Function at 0x44e9ef
Capabilities:
Contain obfuscated stackstrings
Enumerate processes
Get installed programs
Parse pe header

Disassembly:
push 0x4e0
mov eax, 0x59f0d9
call fcn.0045f202
xor edi, edi
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x4e4], edi
mov dword [ebp - 0x4e0], edi
call fcn.00446e16
mov dword [ebp - 0x4e4], eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x4d0], edi
mov dword [ebp - 0x4cc], edi
mov dword [ebp - 0x4c8], edi
mov esi, str.4c8c229a12c0409fe14e0fade66204b4
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push esi
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.5f1de38380e9f345ea6737d8248fe8e1
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.ad46ce29918b8c7daa589e5686686b32
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.fbd194be5bac58b1fe30733112b23734
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.b4cd1a1f1e079a75ef145ed212b5e827
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.7e78035005116a62429bd8472feadfb4
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.16aac4ac2878bbfe574d39778ecc6015
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.59c7ea66abf08059812ed296a50cccc9
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.3322f9c56a4b1c8e2b0e263929bde1d5
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.dc3569572a2098a0d3aa2b5fd9d47975
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.8a05d92623072dbe390d4118138e29a1
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.b8217759222d7763426782d9296bf869
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.469c42ad0c1ecba16b7bdc261c80ff93
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.3557e29cca932f62aebd74d373a4fe33
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
push 0x10
pop ebx
lea eax, [ebp - 0x28]
mov byte [ebp - 4], bl
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.9df855027a781113e4660ae7f89e6a29
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.8d6f539978e1e76fa6e9bc989391add8
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.97f534e92e254024d7d9c38ee8a426c7
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.11a47037f5fbb629bdf8a2e46865094a
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00411360
push str.16da6198852e3801ddbd256688e3c642
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.0b793b26984d9e326a91c27ac246ce4d
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.9d60f116dfb4d83a3eda27f39de80395
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.5366e5f4face8414ffc79d2007ce8e24
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.3c401d59cd02ce9c675481effdfdf354
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.a0190646f5093e4991e8e4d8fa345a86
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.1260617677a23c85176a91d0779057ef
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.5934f723522b0aac1dd13a2bca2e1ceb
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.772283856dec291c909bc311aaabea0f
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.f00e6b31ec0192823c01b6e2925db92e
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.e82eb55241b19760c026d44879b9f727
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.6564f25b3a6f1d938cc69cebe136878a
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.aa6689450118a631e2c8a48c4ce8e365
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.8bda441a6c1268e855dd3b827c7843bc
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.b4ed68c4376c0a1548104209e8ed585e
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.faff2a0a6e57220049b4224489dd1ffe
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x24
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.d7d4f226bec23e0b382c4374a992162e
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.6b026733b241827c289c4881d68f949e
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x26
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.695c63f5b115c53965dd72cdb4fe5c3f
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.446203d96a0773d677b95fb68a13f648
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.7f7b698571eaa2ceb9707f5e892fe9e6
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x29
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.77211e5abb9e813db9e140003a2b17c8
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2a
