Function at 0x405270
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x458190]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24c]
push eax
push 0x446fbc
lea ecx, [esp + 0x148]
push 0x104
push ecx
call fcn.0042ae9c
mov ebp, dword [0x45681c]
mov eax, 0x49f9945f
imul ebp
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x20], eax
mov eax, 0x302debc5
imul dword [0x456824]
mov eax, dword [esp + 0x20]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ecx, eax
mov eax, 0x3e12562b
imul dword [0x456824]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov ebx, dword [0x456830]
mov eax, 0x2ff8513b
imul dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x1558c
mov edi, ebx
imul ebx, ebx, 0xdd7b
sub eax, ebx
imul edi, edi, 0xa8da
add eax, edx
mov dword [esp + 0x20], eax
mov esi, dword [0x456838]
mov eax, 0x47298a5
imul esi, esi, 0xe0dd
imul dword [0x456834]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
sub edx, eax
mov ebx, edx
mov edx, dword [0x456820]
mov eax, 0x395bd985
imul edx
sar edx, 0xd
add ecx, edi
add ecx, esi
mov eax, edx
add esp, 0x10
shr eax, 0x1f
mov dword [str._r_____r____], ecx
add ebx, edx
add eax, ebx
mov dword [0x456818], eax
mov eax, 0x99b19d5b
imul ebp
add edx, ebp
sar edx, 0xf
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x302debc5
imul dword [0x456838]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
sub eax, ecx
push 0
lea ecx, [eax + edi + 0xaaa7]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45681c], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [0x456828]
mov ebp, eax
mov esi, dword [0x456818]
mov eax, 0x49f9945f
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
imul ecx, ecx, 0xd534
sub ecx, eax
mov edx, edi
imul edx, edx, 0x15410
add ecx, edx
mov eax, 0x302debc5
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456834]
sub ecx, eax
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp ebp, 0xffffffff
mov dword [0x456834], ecx
jne 0x4054c0
mov edi, dword [0x456830]
imul esi, esi, 0x1558c
mov eax, 0x2ff8513b
imul edi, edi, 0xdd7b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x47298a5
imul ecx
sar edx, 8
mov ecx, edx
sub ebx, edi
shr ecx, 0x1f
add ecx, edx
add ebx, esi
sub ebx, ecx
mov ecx, dword [0x456820]
mov eax, 0x395bd985
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x456818], eax
call fcn.0042ae36
add esp, 4
jmp 0x405aef
mov edx, dword [0x456820]
imul esi, esi, 0x398f
mov eax, 0x18008403
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub esi, eax
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x107f4
sub esi, eax
add esi, edx
lea eax, [esp + 0x18]
sub esi, ecx
push eax
sub esi, 0x1558c
push ebp
mov dword [0x456820], esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40558c
mov ecx, dword [0x45682c]
mov eax, 0x99b19d5b
imul ecx
mov eax, dword [0x456828]
add edx, ecx
imul eax, eax, 0x398f
sar edx, 0xf
mov edi, dword [0x456830]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x15410
sub edx, ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0xa8da
add eax, edi
add eax, edx
lea edx, [ecx + eax - 0x1558c]
push ebp
mov dword [0x456824], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405aef
mov ecx, dword [0x456838]
mov eax, 0x246e57b5
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, dword [0x45681c]
imul eax, eax, 0xd534
mov edx, ecx
imul edx, edx, 0x1558c
sub esi, edx
mov edx, dword [0x456824]
add esi, eax
mov eax, 0x302debc5
imul edx
sar edx, 0xe
mov eax, edx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61082f49
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov dword [0x456828], esi
mov ecx, dword [0x456820]
mov edx, dword [0x45682c]
imul edx, edx, 0x1558c
mov esi, ecx
imul esi, esi, 0xdd7b
add esi, edx
mov eax, 0x47298a5
imul dword [0x45681c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub esi, eax
add esi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
add esi, edx
lea ecx, [esp + 0x140]
shr eax, 0x1f
push ecx
lea edx, [esp + 0x40]
add eax, esi
push edx
mov dword [0x45682c], eax
call fcn.00434bbe
mov esi, dword [0x456824]
add esp, 8
test eax, eax
je 0x405a29
mov eax, dword [0x45682c]
imul esi, esi, 0xffffc9ca
mov ecx, dword [0x45681c]
imul eax, eax, 0x1558c
sub esi, eax
mov eax, 0x18008403
imul ecx
