Function at 0x406980
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x254
mov eax, dword [0x460640]
mov edx, dword [esp + 0x258]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x260], eax
xor eax, eax
mov byte [esp + 0x15c], 0
mov ecx, 0x40
lea edi, [esp + 0x15d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44effc
stosb byte es:[edi], al
lea eax, [esp + 0x164]
push 0x104
push eax
call fcn.0043260c
mov eax, dword [0x45ecd4]
mov esi, dword [0x45eccc]
add esp, 0x10
cdq
mov edi, eax
push 1
mov ebp, edx
push 0xeae0c6d3
mov eax, esi
cdq
push ebp
push edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
call fcn.004319f0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov ebx, dword [0x45ece8]
push 2
imul ebx, ebx, 0x6b66a94
push 0xb57eb16
push ecx
push edx
mov dword [esp + 0x28], eax
call fcn.004319f0
push 2
push 0xb57eb16
push ebp
push edi
mov dword [esp + 0x24], eax
call fcn.004319f0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push 1
sub ecx, eax
mov eax, dword [esp + 0x24]
push 0x86050f76
push eax
push edx
mov dword [esp + 0x24], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x14]
mov edi, dword [0x45ecdc]
sub ecx, eax
imul edi, edi, 0x5295f78d
mov eax, esi
imul eax, eax, 0x140cef57
sub ecx, eax
mov eax, dword [esp + 0x18]
add ecx, ebx
add edi, ecx
add edi, eax
mov eax, dword [0x45ecd0]
push 1
cdq
push 0xebf310a9
mov dword [str._r_____r____], edi
push edx
push eax
call fcn.004319f0
mov dword [esp + 0x14], eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov ebp, dword [0x45ece0]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x45ecd0]
mov eax, 0x4d7937c3
mul ecx
mov eax, dword [esp + 0x14]
shr edx, 0x1e
add eax, edx
mov edx, ebp
imul edx, edx, 0x7f4ea4e2
sub eax, edx
mov dword [esp + 0x14], eax
mov eax, 0x2a01e433
imul ecx
mov ecx, dword [esp + 0x14]
sar edx, 0x1c
mov eax, edx
add ecx, edx
mov edx, dword [esp + 0x28]
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x45ecc8]
imul ecx, ecx, 0x6181b446
push 1
add eax, ecx
push 0x5295f78d
mov dword [0x45ecc8], eax
mov eax, dword [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.004319f0
imul ebp, ebp, 0x140cef57
mov ecx, eax
mov eax, 0x2a215c6f
mul esi
mov eax, dword [0x45ece4]
sub esi, edx
imul eax, eax, 0x6181b446
shr esi, 1
add esi, edx
mov edx, dword [esp + 0x18]
shr esi, 0x1f
add ecx, esi
sub ecx, ebp
add ecx, eax
sub ecx, ebx
sub ecx, edi
push 0
lea eax, [ecx + edx - 0x4f64023c]
push 2
mov dword [0x45eccc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x18], eax
mov eax, dword [0x45ecd8]
cdq
mov ebx, eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov ebp, edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd4]
mov edx, dword [0x45ecc8]
mov esi, eax
add edx, ecx
mov edi, dword [str._r_____r____]
imul edx, edx, 0x242d3a05
push 1
sub esi, edx
mov eax, edi
cdq
push 0xb09bfdc4
push edx
push eax
call fcn.004319f0
push 1
push 0xeae0c6d3
push ebp
push ebx
add esi, eax
call fcn.004319f0
push 1
push 0x86050f76
push ebp
push ebx
sub esi, eax
call fcn.004319f0
imul edi, edi, 0x151f392d
sub esi, eax
sub esi, edi
mov edi, dword [esp + 0x18]
cmp edi, 0xffffffff
mov dword [0x45ece4], esi
jne 0x406c7f
mov edi, dword [0x45ecd0]
push 1
mov eax, edi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov ebx, eax
push 1
mov eax, esi
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
sub ebx, eax
mov eax, 0x4d7937c3
mul edi
mov eax, dword [0x45ece0]
imul eax, eax, 0x7f4ea4e2
shr edx, 0x1e
add ebx, edx
sub ebx, eax
mov eax, 0x2a01e433
imul edi
mov eax, dword [0x45ecc8]
imul eax, eax, 0x6181b446
sar edx, 0x1c