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.5a515083beb6921409163a1d5b8c2db2
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.6ef8fef7c51f5a46a613cf958621b765
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2c
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.c507b79b7a4ff97e107105302f870353
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2d
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.69be492c4fe57987ca5fffaa5a51ea2f
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2e
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.f84dc9fa65c58663274ce7348687f8df
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00411360
push str.76219ba767d49dbadacff2419d4fa86c
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x30
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.0a30567cc70aa009da9c30d609ce1553
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x31
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.1e78bc882bfb75842932fe8a984e56b4
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x32
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.84fb82b618d412cab7a45029f9d6f2a7
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x33
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.8a7e642894377764d95cde4a53d091b1
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x34
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411360
push str.028b0d7c79a31a71972b17378d9fd460
lea ecx, [ebp - 0xb8]
call fcn.0040f5b0
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x35
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 1
call fcn.00411360
push str.e0f5f20b4f9dca7f5f3d5adb5871b177
lea ecx, [ebp - 0x70]
call fcn.0040f5b0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x36
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00411360
push str.fa38686235d9e13ca7cd6e2927ae4d60
lea ecx, [ebp - 0x58]
call fcn.0040f5b0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x37
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00411360
push str.eb8e7f5b947fa7a28b37caae81a80781
lea ecx, [ebp - 0x40]
call fcn.0040f5b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x38
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00411360
push str.23d967f89a8854a97834d6a7f26a9729
lea ecx, [ebp - 0xd0]
call fcn.0040f5b0
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 0x39
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 1
call fcn.00411360
push str.894ce5cf693a97b1289946c105bc44ce
lea ecx, [ebp - 0x88]
call fcn.0040f5b0
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x3a
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0044571e
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.00411360
push 0x22c
lea eax, [ebp - 0x4c4]
push edi
push eax
call fcn.0056f980
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x44fd4f
lea eax, [ebp - 0x4c4]
mov dword [ebp - 0x4c4], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x44f4d0
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x88]
call fcn.0040f6c0
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x3b
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0044da86
pop ecx
pop ecx
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x3d
call fcn.004113b0
lea eax, [ebp - 0x58]
push eax
call fcn.0044d86c
cmp dword [ebp - 0x44], ebx
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x4e4]
push eax
call fcn.0044bd9e
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00411360
lea eax, [ebp - 0x4c4]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x44f45d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5a1790
lea ecx, [ebp - 0x88]
call fcn.0040f6c0
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.0044da86
pop ecx
pop ecx
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x40
call fcn.004113b0
mov ecx, dword [ebp - 0x4e4]
mov eax, dword [ecx]
mov dword [ebp - 0x4d4], eax
cmp eax, ecx
je 0x44f611
add eax, 0x10
cmp dword [eax + 0x14], ebx
jb 0x44f533
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040f5b0
push 0x5a7c0c
mov byte [ebp - 4], 0x41
call fcn.0057cef0
pop ecx
push eax
push 0x5a7c0c
lea ecx, [ebp - 0x58]
call fcn.00418fb0
cmp dword [ebp - 0x8c], ebx
lea eax, [ebp - 0xa0]
push dword [ebp - 0x90]
cmovae eax, dword [ebp - 0xa0]
lea ecx, [ebp - 0x58]
push eax
call fcn.00418fb0
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.004452a7
lea eax, [ebp - 0x40]
