Function at 0x416200
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x234
mov eax, dword [0x452944]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x240], eax
xor eax, eax
mov byte [esp + 0x13c], 0
mov ecx, 0x40
lea edi, [esp + 0x13d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x248]
push eax
push 0x442000
lea ecx, [esp + 0x144]
push 0x104
push ecx
call fcn.00425dd8
mov edi, dword [0x4518e8]
mov ecx, dword [0x4518f4]
mov esi, dword [0x4518d8]
imul ecx, ecx, 0x62fe
mov eax, 0x58fba7b7
imul edi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, dword [0x4518dc]
mov edx, ecx
sub edx, eax
sub edx, esi
mov esi, dword [0x4518ec]
mov eax, esi
imul esi, esi, 0xd4a0
imul eax, eax, 0x5c10
mov dword [esp + 0x20], eax
lea ebp, [edx + ebx + 0xd46b]
mov eax, 0xd45237bd
imul edi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f0]
mov edi, eax
mov eax, dword [esp + 0x20]
sub edi, eax
mov eax, 0x27a02fad
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d4]
sub edi, eax
add edi, ebp
lea eax, [edx + edi - 0x5a74]
mov edi, dword [0x4518e0]
mov dword [0x4518d4], eax
mov eax, 0x7225d683
imul ebx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
add esp, 0x10
mov dword [str._r_____r_____n], ebp
xor ebp, ebp
sub eax, edi
push ebp
add eax, 0x131b4
push 2
mov dword [0x4518d8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [0x4518d4]
mov ebx, eax
mov edx, dword [0x4518f0]
mov esi, dword [0x4518e8]
mov eax, 0xe4218e9
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, edi
imul ecx, ecx, 0xd455
mov edx, esi
imul edx, edx, 0x11f11
sub ecx, eax
mov eax, dword [0x4518d8]
add ecx, edx
sub ecx, eax
add ecx, 0xc301
cmp ebx, 0xffffffff
mov dword [0x4518f0], ecx
jne 0x4163d0
mov ebx, dword [0x4518ec]
mov eax, 0xd45237bd
imul ebx, ebx, 0x5c10
imul esi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x27a02fad
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
sub esi, ebx
sub esi, ecx
add esi, edx
lea edx, [edi + esi - 0x5a74]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x4518d4], edx
call fcn.0042579d
add esp, 4
jmp 0x4168de
mov ecx, dword [0x4518dc]
mov eax, 0x57bc6617
imul ecx
sar edx, 0xd
mov edi, dword [0x4518ec]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xf1bde717
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x4518f4]
sub eax, edi
lea edx, [eax + ecx - 0x5a6f]
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [0x4518dc], edx
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x41647f
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518d8]
mov eax, 0x9a5307c5
imul esi, esi, 0xd4a0
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x33af
sub esi, ecx
add esi, dword [0x4518f0]
lea eax, [edx + esi + 0xc49d]
push ebx
mov dword [0x4518e0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4168de
mov ecx, dword [0x4518e4]
mov eax, 0xa5820cf9
imul ecx
add edx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x5a75
mov esi, ecx
mov ecx, dword [0x4518e0]
sub esi, edx
mov eax, 0x7225d683
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, 0x1f366
mov dword [0x4518e4], esi
lea ecx, [ecx]
mov esi, dword [0x4518dc]
imul ecx, ecx, 0x5a75
imul esi, esi, 0x5c10
add esi, ecx
mov ecx, dword [0x4518d8]
mov edx, ecx
imul edx, edx, 0xbb8d
sub esi, edx
mov eax, 0x27a02fad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [esp + 0x13c]
push ecx
lea edx, [esp + 0x3c]
sub esi, eax
push edx
mov dword [0x4518e8], esi
call fcn.0042f42e
add esp, 8
test eax, eax
je 0x4166a8
mov ecx, dword [0x4518d8]
mov eax, 0x57bc6617
imul ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 0xd
imul ecx, ecx, 0x5d5f
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x588f
sub ecx, eax
