
mov edx, dword [ebp - 0x23c]
push edx
call fcn.004424b0
add esp, 4
movzx eax, al
test eax, eax
je 0x444420
lea eax, [ebp - 0x368]
call fcn.00405170
test eax, eax
jbe 0x4443fd
push fcn.0042d7fa
lea ebx, [ebp - 0x4fc]
lea edi, [ebp - 0x368]
call fcn.00408400
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ebx, [ebp - 0x504]
lea edi, [ebp - 0x368]
call fcn.00408450
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ebx, [ebp - 0x50c]
lea edi, [ebp - 0x368]
call fcn.00408400
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x514]
push eax
call fcn.00412530
add esp, 0x20
lea ecx, [ebp - 0x368]
push ecx
lea edx, [ebp - 0x520]
push edx
mov ecx, dword [ebp + 8]
call fcn.00410bb0
mov byte [ebp - 4], 0x11
lea esi, [ebp - 0x368]
call fcn.00401380
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x314]
call fcn.00401380
jmp 0x444aed
mov byte [ebp - 4], 0x11
lea esi, [ebp - 0x368]
call fcn.00401380
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x524], esp
lea eax, [ebp - 0x314]
push eax
call fcn.00405020
mov dword [ebp - 0x798], eax
call fcn.00442c20
add esp, 0x1c
mov byte [ebp - 0x799], al
movzx ecx, byte [ebp - 0x799]
test ecx, ecx
je 0x444575
lea eax, [ebp - 0x384]
call fcn.00401360
mov byte [ebp - 4], 0x13
push 1
lea edx, [ebp - 0x2f8]
push edx
lea eax, [ebp - 0x384]
push eax
sub esp, 0x22c
mov ecx, 0x8b
lea esi, [ebp - 0x244]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.004435f0
add esp, 0x238
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.004424b0
add esp, 4
movzx edx, al
test edx, edx
je 0x444566
lea eax, [ebp - 0x384]
call fcn.00405170
test eax, eax
jbe 0x444543
push fcn.0042d7fa
lea ebx, [ebp - 0x52c]
lea edi, [ebp - 0x384]
call fcn.00408400
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ebx, [ebp - 0x534]
lea edi, [ebp - 0x384]
call fcn.00408450
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ebx, [ebp - 0x53c]
lea edi, [ebp - 0x384]
call fcn.00408400
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x544]
push eax
call fcn.00412530
add esp, 0x20
lea ecx, [ebp - 0x384]
push ecx
lea edx, [ebp - 0x550]
push edx
mov ecx, dword [ebp + 8]
call fcn.00410bb0
mov byte [ebp - 4], 0x11
lea esi, [ebp - 0x384]
call fcn.00401380
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x314]
call fcn.00401380
jmp 0x444aed
mov byte [ebp - 4], 0x11
lea esi, [ebp - 0x384]
call fcn.00401380
lea eax, [ebp - 0x34c]
call fcn.00401360
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x330]
call fcn.00401360
mov byte [ebp - 4], 0x15
push 1
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x34c]
push ecx
sub esp, 0x22c
mov ecx, 0x8b
lea esi, [ebp - 0x244]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.004435f0
add esp, 0x238
test eax, eax
je 0x444ac0
lea eax, [ebp - 0x34c]
lea ecx, [ebp - 0x330]
call fcn.00405050
push fcn.0042d7fa
lea ebx, [ebp - 0x558]
lea edi, [ebp - 0x330]
call fcn.00408400
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ebx, [ebp - 0x560]
lea edi, [ebp - 0x330]
call fcn.00408450
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ebx, [ebp - 0x568]
lea edi, [ebp - 0x330]
call fcn.00408400
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x570]
push eax
call fcn.00412530
add esp, 0x20
lea ecx, [ebp - 0x220]
push ecx
push str.svchost.exe
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4446e1
lea eax, [ebp - 0x34c]
call fcn.00405160
push eax
lea eax, [ebp - 0x2d0]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4446e1
mov edx, dword [ebp - 0x23c]
push edx
call fcn.004424b0
add esp, 4
movzx eax, al
test eax, eax
je 0x4446e1
lea eax, [ebp - 0x330]
call fcn.00405170
test eax, eax
jbe 0x4446af
lea ecx, [ebp - 0x330]
push ecx
lea edx, [ebp - 0x57c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00410bb0
mov byte [ebp - 4], 0x14
lea esi, [ebp - 0x330]
call fcn.00401380
mov byte [ebp - 4], 0x11
lea esi, [ebp - 0x34c]
call fcn.00401380
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x314]
call fcn.00401380
jmp 0x444aed
lea eax, [ebp - 0x220]
push eax
push str.csrss.exe
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44478a
lea eax, [ebp - 0x34c]
call fcn.00405160
push eax
lea eax, [ebp - 0x278]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x44478a
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.004424b0
add esp, 4
movzx edx, al
test edx, edx
je 0x44478a
lea eax, [ebp - 0x330]
call fcn.00405170
test eax, eax
jbe 0x444758
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x588]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00410bb0
mov byte [ebp - 4], 0x14
lea esi, [ebp - 0x330]
call fcn.00401380
mov byte [ebp - 4], 0x11