mov eax, dword [esp + 0x20]
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456828]
imul edx, edx, 0x8ed2
push eax
sub esi, ecx
push 0
add esi, edx
push 0x1f0fff
mov dword [0x456830], esi
call ebx
mov ecx, dword [0x45681c]
mov esi, eax
mov eax, dword [0x456838]
imul eax, eax, 0xe0dd
mov dword [esp + 0x10], eax
mov edi, dword [0x456824]
mov eax, 0x49f9945f
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov ecx, eax
mov eax, 0x302debc5
imul edi
sar edx, 0xe
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x456830]
mov edx, ecx
imul edx, edx, 0xa8da
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x3e12562b
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
test esi, esi
mov dword [str._r_____r____], edx
jne 0x40574e
push 0x446f88
call fcn.0042ae36
add esp, 4
jmp 0x405831
mov edi, dword [0x456834]
imul ecx, ecx, 0xdd7b
mov eax, 0x2ff8513b
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0x1558c
add eax, ecx
mov ecx, eax
mov eax, 0x47298a5
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [0x456820]
mov eax, 0x395bd985
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
push esi
mov dword [0x456818], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x4057cf
push 0x446f74
call fcn.0042ae36
add esp, 4
mov ecx, dword [0x456820]
mov edx, dword [0x45682c]
imul edx, edx, 0x1558c
mov edi, ecx
imul edi, edi, 0xdd7b
add edi, edx
mov edx, dword [0x45681c]
mov eax, 0x47298a5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub edi, eax
add edi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
push esi
mov dword [0x45682c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4055f4
mov esi, dword [0x456824]
mov ecx, dword [0x456828]
mov edi, dword [esp + 0x14]
mov edx, dword [0x45682c]
imul esi, esi, 0xffffc9ca
imul ecx, ecx, 0x8ed2
imul edx, edx, 0x1558c
sub esi, edx
mov eax, 0x18008403
imul dword [0x45681c]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
push ebp
mov dword [0x456830], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x302debc5
imul esi
mov ebp, esi
imul ebp, ebp, 0xe0dd
sar edx, 0xe
sub ecx, ebp
add ecx, edx
mov eax, edx
mov edx, dword [str._r_____r____]
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0xa8da
add eax, ecx
sub eax, edx
add eax, 0xaaa7
test edi, edi
mov dword [0x45681c], eax
je 0x405a8e
mov edx, dword [esp + 0x20]
push edx
push 0
push 0x1f0fff
call ebx
mov ecx, dword [0x456820]
mov edi, dword [0x456818]
mov ebp, dword [0x45682c]
mov esi, eax
mov eax, 0x18008403
imul ecx
sar edx, 0xc
mov ebx, edi
imul ebx, ebx, 0x398f
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3e12562b
imul ebp
mov eax, dword [0x456834]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x107f4
add ebx, edx
sub ebx, eax
sub ebx, 0x1558c
test esi, esi
mov dword [0x456820], ebx
je 0x405aef
mov eax, 0x99b19d5b
imul ecx, ecx, 0x15410
imul edi, edi, 0xa8da
imul ebp
add edx, ebp
mov ebp, dword [0x456830]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
imul edx, edx, 0x398f
sub ecx, eax
add edx, ebp
add edx, ecx
push 0
lea eax, [edi + edx - 0x1558c]
push esi
mov dword [0x456824], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45682c]
mov edi, dword [0x456824]
imul ecx, ecx, 0x1558c
imul edi, edi, 0xffffc9ca
sub edi, ecx
mov ecx, dword [0x45681c]
mov eax, 0x18008403
imul ecx
mov ecx, dword [0x456828]
sar edx, 0xc
imul ecx, ecx, 0x8ed2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push esi
mov dword [0x456830], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.0042a141
add esp, 0x238
ret
mov edi, dword [0x456838]
mov eax, 0x246e57b5
imul edi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x45681c]
imul eax, eax, 0xd534
mov edx, edi
imul edx, edx, 0x1558c
sub ecx, edx
add ecx, eax
mov eax, 0x302debc5
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x61082f49
imul edi
mov edi, dword [esp + 0x20]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x456828], ecx
jmp 0x405854
mov ecx, dword [0x456828]
mov esi, dword [0x456818]
mov eax, 0x49f9945f
imul esi, esi, 0xd534
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub esi, eax
add esi, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov dword [0x456834], esi
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.0042a141
add esp, 0x238
ret