lea eax, [ecx + edx - 0x5a74]
mov ecx, dword [esp + 0x1c]
push ecx
push 0
push 0x1f0fff
mov dword [0x4518ec], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x4518e8]
mov edi, dword [0x4518f4]
mov esi, eax
imul edi, edi, 0x62fe
mov eax, 0x58fba7b7
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d8]
sub edi, eax
sub edi, edx
test esi, esi
mov edx, dword [0x4518dc]
lea edi, [edi + edx + 0xd46b]
mov dword [str._r_____r_____n], edi
jne 0x4165d1
push 0x441fcc
call fcn.0042579d
add esp, 4
jmp 0x41668e
mov eax, dword [0x4518ec]
imul eax, eax, 0x5c10
mov dword [esp + 0x10], eax
mov eax, 0xd45237bd
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x4518f0]
mov dword [esp + 0x10], eax
mov eax, 0x27a02fad
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518d4]
sub eax, ecx
add eax, edi
lea eax, [edx + eax - 0x5a74]
push esi
mov dword [0x4518d4], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x416644
push 0x441fb8
call fcn.0042579d
add esp, 4
mov edi, dword [0x4518dc]
mov ecx, dword [0x4518e0]
imul edi, edi, 0x5c10
imul ecx, ecx, 0x5a75
add edi, ecx
mov ecx, dword [0x4518d8]
mov edx, ecx
imul edx, edx, 0xbb8d
sub edi, edx
mov eax, 0x27a02fad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push esi
mov dword [0x4518e8], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
push ecx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4166fc
mov ecx, dword [0x4518e0]
jmp 0x4164d0
mov ecx, dword [0x4518e4]
mov eax, 0xa5820cf9
imul ecx
add edx, ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x5a75
mov ecx, eax
mov ebp, dword [esp + 0x1c]
sub ecx, edx
mov edx, dword [0x4518e0]
mov eax, 0x7225d683
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, 0x1f366
mov dword [0x4518e4], ecx
jmp 0x416702
mov ecx, dword [0x4518e4]
mov edx, dword [0x4518d8]
imul ecx, ecx, 0x588f
mov eax, 0x57bc6617
imul edx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0x5d5f
sub edx, eax
lea eax, [edx + ecx - 0x5a74]
push ebx
mov dword [0x4518ec], eax
call edi
mov ecx, dword [0x4518f4]
mov esi, dword [0x4518ec]
imul ecx, ecx, 0x62fe
imul esi, esi, 0xd4a0
sub esi, ecx
mov ecx, dword [0x4518dc]
mov eax, 0x7225d683
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, dword [0x4518e0]
add ecx, 0x131b4
test ebp, ebp
mov dword [0x4518d8], ecx
je 0x41689d
mov edx, dword [esp + 0x1c]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x4518dc]
mov esi, eax
mov eax, 0x57bc6617
imul ecx
mov ecx, dword [0x4518e8]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xf1bde717
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518ec]
sub eax, ebx
sub eax, edx
test esi, esi
mov edx, dword [0x4518f4]
lea eax, [eax + edx - 0x5a6f]
mov dword [0x4518dc], eax
je 0x4168de
mov ebx, dword [0x4518d8]
mov ebp, dword [0x4518f0]
imul ebx, ebx, 0xd4a0
mov eax, 0x9a5307c5
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x33af
sub ebx, ecx
add ebx, ebp
push 0
lea eax, [edx + ebx + 0xc49d]
push esi
mov dword [0x4518e0], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x4518d8]
mov eax, 0x57bc6617
imul ecx
mov eax, dword [0x4518e4]
sar edx, 0xd
imul eax, eax, 0x588f
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0x5d5f
sub edx, ecx
lea ecx, [edx + eax - 0x5a74]
push esi
mov dword [0x4518ec], ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x230]
call fcn.00424991
add esp, 0x234
ret
mov edx, dword [0x4518f0]
mov esi, dword [0x4518d4]
mov eax, 0xe4218e9
imul esi, esi, 0xd455
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e8]
imul edx, edx, 0x11f11
sub esi, eax
add esi, edx
sub esi, ecx
add esi, 0xc301
mov dword [0x4518f0], esi
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.00424991
add esp, 0x234
ret