lea esi, [ebp - 0x34c]
call fcn.00401380
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x314]
call fcn.00401380
jmp 0x444aed
mov byte [ebp - 0x385], 0
lea esi, [ebp - 0x390]
lea edi, [ebp - 0x2b4]
call fcn.0040f860
jmp 0x4447b8
push 0
lea edx, [ebp - 0x590]
push edx
lea ecx, [ebp - 0x390]
call fcn.00410b70
lea esi, [ebp - 0x598]
lea edi, [ebp - 0x2b4]
call fcn.0040f880
mov esi, eax
lea edi, [ebp - 0x390]
call fcn.0040fd00
movzx eax, al
test eax, eax
je 0x44484d
lea eax, [ebp - 0x34c]
call fcn.00405160
push eax
lea ecx, [ebp - 0x390]
call fcn.00410a50
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x444848
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.004424b0
add esp, 4
movzx edx, al
test edx, edx
je 0x444848
lea eax, [ebp - 0x330]
call fcn.00405170
test eax, eax
jbe 0x44483f
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x5a4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00410bb0
mov byte [ebp - 0x385], 1
jmp 0x44484d
jmp 0x4447a4
movzx edx, byte [ebp - 0x385]
test edx, edx
je 0x44488a
mov byte [ebp - 4], 0x14
lea esi, [ebp - 0x330]
call fcn.00401380
mov byte [ebp - 4], 0x11
lea esi, [ebp - 0x34c]
call fcn.00401380
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x314]
call fcn.00401380
jmp 0x444aed
push fcn.0042d7fa
lea ebx, [ebp - 0x5ac]
lea edi, [ebp - 0x34c]
call fcn.00408400
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ebx, [ebp - 0x5b4]
lea edi, [ebp - 0x34c]
call fcn.00408450
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ebx, [ebp - 0x5bc]
lea edi, [ebp - 0x34c]
call fcn.00408400
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x5c4]
push eax
call fcn.00412530
add esp, 0x20
lea eax, [ebp - 0x34c]
call fcn.00405170
mov esi, eax
lea eax, [ebp - 0x314]
call fcn.00405170
sub esi, eax
mov eax, dword [0x44de98]
mov ebx, esi
lea esi, [ebp - 0x34c]
call fcn.004050d0
lea esi, [ebp - 0x398]
lea edi, [ebp - 0x25c]
call fcn.0040f860
jmp 0x444939
push 0
lea ecx, [ebp - 0x5cc]
push ecx
lea ecx, [ebp - 0x398]
call fcn.00410b70
lea esi, [ebp - 0x5d4]
lea edi, [ebp - 0x25c]
call fcn.0040f880
mov esi, eax
lea edi, [ebp - 0x398]
call fcn.0040fd00
movzx edx, al
test edx, edx
je 0x4449ce
lea eax, [ebp - 0x34c]
call fcn.00405160
push eax
lea ecx, [ebp - 0x398]
call fcn.00410a50
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4449c9
mov eax, dword [ebp - 0x23c]
push eax
call fcn.004424b0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x4449c9
lea eax, [ebp - 0x330]
call fcn.00405170
test eax, eax
jbe 0x4449c0
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x5e0]
push eax
mov ecx, dword [ebp + 8]
call fcn.00410bb0
mov byte [ebp - 0x385], 1
jmp 0x4449ce
jmp 0x444925
movzx ecx, byte [ebp - 0x385]
test ecx, ecx
je 0x444a0b
mov byte [ebp - 4], 0x14
lea esi, [ebp - 0x330]
call fcn.00401380
mov byte [ebp - 4], 0x11
lea esi, [ebp - 0x34c]
call fcn.00401380
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x314]
call fcn.00401380
jmp 0x444aed
lea eax, [ebp - 0x34c]
call fcn.00405160
push eax
lea eax, [ebp - 0x29c]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x444ac0
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0xa
je 0x444a56
cmp dword [ebp - 0x39c], 0xb
jne 0x444ac0
mov eax, dword [ebp - 0x23c]
push eax
call fcn.004424b0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x444ac0
lea eax, [ebp - 0x330]
call fcn.00405170
test eax, eax
jbe 0x444a91
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x5ec]
push eax
mov ecx, dword [ebp + 8]
call fcn.00410bb0
mov byte [ebp - 4], 0x14
lea esi, [ebp - 0x330]
call fcn.00401380
mov byte [ebp - 4], 0x11
lea esi, [ebp - 0x34c]
call fcn.00401380
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x314]
call fcn.00401380
jmp 0x444aed
mov byte [ebp - 4], 0x14
lea esi, [ebp - 0x330]
call fcn.00401380
mov byte [ebp - 4], 0x11
lea esi, [ebp - 0x34c]
call fcn.00401380
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x314]
call fcn.00401380
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x27c]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x444072
mov eax, dword [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x2f8]
call fcn.004108f0
mov dword [ebp - 0x5f0], 1
mov byte [ebp - 4], 7
lea esi, [ebp - 0x29c]
call fcn.00401380
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x25c]
call fcn.00410b50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2b4]
call fcn.00410b50
mov byte [ebp - 4], 0
lea esi, [ebp - 0x278]
call fcn.00401380
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x2d0]
call fcn.00401380
mov eax, dword [ebp - 0x5f0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bbc1
mov esp, ebp
pop ebp
ret