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
add ecx, eax
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45ecc8], ecx
call fcn.004325a6
add esp, 4
jmp 0x4074ea
mov eax, dword [0x45ecdc]
push 2
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov ebx, eax
mov eax, dword [0x45ecd0]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd8]
mov edx, dword [0x45ece8]
mov ebp, eax
imul edx, edx, 0x6b66a94
mov eax, ecx
imul eax, eax, 0xb57eb16
sub ebp, ebx
add ebp, edx
add ebp, eax
mov eax, 0x2a01e433
imul ecx
mov eax, dword [0x45ecc8]
imul eax, eax, 0x5295f78d
sar edx, 0x1c
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
add ecx, eax
lea edx, [esp + 0x34]
sub ecx, esi
push edx
sub ecx, 0x6181b446
push edi
mov dword [0x45ecd0], ecx
mov dword [esp + 0x3c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
push 1
push 0xeae0c6d3
jne 0x406d81
mov esi, dword [0x45ecdc]
mov eax, esi
cdq
push edx
push eax
call fcn.004319f0
mov ecx, dword [str._r_____r____]
mov ebx, eax
mov eax, dword [0x45ecd8]
add eax, ecx
imul ecx, ecx, 0x151f392d
imul eax, eax, 0x5295f78d
add ebx, eax
mov eax, 0x2a215c6f
mul esi
mov eax, esi
imul esi, esi, 0x140cef57
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
sub ebx, eax
sub ebx, esi
sub ebx, ecx
mov ecx, dword [0x45ece0]
lea edx, [ebx + ecx - 0x6181b446]
push edi
mov dword [0x45ecd4], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4074ea
mov edi, dword [0x45ece8]
mov eax, edi
cdq
mov ebx, eax
mov eax, dword [0x45ecd4]
mov ebp, edx
cdq
push edx
push eax
mov dword [esp + 0x40], ebp
call fcn.004319f0
mov esi, dword [0x45ece0]
mov ecx, eax
mov eax, 0x2a215c6f
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
push 1
add eax, edx
push 0xebf310a9
shr eax, 0x1f
push ebp
sub eax, ecx
push ebx
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
push 2
push 0x6b66a94
mov edx, ebp
push edx
sub ecx, eax
push ebx
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul edi, edi, 0x6181b446
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [0x45ecc8]
imul eax, eax, 0x151f392d
mov edx, esi
imul edx, edx, 0x242d3a05
sub ecx, edi
sub ecx, eax
sub ecx, edx
mov dword [0x45ecd8], ecx
mov eax, dword [0x45ece4]
mov ebp, dword [0x45eccc]
cdq
mov edi, eax
push 0xfffffffffffffffe
mov ebx, edx
mov eax, ebp
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
add ecx, ebp
imul ecx, ecx, 0x79faf08a
push 2
push 0xb57eb16
push ebx
sub eax, ecx
push edi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
push 1
push 0xeae0c6d3
push ebx
add ecx, eax
push edi
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul esi, esi, 0x2c857103
mov edx, dword [0x45ecdc]
mov ecx, dword [esp + 0x10]
imul edx, edx, 0x6181b446
add ecx, eax
sub ecx, esi
add ecx, edx
lea eax, [esp + 0x15c]
mov dword [0x45ecdc], ecx
push eax
lea ecx, [esp + 0x5c]
push ecx
call fcn.0043c32e
add esp, 8
test eax, eax
je 0x40711f
mov edx, dword [0x45ecd0]
mov esi, dword [0x45ece8]
mov eax, dword [0x45eccc]
push 0xfffffffffffffffe
lea edi, [edx + esi]
cdq
imul edi, edi, 0x4f64023c
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ebx, eax
push 1
mov eax, esi
cdq
push 0x86050f76
push edx
push eax
sub ebx, edi
call fcn.004319f0
mov ecx, dword [0x45ecd8]
mov edx, dword [0x45ecdc]
imul ecx, ecx, 0x2c857103
add ebx, eax
imul edx, edx, 0x6181b446
mov eax, dword [0x45ecd4]
imul eax, eax, 0x6b66a94
sub ebx, eax
mov eax, dword [esp + 0x3c]
push eax
sub ebx, ecx
push 0
sub ebx, edx
push 0x1f0fff
mov dword [0x45ece0], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45eccc]
mov edi, eax
mov eax, dword [0x45ecd4]
cdq
mov ebx, eax
push 2
mov ebp, edx