push eax
call fcn.0044cb85
add esp, 0x1c
mov esi, dword [ebp - 0x4d0]
mov byte [ebp - 4], 0x42
jmp 0x44f5d8
mov eax, esi
cmp dword [esi + 0x14], ebx
jb 0x44f5b0
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040f5b0
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x40]
call fcn.0045005d
lea ecx, [ebp - 0x70]
test al, al
jne 0x44fc67
call fcn.00411360
add esi, 0x18
cmp esi, dword [ebp - 0x4cc]
jne 0x44f5a7
lea ecx, [ebp - 0x40]
call fcn.00411360
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x40
call fcn.00411360
lea ecx, [ebp - 0x4d4]
call fcn.00446c56
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0x4e4]
jne 0x44f529
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
push str.1c8e8f34fd91e72330c28efa548e0cb1
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x43
call fcn.0040f5b0
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x44
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.1ceca4bfc3e3c2c3664377e5a48e722d
lea ecx, [ebp - 0xd0]
call fcn.0040f5b0
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 0x45
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.661f72c6c52b62735e8ce7d915de3c0f
lea ecx, [ebp - 0x28]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x46
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.7f74d681fb42ad6c0ac0e34ad4053f30
lea ecx, [ebp - 0xb8]
call fcn.0040f5b0
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x47
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.641ebf23a5e4aaec4605b24f96cc8954
lea ecx, [ebp - 0x70]
call fcn.0040f5b0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x48
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.01387ef4244a4cf6ba407d47f88dd6b6
lea ecx, [ebp - 0x58]
call fcn.0040f5b0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x49
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.540c987be0dc26d6b036c66e65af861f
lea ecx, [ebp - 0x178]
call fcn.0040f5b0
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 0x4a
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.afae85442a28d429cc9082b0f2774b6c
lea ecx, [ebp - 0x190]
call fcn.0040f5b0
lea eax, [ebp - 0x190]
mov byte [ebp - 4], 0x4b
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.72508599626ae27f96a7b804c1b7292c
lea ecx, [ebp - 0x1a8]
call fcn.0040f5b0
lea eax, [ebp - 0x1a8]
mov byte [ebp - 4], 0x4c
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.38854b3f5985468805fbc4d9e22a20b4
lea ecx, [ebp - 0xe8]
call fcn.0040f5b0
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x4d
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.a624fc640621155e3c1e2827ab3907fa
lea ecx, [ebp - 0x160]
call fcn.0040f5b0
lea eax, [ebp - 0x160]
mov byte [ebp - 4], 0x4e
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.16ae85d9eb4df1c33d09d95acfb1be63
lea ecx, [ebp - 0x148]
call fcn.0040f5b0
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 0x4f
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.04475cc43c8d6b859324a691be6c9473
lea ecx, [ebp - 0x130]
call fcn.0040f5b0
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x50
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.67c63c1004105b141f37cfed4a0c44c1
lea ecx, [ebp - 0x118]
call fcn.0040f5b0
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0x51
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.23414a5df24b84f9769cd2fe342af776
lea ecx, [ebp - 0x100]
call fcn.0040f5b0
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x52
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.5116cbd226e3032170e54ce025668ad6
lea ecx, [ebp - 0x1c0]
call fcn.0040f5b0
lea eax, [ebp - 0x1c0]
mov byte [ebp - 4], 0x53
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.bac238e582b300e9639e0f64a7b10ae5
lea ecx, [ebp - 0x1d8]
call fcn.0040f5b0
lea eax, [ebp - 0x1d8]
mov byte [ebp - 4], 0x54
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.6ce32eaf42240b2bd342ed2f82adb2cd
lea ecx, [ebp - 0x1f0]
call fcn.0040f5b0
lea eax, [ebp - 0x1f0]
mov byte [ebp - 4], 0x55
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.bb83f348f1c0587033068bc2ae5c45d7
lea ecx, [ebp - 0x208]
call fcn.0040f5b0
lea eax, [ebp - 0x208]
mov byte [ebp - 4], 0x56
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.adcea2baa99784066767310a6f514f4b
lea ecx, [ebp - 0x220]
call fcn.0040f5b0
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 0x57
