Function at 0x405e30
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x23c
mov eax, dword [0x45b4b0]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x248], eax
xor eax, eax
mov byte [esp + 0x144], 0
mov ecx, 0x40
lea edi, [esp + 0x145]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x250]
push eax
push 0x449ffc
lea ecx, [esp + 0x14c]
push 0x104
push ecx
call fcn.0042dd5c
mov ebp, dword [0x459b44]
mov ebx, dword [0x459b3c]
mov esi, dword [0x459b58]
mov eax, 0x491979d9
imul esi, esi, 0x3b76e
imul ebp
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, ebx
imul edx, edx, 0x426f4
add edx, ecx
add edx, esi
shl edx, 1
mov edi, edx
mov eax, 0x89cc5bfb
imul ebx
add edx, ebx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov ebx, dword [0x459b40]
mov eax, 0x5764ae1b
imul ebp
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x20ab631d
imul ebx
sar edx, 0xf
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x4c84c1e9
imul ebx
mov ebx, dword [0x459b50]
sar edx, 0x12
add ebp, edx
mov eax, edx
mov edx, dword [0x459b38]
imul edx, edx, 0xd61e3
shr eax, 0x1f
add eax, ebp
add eax, edx
mov edx, ebx
imul edx, edx, 0x1db98
sub eax, edx
mov edx, dword [0x459b54]
mov ebp, eax
mov eax, 0xf957fd3
imul edx
sar edx, 0xd
mov eax, edx
add esp, 0x10
mov dword [str._r_____r____], edi
shr eax, 0x1f
imul ebx, ebx, 0x426f4
add eax, edx
sub ebp, eax
mov eax, 0x415373e5
imul dword [0x459b3c]
sar edx, 0x10
add ebp, ecx
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ecx + ebx*2 + 0x84bc4]
push 0
sub edx, edi
add ebp, esi
push 2
mov dword [0x459b38], ebp
mov dword [esp + 0x20], 0
mov dword [0x459b3c], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x459b44]
mov ebp, eax
mov ebx, dword [0x459b48]
mov eax, 0x491979d9
imul ecx
mov eax, dword [0x459b38]
imul eax, eax, 0x3eb37
mov ecx, eax
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x89cc5bfb
imul ebx
add edx, ebx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [0x459b54]
mov eax, 0x5764ae1b
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov ecx, eax
mov edi, dword [0x459b58]
mov eax, 0x491979d9
imul edi, edi, 0x3b76e
imul ebx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, ecx
mov ecx, dword [str._r_____r____]
imul ecx, ecx, 0x70110
add eax, esi
add ecx, eax
add ecx, edi
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
mov dword [0x459b54], ecx
jne 0x4060ae
mov ebx, dword [0x459b40]
mov eax, 0x20ab631d
imul ebx
sar edx, 0xf
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x4c84c1e9
imul ebx
mov eax, dword [0x459b38]
sar edx, 0x12
imul eax, eax, 0xd61e3
mov ebx, edx
add ebp, edx
mov edx, dword [0x459b50]
imul edx, edx, 0x1db98
shr ebx, 0x1f
add ebx, ebp
add ebx, eax
sub ebx, edx
mov eax, 0xf957fd3
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, esi
add ebx, edi
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x459b38], ebx
call fcn.0042dcf6
add esp, 4
jmp 0x4067e3
mov edx, dword [0x459b40]
imul ebx, ebx, 0xbb797
mov eax, 0xf6ddfe9
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b4c]
mov ebp, eax
mov eax, 0xa89b51e5
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [0x459b38]
imul eax, eax, 0x20dab
sub edx, ebp
mov ebp, dword [esp + 0x14]
add edx, ebx
add edx, eax
sub edx, ecx
lea ecx, [esp + 0x1c]
add edx, esi
push ecx
lea eax, [edx + edi - 0xd61e3]
push ebp
mov dword [0x459b40], eax
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40619f
mov ecx, dword [0x459b4c]
mov eax, 0x415373e5
imul ecx
imul ecx, ecx, 0x84de8
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b58]
sub ecx, eax
imul edx, edx, 0x3b76e
mov eax, dword [0x459b48]
imul eax, eax, 0x20dab
add ecx, edx
mov edx, dword [0x459b44]
add ecx, eax