mov eax, esi
cdq
push 0xb57eb16
push edx
push eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
call fcn.004319f0
push 2
push 0xb57eb16
push ebp
push ebx
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
push 1
push 0xeae0c6d3
mov edx, ebp
push edx
sub ecx, eax
push ebx
mov dword [esp + 0x20], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
push 1
add ecx, eax
mov eax, dword [esp + 0x24]
push 0x86050f76
push eax
push edx
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul esi, esi, 0x140cef57
mov ecx, dword [esp + 0x10]
sub ecx, eax
sub ecx, esi
mov eax, dword [0x45ece8]
mov edx, dword [0x45ecdc]
imul eax, eax, 0x6b66a94
imul edx, edx, 0x5295f78d
add ecx, eax
add ecx, edx
test edi, edi
mov dword [str._r_____r____], ecx
jne 0x406fed
push 0x44efc8
call fcn.004325a6
add esp, 4
jmp 0x4070fd
mov esi, dword [0x45ecd0]
push 1
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov ebx, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
sub ebx, eax
mov eax, 0x4d7937c3
mul esi
mov eax, dword [0x45ece0]
imul eax, eax, 0x7f4ea4e2
shr edx, 0x1e
add ebx, edx
sub ebx, eax
mov eax, 0x2a01e433
imul esi
sar edx, 0x1c
mov ecx, edx
add ebx, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x6181b446
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
push edi
mov dword [0x45ecc8], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x407074
push 0x44efb4
call fcn.004325a6
add esp, 4
mov eax, dword [0x45ece4]
mov ebp, dword [0x45eccc]
cdq
mov esi, eax
push 0xfffffffffffffffe
mov ebx, edx
mov eax, ebp
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
add ecx, ebp
imul ecx, ecx, 0x79faf08a
push 2
push 0xb57eb16
push ebx
sub eax, ecx
push esi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
push 1
push 0xeae0c6d3
push ebx
add ecx, eax
push esi
mov dword [esp + 0x20], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [0x45ece0]
add ecx, eax
imul edx, edx, 0x2c857103
mov eax, dword [0x45ecdc]
imul eax, eax, 0x6181b446
sub ecx, edx
add ecx, eax
push edi
mov dword [0x45ecdc], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x34]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4071c4
mov esi, dword [0x45ece0]
jmp 0x406e12
mov ebx, dword [0x45ece8]
mov edi, dword [0x45ecd4]
mov eax, ebx
cdq
mov dword [esp + 0x2c], eax
push 1
mov dword [esp + 0x34], edx
mov eax, edi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ebp, dword [0x45ece0]
mov ecx, eax
mov eax, 0x2a215c6f
mul ebp
mov eax, ebp
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [esp + 0x2c]
shr eax, 0x1f
push 1
mov esi, eax
sub esi, ecx
mov ecx, dword [esp + 0x34]
push 0xebf310a9
push ecx
push edx
call fcn.004319f0
mov ecx, dword [esp + 0x2c]
push 2
sub esi, eax
mov eax, dword [esp + 0x34]
push 0x6b66a94
push eax
push ecx
call fcn.004319f0
imul ebp, ebp, 0x242d3a05
mov ecx, dword [esp + 0x3c]
add esi, eax
mov eax, dword [0x45ecc8]
mov edx, ebx
imul eax, eax, 0x151f392d
imul edx, edx, 0x6181b446
sub esi, edx
sub esi, eax
sub esi, ebp
mov dword [0x45ecd8], esi
mov dword [esp + 0x14], ecx
jmp 0x4071d6
mov edi, dword [0x45ecd4]
mov ebx, dword [0x45ece8]
mov esi, dword [0x45ecd8]
mov edx, dword [0x45ecd0]
mov eax, dword [0x45eccc]
push 0xfffffffffffffffe
lea ebp, [edx + ebx]
cdq
imul ebp, ebp, 0x4f64023c
push 0x4f64023c
push edx
push eax
call fcn.004319f0
sub eax, ebp
mov ebp, eax
push 1
mov eax, ebx
cdq
push 0x86050f76
push edx
push eax
call fcn.004319f0
imul edi, edi, 0x6b66a94
imul esi, esi, 0x2c857103
mov ecx, dword [esp + 0x18]
add ebp, eax
mov eax, dword [0x45ecdc]
imul eax, eax, 0x6181b446
sub ebp, edi
sub ebp, esi
sub ebp, eax
push ecx
