Function at 0x4051b0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x458190]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24c]
push eax
push 0x446fbc
lea ecx, [esp + 0x148]
push 0x104
push ecx
call fcn.0042aabc
mov ebp, dword [0x456824]
mov eax, 0x1315e2c9
imul ebp
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x637bce79
imul ebp
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov ebp, dword [0x456834]
mov eax, 0x3b50a35b
imul dword [0x45681c]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x4ca85b91
imul ebp
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
mov ebx, dword [0x456830]
imul edx, edx, 0xd5bac
add eax, edx
mov dword [esp + 0x20], eax
mov esi, dword [0x456838]
mov eax, 0x72563b0d
imul esi, esi, 0x8cc35
imul ebp
sar edx, 0x10
mov edi, ebx
imul ebx, ebx, 0x8a1c3
mov eax, edx
imul edi, edi, 0x6a41a
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
sub edx, eax
sub edx, ebx
mov ebx, edx
mov edx, dword [0x456820]
mov eax, 0x2e259371
imul edx
sar edx, 0x10
add ecx, edi
add ecx, esi
mov eax, edx
add esp, 0x10
shr eax, 0x1f
mov dword [str._r_____r____], ecx
add ebx, edx
add eax, ebx
mov dword [0x456818], eax
mov eax, 0x1315e2c9
imul dword [0x456838]
sar edx, 0x10
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x3d63c959
imul dword [0x45681c]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
sub eax, ecx
push 0
lea ecx, [eax + edi + 0x6a5e7]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45681c], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x456828]
mov ebx, eax
mov edi, dword [0x456818]
mov eax, 0x1315e2c9
imul esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
imul ecx, ecx, 0xd69d0
sub ecx, eax
mov edx, edi
imul edx, edx, 0x85714
add ecx, edx
mov edx, dword [0x456834]
mov eax, 0x637bce79
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x3b50a35b
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp ebx, 0xffffffff
mov dword [0x456834], ecx
jne 0x4053f4
mov eax, 0x4ca85b91
imul edi, edi, 0xd5bac
imul ecx
sar edx, 0x12
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x72563b0d
imul ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8a1c3
add esi, edi
sub esi, ecx
mov ecx, dword [0x456820]
sub esi, edx
mov eax, 0x2e259371
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x456818], eax
call fcn.0042aa56
add esp, 4
jmp 0x405a19
mov edx, dword [0x45682c]
imul edi, edi, 0x23d2f
mov esi, dword [str._r_____r____]
mov eax, 0x637bce79
imul esi, esi, 0xa4b0c
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456820]
sub esi, eax
mov eax, 0x2681eb59
imul edx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add esi, edi
add eax, edx
sub esi, eax
sub esi, ecx
lea ecx, [esp + 0x18]
push ecx
sub esi, 0xd5bac
push ebx
mov dword [0x456820], esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4054be
mov ecx, dword [0x45682c]
mov esi, dword [str._r_____r____]
mov ebp, dword [0x456830]
imul esi, esi, 0xd69d0
mov eax, 0x3d63c959
imul ecx
mov ecx, dword [0x456828]
sar edx, 0x11
imul ecx, ecx, 0x23d2f
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x6a41a
sub esi, eax
add ecx, ebp
add ecx, esi
lea eax, [edx + ecx - 0xd5bac]
push ebx
mov dword [0x456824], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405a19
mov ecx, dword [0x456824]
mov eax, 0x1315e2c9
imul ecx
mov eax, dword [0x45681c]
sar edx, 0x10
imul eax, eax, 0x85714
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [0x456838]
mov esi, ecx
imul esi, esi, 0xfff2a454
sub esi, edx
add esi, eax
mov eax, 0x7464ef13
imul ecx
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
sar edx, 0x12
add esi, edx
mov edi, edx
mov eax, 0x4d18b8d9
imul ecx
sar edx, 0x11
mov ecx, edx
shr edi, 0x1f
shr ecx, 0x1f
add edi, esi
add ecx, edx
sub edi, ecx
mov dword [0x456828], edi
mov ecx, dword [0x456820]
mov esi, dword [0x45682c]
mov eax, 0x637bce79
imul esi, esi, 0xd5bac
imul ecx
imul ecx, ecx, 0x8a1c3
sar edx, 0x12
mov edi, edx
add esi, edx
mov eax, 0x72563b0d
imul dword [0x45681c]
sar edx, 0x10
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
add edi, esi
sub edi, eax
add edi, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x58c2a
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
add edi, ecx
push eax
mov dword [0x45682c], edi
call fcn.004347de
add esp, 8
test eax, eax
je 0x405947
mov ecx, dword [0x45682c]
mov esi, dword [0x456824]
imul ecx, ecx, 0xd5bac
imul esi, esi, 0xfffdd9b2
sub esi, ecx
mov ecx, dword [0x45681c]
mov eax, 0x2681eb59
imul ecx
mov ecx, dword [0x456828]
sar edx, 0x10
imul ecx, ecx, 0x58c2a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