mov edi, dword [0x459b50]
mov eax, 0x491979d9
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x70110
add eax, edi
add eax, ecx
lea eax, [edx + eax - 0xd61e3]
push ebp
mov dword [0x459b44], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4067e3
mov esi, dword [0x459b58]
mov eax, 0x491979d9
imul dword [0x459b44]
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x3da796f7
imul esi
mov dword [esp + 0x10], ecx
mov ecx, dword [0x459b50]
sar edx, 0x11
mov edi, ecx
imul edi, edi, 0x3eb37
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x89c36131
imul esi
add edx, esi
sar edx, 0x11
add edi, edx
mov eax, edx
mov edx, esi
imul edx, edx, 0x9aa75
shr eax, 0x1f
add eax, edi
sub eax, edx
mov dword [0x459b48], eax
mov eax, dword [0x459b4c]
imul ecx, ecx, 0x3eb04
imul esi, esi, 0x3b76e
mov edx, dword [0x459b40]
imul eax, eax, 0xd61e3
imul edx, edx, 0x1db98
add ecx, eax
add ecx, edx
mov edx, dword [0x459b54]
mov eax, 0x5764ae1b
imul edx
sar edx, 0x12
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x459b3c]
mov eax, 0xf957fd3
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, esi
sub edi, eax
mov eax, 0x491979d9
imul dword [0x459b44]
sar edx, 0x11
mov ecx, edx
add edi, edx
lea edx, [esp + 0x144]
shr ecx, 0x1f
push edx
lea eax, [esp + 0x44]
add ecx, edi
push eax
mov dword [0x459b4c], ecx
call fcn.00437a7e
add esp, 8
test eax, eax
je 0x4064c4
mov esi, dword [0x459b48]
mov ecx, dword [0x459b4c]
imul esi, esi, 0x3eb04
imul ecx, ecx, 0xd61e3
sub esi, ecx
mov ecx, dword [0x459b3c]
mov eax, 0xf6ddfe9
imul ecx
mov ecx, dword [0x459b44]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [0x459b58]
mov edx, ecx
imul eax, eax, 0xc0332
imul edx, edx, 0x3b76e
sub esi, edx
add esi, eax
mov eax, 0x491979d9
imul ecx
sar edx, 0x11
mov ecx, edx
add esi, edx
mov edx, dword [esp + 0x24]
push edx
shr ecx, 0x1f
push 0
add ecx, esi
push 0x1f0fff
mov dword [0x459b50], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x459b3c]
mov esi, dword [0x459b58]
mov edi, eax
imul esi, esi, 0x3b76e
mov eax, 0x491979d9
imul dword [0x459b44]
sar edx, 0x11
mov eax, ebx
imul eax, eax, 0x426f4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add eax, ecx
add eax, esi
shl eax, 1
mov ebp, eax
mov eax, 0x89cc5bfb
imul ebx
add edx, ebx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x5764ae1b
imul dword [0x459b44]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
test edi, edi
mov dword [str._r_____r____], ebp
jne 0x406394
push 0x449fc8
call fcn.0042dcf6
add esp, 4
jmp 0x4064a0
mov ebx, dword [0x459b40]
mov eax, 0x20ab631d
imul ebx
sar edx, 0xf
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x4c84c1e9
imul ebx
mov eax, dword [0x459b50]
sar edx, 0x12
imul eax, eax, 0x1db98
mov ebx, edx
add ebp, edx
mov edx, dword [0x459b38]
imul edx, edx, 0xd61e3
shr ebx, 0x1f
add ebx, ebp
add ebx, edx
mov edx, dword [0x459b54]
sub ebx, eax
mov eax, 0xf957fd3
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
add ebx, esi
push edi
mov dword [0x459b38], ebx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406414
push 0x449fb4
call fcn.0042dcf6
add esp, 4
mov ecx, dword [0x459b4c]
mov esi, dword [0x459b50]
imul ecx, ecx, 0xd61e3
mov edx, dword [0x459b40]
imul esi, esi, 0x3eb04
imul edx, edx, 0x1db98
add esi, ecx
mov ecx, dword [0x459b54]
add esi, edx
mov eax, 0x5764ae1b
imul ecx
mov eax, dword [0x459b58]
mov ecx, dword [0x459b3c]
imul eax, eax, 0x3b76e
sar edx, 0x12
mov ebx, edx
add esi, edx
shr ebx, 0x1f
add ebx, esi
add ebx, eax
mov eax, 0xf957fd3
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x459b44]
mov eax, 0x491979d9
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
push edi
mov dword [0x459b4c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