mov dword [0x45ece0], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [0x45ecd4]
mov eax, ebp
cdq
push 1
push 0xeae0c6d3
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004319f0
push 1
push 0x5295f78d
push edi
push esi
mov ebx, eax
call fcn.004319f0
mov ecx, dword [0x45eccc]
add ebx, eax
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [0x45ece8]
sub ecx, edx
imul eax, eax, 0x6b66a94
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece0]
mov esi, dword [str._r_____r____]
imul edx, edx, 0x140cef57
shr ecx, 0x1f
add ebx, ecx
mov ecx, dword [0x45ece4]
sub ebx, edx
mov edx, ecx
imul edx, edx, 0x6181b446
sub ebx, eax
mov eax, dword [esp + 0x14]
add ebx, edx
sub ebx, esi
sub ebx, 0x4f64023c
test eax, eax
mov dword [0x45eccc], ebx
je 0x407466
mov eax, dword [esp + 0x3c]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45ecdc]
mov ebx, eax
mov eax, esi
cdq
mov ebp, eax
mov eax, dword [0x45ecd0]
push 1
mov edi, edx
cdq
push 0xb09bfdc4
push edx
push eax
mov dword [esp + 0x38], edi
call fcn.004319f0
push 0xfffffffffffffffd
push 0xf4a814ea
push edi
push ebp
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [0x45ece8]
mov edi, eax
imul ecx, ecx, 0x6b66a94
mov eax, dword [esp + 0x10]
sub edi, eax
add edi, ecx
mov ecx, dword [0x45ecd8]
mov edx, ecx
imul edx, edx, 0xb57eb16
add edi, edx
mov eax, 0x2a01e433
imul ecx
sar edx, 0x1c
add edi, edx
mov eax, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x5295f78d
shr eax, 0x1f
add eax, edi
mov edi, dword [0x45ece4]
add eax, edx
sub eax, edi
sub eax, 0x6181b446
test ebx, ebx
mov dword [0x45ecd0], eax
je 0x4074ea
mov edi, dword [str._r_____r____]
lea eax, [ecx + edi]
imul eax, eax, 0x5295f78d
mov ecx, eax
mov eax, 0x2a215c6f
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
push 1
add eax, edx
mov edx, dword [esp + 0x2c]
push 0xeae0c6d3
shr eax, 0x1f
push edx
sub ecx, eax
push ebp
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul esi, esi, 0x140cef57
imul edi, edi, 0x151f392d
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [0x45ece0]
sub ecx, esi
sub ecx, edi
push 0
lea ecx, [ecx + eax - 0x6181b446]
push ebx
mov dword [0x45ecd4], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [0x45ecd0]
mov esi, dword [0x45ece8]
mov eax, dword [0x45eccc]
push 0xfffffffffffffffe
lea edi, [edx + esi]
cdq
imul edi, edi, 0x4f64023c
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ebp, eax
push 1
mov eax, esi
cdq
push 0x86050f76
push edx
push eax
sub ebp, edi
call fcn.004319f0
mov ecx, dword [0x45ecd8]
mov edx, dword [0x45ecdc]
imul ecx, ecx, 0x2c857103
add ebp, eax
imul edx, edx, 0x6181b446
mov eax, dword [0x45ecd4]
imul eax, eax, 0x6b66a94
sub ebp, eax
sub ebp, ecx
sub ebp, edx
push ebx
mov dword [0x45ece0], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4074ec
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
push 0xfffffffffffffffd
mov eax, ecx
mov ebx, edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecc8]
add ecx, ebp
imul ecx, ecx, 0x242d3a05
sub eax, ecx
mov dword [esp + 0x10], eax
push 1
mov eax, esi
cdq
push 0xb09bfdc4
push edx
push eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
push 1
push 0xeae0c6d3
push ebx
add ecx, eax
push edi
mov dword [esp + 0x20], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x10]
push 1
push 0x86050f76
push ebx
sub ecx, eax
push edi
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul esi, esi, 0x151f392d
mov ecx, dword [esp + 0x10]
sub ecx, eax
sub ecx, esi
mov dword [0x45ece4], ecx
xor eax, eax
mov ecx, dword [esp + 0x260]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043180d
add esp, 0x254
ret