push edx
sub esi, eax
push 0
add esi, ecx
push 0x1f0fff
mov dword [0x456830], esi
call ebp
mov ecx, dword [0x456824]
mov esi, eax
mov eax, 0x1315e2c9
imul ecx
mov eax, dword [0x456838]
imul eax, eax, 0x8cc35
sar edx, 0x10
mov edi, edx
shr edi, 0x1f
add edi, edx
add edi, eax
mov eax, 0x637bce79
imul ecx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x456830]
mov edx, ecx
imul edx, edx, 0x6a41a
add edi, edx
mov edx, dword [0x45681c]
mov eax, 0x3b50a35b
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
test esi, esi
mov dword [str._r_____r____], edi
jne 0x40566c
push 0x446f88
call fcn.0042aa56
add esp, 4
jmp 0x405756
mov edi, dword [0x456834]
imul ecx, ecx, 0x8a1c3
mov eax, 0x4ca85b91
imul edi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0xd5bac
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x72563b0d
imul edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
sub edx, ecx
mov ecx, dword [0x456820]
mov dword [esp + 0x10], edx
mov eax, 0x2e259371
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
push esi
mov dword [0x456818], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x4056f3
push 0x446f74
call fcn.0042aa56
add esp, 4
mov ecx, dword [0x456820]
mov edi, dword [0x45682c]
mov eax, 0x637bce79
imul edi, edi, 0xd5bac
imul ecx
imul ecx, ecx, 0x8a1c3
sar edx, 0x12
add edi, edx
mov eax, edx
mov edx, dword [0x45681c]
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x72563b0d
imul edx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x58c2a
add edi, ecx
push esi
mov dword [0x45682c], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x18]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405524
mov ecx, dword [0x456824]
mov esi, dword [0x456828]
mov edi, dword [esp + 0x14]
mov edx, dword [0x45682c]
imul ecx, ecx, 0xfffdd9b2
imul esi, esi, 0x58c2a
imul edx, edx, 0xd5bac
sub ecx, edx
mov eax, 0x2681eb59
imul dword [0x45681c]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
push ebx
mov dword [0x456830], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x456838]
mov eax, 0x1315e2c9
imul ecx
imul ecx, ecx, 0x8cc35
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x3d63c959
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x6a41a
add eax, ecx
sub eax, edx
add eax, 0x6a5e7
test edi, edi
mov dword [0x45681c], eax
je 0x4059b8
mov edx, dword [esp + 0x20]
push edx
push 0
push 0x1f0fff
call ebp
mov ebx, dword [0x45682c]
mov ecx, dword [str._r_____r____]
mov edi, dword [0x456818]
mov esi, eax
mov eax, 0x637bce79
imul ebx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, ecx
imul ebp, ebp, 0xa4b0c
mov edx, edi
imul edx, edx, 0x23d2f
sub ebp, eax
add ebp, edx
mov edx, dword [0x456820]
mov eax, 0x2681eb59
imul edx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
sub ebp, dword [0x456834]
sub ebp, 0xd5bac
test esi, esi
mov dword [0x456820], ebp
je 0x405a19
mov ebp, dword [0x456830]
imul ecx, ecx, 0xd69d0
imul edi, edi, 0x6a41a
mov eax, 0x3d63c959
imul ebx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
imul edx, edx, 0x23d2f
sub ecx, eax
add edx, ebp
add edx, ecx
push 0
lea eax, [edi + edx - 0xd5bac]
push esi
mov dword [0x456824], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45682c]
mov edi, dword [0x456824]
imul ecx, ecx, 0xd5bac
imul edi, edi, 0xfffdd9b2
sub edi, ecx
mov ecx, dword [0x45681c]
mov eax, 0x2681eb59
imul ecx
mov ecx, dword [0x456828]
sar edx, 0x10
imul ecx, ecx, 0x58c2a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push esi
mov dword [0x456830], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.00429d61
add esp, 0x238
ret
mov ecx, dword [0x456824]
mov edi, dword [0x456838]
mov eax, 0x1315e2c9
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0xfff2a454
sub edx, eax
mov eax, dword [0x45681c]
imul eax, eax, 0x85714
add edx, eax
mov dword [esp + 0x10], edx
mov eax, 0x7464ef13
imul edi
mov eax, dword [esp + 0x10]
sar edx, 0x12
add eax, edx
mov esi, edx
shr esi, 0x1f
add esi, eax
mov eax, 0x4d18b8d9
imul edi
mov edi, dword [esp + 0x20]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x456828], esi
jmp 0x405779
mov ecx, dword [0x456828]
mov eax, 0x1315e2c9
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
mov esi, ecx
imul edx, edx, 0x85714
imul esi, esi, 0xd69d0
sub esi, eax
add esi, edx
mov edx, dword [0x456834]
mov eax, 0x637bce79
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3b50a35b
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov dword [0x456834], esi
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.00429d61
add esp, 0x238
ret