mov esi, dword [0x459b58]
je 0x40652f
mov ecx, dword [0x459b50]
jmp 0x406203
mov edi, dword [0x459b44]
mov esi, dword [0x459b58]
mov eax, 0x491979d9
imul edi
sar edx, 0x11
mov eax, edx
mov ebx, dword [0x459b50]
shr eax, 0x1f
imul ebx, ebx, 0x3eb37
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x3da796f7
imul esi
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x89c36131
imul esi
sub ebx, ecx
add edx, esi
sar edx, 0x11
add ebx, edx
mov ecx, edx
mov edx, esi
imul edx, edx, 0x9aa75
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [esp + 0x24]
sub ecx, edx
mov dword [0x459b48], ecx
jmp 0x40653f
mov edi, dword [0x459b44]
mov ecx, dword [0x459b48]
mov ebx, dword [esp + 0x18]
mov eax, dword [0x459b4c]
imul ecx, ecx, 0x3eb04
imul esi, esi, 0xc0332
mov edx, dword [0x459b3c]
imul eax, eax, 0xd61e3
sub ecx, eax
mov eax, 0xf6ddfe9
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x3b76e
sub ecx, eax
sub ecx, edx
mov eax, 0x491979d9
imul edi
sar edx, 0x11
add ecx, esi
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
push ebp
mov dword [0x459b50], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x459b44]
mov esi, dword [0x459b50]
mov eax, 0x491979d9
imul esi, esi, 0x426f4
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x459b3c]
mov eax, 0x415373e5
imul edx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add esi, ecx
add eax, edx
lea edx, [eax + esi*2 + 0x84bc4]
mov esi, dword [str._r_____r____]
sub edx, esi
test ebx, ebx
mov dword [0x459b3c], edx
je 0x406772
mov eax, dword [esp + 0x24]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x459b44]
mov ebp, eax
mov eax, 0x491979d9
imul ecx
sar edx, 0x11
mov ecx, edx
mov esi, dword [0x459b4c]
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x459b40]
mov eax, 0xf6ddfe9
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xa89b51e5
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, dword [0x459b58]
sub eax, edi
imul ebx, ebx, 0x3b76e
mov edi, dword [0x459b48]
mov edx, edi
imul edx, edx, 0xbb797
add eax, edx
mov edx, dword [0x459b38]
imul edx, edx, 0x20dab
add eax, edx
sub eax, dword [0x459b54]
add eax, ecx
test ebp, ebp
lea eax, [eax + ebx - 0xd61e3]
mov dword [0x459b40], eax
je 0x4067e3
imul edi, edi, 0x20dab
mov eax, 0x415373e5
imul esi
imul esi, esi, 0x84de8
add edi, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x10
imul ecx, ecx, 0x70110
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b50]
sub esi, eax
add edi, esi
add ecx, edi
add ecx, ebx
push 0
lea eax, [ecx + edx - 0xd61e3]
push ebp
mov dword [0x459b44], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [0x459b48]
mov ecx, dword [0x459b4c]
imul esi, esi, 0x3eb04
imul ecx, ecx, 0xd61e3
sub esi, ecx
mov ecx, dword [0x459b3c]
mov eax, 0xf6ddfe9
imul ecx
mov ecx, dword [0x459b44]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [0x459b58]
mov edx, ecx
imul eax, eax, 0xc0332
imul edx, edx, 0x3b76e
sub esi, edx
add esi, eax
mov eax, 0x491979d9
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
push ebp
mov dword [0x459b50], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x238]
call fcn.0042d001
add esp, 0x23c
ret
mov edi, dword [0x459b48]
imul esi, esi, 0x70110
mov ebx, dword [0x459b38]
mov eax, 0x89cc5bfb
imul ebx, ebx, 0x3eb37
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b54]
sub ebx, eax
mov eax, 0x5764ae1b
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b58]
imul edx, edx, 0x3b76e
sub ebx, eax
add ebx, edx
mov eax, 0x491979d9
imul edi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
add esi, ebx
mov dword [0x459b54], esi
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.0042d001
add esp, 0x23c
ret