Function at 0x4497f0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x598b80
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x61e810]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push 2
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x240], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x244], esi
cmp esi, 0xffffffff
je 0x449869
lea ecx, [ebp - 0x23c]
push ecx
mov ebx, 0x22c
push esi
mov dword [ebp - 0x23c], ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x449870
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x449abc
lea edx, [ebp - 0x23c]
push edx
push esi
mov dword [ebp - 0x23c], ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x449aaf
mov ebx, 1
mov eax, dword [ebp - 0x248]
call fcn.004016fc
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0048eadb
add esp, 8
test eax, eax
jne 0x449a8f
mov ecx, dword [ebp - 0x234]
add dword [ebp - 0x240], ebx
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
jne 0x449a7a
test byte [0x63221c], bl
jne 0x449981
or dword [0x63221c], ebx
mov dword [ebp - 4], edi
push 0x632228
mov dword [0x632220], 0x5fd2f0
mov dword [0x632224], edi
mov dword [0x632240], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], bl
push 8
mov dword [0x632220], 0x5fd330
call fcn.0048a378
add esp, 4
cmp eax, edi
je 0x449931
mov dword [eax], 0xffffffff
mov byte [eax + 4], bl
mov esi, eax
jmp 0x449933
xor esi, esi
push 0x632228
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x632224]
add dword [0x632240], ebx
cmp eax, edi
je 0x449956
push eax
call fcn.0048a131
add esp, 4
sub dword [0x632240], ebx
push 0x632228
mov dword [0x632224], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x5ac41a
call fcn.0048ae63
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [0x632220]
mov eax, dword [edx + 8]
push str.OpenProcess_Error_
push str.utilCommonUtils.cpp
push 0x2a4
push 2
push 0x632220
call eax
add esp, 0x14
test byte [0x6321f0], bl
jne 0x449a5e
or dword [0x6321f0], ebx
mov dword [ebp - 4], 2
push 0x6321fc
mov dword [0x6321f4], 0x5fd2f0
mov dword [0x6321f8], edi
mov dword [0x632214], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 3
push 8
mov dword [0x6321f4], 0x5fd310
mov byte [0x632218], bl
call fcn.0048a378
add esp, 4
cmp eax, edi
je 0x449a0e
mov dword [eax], 0xffffffff
mov byte [eax + 4], bl
mov esi, eax
jmp 0x449a10
xor esi, esi
push 0x6321fc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x6321f8]
add dword [0x632214], ebx
cmp eax, edi
je 0x449a33
push eax
call fcn.0048a131
add esp, 4
sub dword [0x632214], ebx
push 0x6321fc
mov dword [0x6321f8], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x5ac42e
call fcn.0048ae63
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x6321f4]
mov edx, dword [ecx + 4]
push str.OpenProcess_Error_
push 2
push 0x6321f4
call edx
add esp, 0xc
jmp 0x449a89
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x244]
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x449891
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489dc1
mov esp, ebp
pop ebp
ret