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x220]
call fcn.00411360
push str.f3aacd86111c1bb15911d1851eb28593
lea ecx, [ebp - 0x238]
call fcn.0040f5b0
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 0x58
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.2c64c0273b46a962e1051753cbc553d0
lea ecx, [ebp - 0x250]
call fcn.0040f5b0
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 0x59
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x43
call fcn.00411360
push str.7a4d2f977016999b6fbcd93191627c7c
lea ecx, [ebp - 0x268]
call fcn.0040f5b0
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 0x5a
push eax
lea ecx, [ebp - 0x34]
call fcn.0044571e
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0x43
call fcn.00411360
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 0x4dc], edi
mov dword [ebp - 0x4d8], edi
call fcn.00446e16
mov dword [ebp - 0x4dc], eax
mov esi, 0x5a178c
mov byte [ebp - 4], 0x5b
push esi
lea ecx, [ebp - 0x298]
call fcn.0040f6c0
push esi
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x5c
call fcn.0040f6c0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x4d4]
push eax
push 0x109
push edi
push 0x5a19a0
push reloc.WS2_32.dll_bind
mov byte [ebp - 4], 0x5d
mov dword [ebp - 0x4d4], edi
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x44fb12
lea eax, [ebp - 0x4dc]
push eax
push dword [ebp - 0x4d4]
call fcn.0044b72b
pop ecx
pop ecx
push dword [ebp - 0x4d4]
call esi
lea eax, [ebp - 0x4d4]
push eax
push 9
push edi
push 0x5a1a28
push reloc.WS2_32.dll_bind
call ebx
test eax, eax
jne 0x44fb48
lea eax, [ebp - 0x4dc]
push eax
push dword [ebp - 0x4d4]
call fcn.0044b72b
pop ecx
pop ecx
push dword [ebp - 0x4d4]
call esi
lea eax, [ebp - 0x4d4]
push eax
push 9
push edi
push 0x5a19a0
push reloc.WS2_32.dll_accept
call ebx
test eax, eax
jne 0x44fb7e
lea eax, [ebp - 0x4dc]
push eax
push dword [ebp - 0x4d4]
call fcn.0044b72b
pop ecx
pop ecx
push dword [ebp - 0x4d4]
call esi
lea eax, [ebp - 0x4d4]
push eax
push 0x109
push edi
push str.SoftwareMicrosoft_
push reloc.WS2_32.dll_bind
call ebx
test eax, eax
jne 0x44fbb7
lea eax, [ebp - 0x4dc]
push eax
push dword [ebp - 0x4d4]
call fcn.0044b72b
pop ecx
pop ecx
push dword [ebp - 0x4d4]
call esi
mov ecx, dword [ebp - 0x4dc]
mov eax, dword [ecx]
mov dword [ebp - 0x4e8], eax
cmp eax, ecx
je 0x44fd1b
mov ebx, 0x5a7c0c
add eax, 0x10
cmp dword [eax + 0x14], 0x10
jb 0x44fbdd
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040f5b0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x5e
push eax
call fcn.0044d86c
pop ecx
lea eax, [ebp - 0x70]
mov dword [ebp - 0x48], edi
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], edi
call fcn.004452a7
push ebx
mov byte [ebp - 4], 0x5f
call fcn.0057cef0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x58]
call fcn.00418fb0
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0xa0]
push dword [ebp - 0x90]
cmovae eax, dword [ebp - 0xa0]
lea ecx, [ebp - 0x58]
push eax
call fcn.00418fb0
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.004452a7
lea eax, [ebp - 0x28]
push eax
call fcn.0044cb85
add esp, 0x1c
mov esi, dword [ebp - 0x34]
mov byte [ebp - 4], 0x60
jmp 0x44fcbb
xor edi, edi
inc edi
call fcn.00411360
lea ecx, [ebp - 0x40]
call fcn.00411360
lea ecx, [ebp - 0x58]
call fcn.00411360
jmp 0x44fd44
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x44fc8e
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0xb8]
call fcn.0040f5b0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb8]
call fcn.0045005d
lea ecx, [ebp - 0xb8]
test al, al
jne 0x44fcfb
call fcn.00411360
add esi, 0x18
cmp esi, dword [ebp - 0x30]
jne 0x44fc84
lea ecx, [ebp - 0x28]
call fcn.00411360
lea ecx, [ebp - 0x58]
call fcn.00411360
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x5d
call fcn.00411360
lea ecx, [ebp - 0x4e8]
call fcn.00446c56
mov eax, dword [ebp - 0x4e8]
cmp eax, dword [ebp - 0x4dc]
jne 0x44fbd2
jmp 0x44fd1b
xor edi, edi
inc edi
call fcn.00411360
lea ecx, [ebp - 0x28]
call fcn.00411360
lea ecx, [ebp - 0x58]
call fcn.00411360
lea ecx, [ebp - 0x70]
call fcn.00411360
lea ecx, [ebp - 0x280]
call fcn.004113b0
lea ecx, [ebp - 0x298]
call fcn.004113b0
lea ecx, [ebp - 0x4dc]
call fcn.0044e1f6
lea ecx, [ebp - 0x34]
call fcn.00445ed0
lea ecx, [ebp - 0xa0]
call fcn.00411360
lea ecx, [ebp - 0x4d0]
call fcn.00445ed0
lea ecx, [ebp - 0x4e4]
call fcn.0044e1f6
mov eax, edi
call fcn.0045f1bd
ret