Function at 0x405d60
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x234
mov eax, dword [0x458190]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x240], eax
xor eax, eax
mov byte [esp + 0x13c], 0
mov ecx, 0x40
lea edi, [esp + 0x13d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x248]
push eax
push 0x446fc4
lea ecx, [esp + 0x144]
push 0x104
push ecx
call fcn.0042aefb
mov ebp, dword [0x456824]
mov eax, 0x606c8017
imul ebp
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
mov ebx, eax
mov edi, dword [0x456830]
mov eax, 0xc4570565
imul edx
add edx, dword [0x45682c]
mov ecx, dword [0x456838]
sar edx, 0x16
imul ecx, ecx, 0x15bc8b
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x329dfa79
imul ebp
sar edx, 0x14
mov esi, edi
imul edi, edi, 0x537276
mov eax, edx
imul esi, esi, 0x53af19
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, esi
add ebx, ecx
mov dword [str._r_____r____], ebx
mov ebx, dword [0x456820]
mov eax, 0x521ee247
imul ebx
imul ebx, ebx, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
mov edi, dword [0x456834]
add eax, ebx
mov dword [esp + 0x20], eax
mov eax, 0x759571eb
imul edi
mov eax, dword [esp + 0x20]
sar edx, 0x15
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x224214b1
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add esp, 0x10
add eax, edx
sub ebx, eax
mov eax, 0x606c8017
imul dword [0x456838]
sar edx, 0x15
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
sub eax, ebp
push 0
lea ecx, [eax + esi + 0x42333a]
push 2
mov dword [0x456818], ebx
mov dword [esp + 0x18], 0
mov dword [0x45681c], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edx, dword [0x45681c]
mov esi, dword [0x456828]
mov ebp, eax
mov eax, 0x606c8017
imul edx
sar edx, 0x15
mov ecx, esi
imul ecx, ecx, 0x54f550
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xc4570565
imul esi
add edx, esi
mov esi, dword [0x456818]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x536f78
sub ecx, eax
add ecx, edx
mov edx, dword [0x456834]
mov eax, 0x329dfa79
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp ebp, 0xffffffff
mov dword [0x456834], ecx
jne 0x405fb2
mov esi, dword [0x456820]
mov edi, dword [0x456830]
mov eax, 0x521ee247
imul edi, edi, 0x537276
imul esi
imul esi, esi, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x759571eb
imul ecx
sar edx, 0x15
sub ebx, edi
add ebx, esi
mov esi, edx
add ebx, edx
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov ecx, edx
shr esi, 0x1f
shr ecx, 0x1f
add ecx, edx
add esi, ebx
sub esi, ecx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x456818], esi
call fcn.0042ae95
add esp, 4
jmp 0x4065c6
mov ecx, dword [0x45682c]
imul esi, esi, 0x779018
mov edi, dword [str._r_____r____]
mov eax, 0x329dfa79
imul edi, edi, 0x50ebd8
imul ecx
mov ecx, dword [0x456820]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1eefbef3
imul ecx
mov eax, dword [0x456830]
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
add edi, esi
lea edx, [esp + 0x14]
sub edi, eax
push edx
sub edi, 0x45ab63
push ebp
mov dword [0x456820], edi
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x406081
mov ecx, dword [0x45682c]
mov esi, dword [str._r_____r____]
mov ebx, dword [0x456834]
imul esi, esi, 0x54f550
mov eax, 0x622f07f9
imul ecx
mov ecx, dword [0x456818]
sar edx, 0x15
imul ecx, ecx, 0x53af19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
imul edx, edx, 0x779018
sub esi, eax
add ecx, ebx
add ecx, esi
lea eax, [edx + ecx - 0x45ab63]
push ebp
mov dword [0x456824], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4065c6
mov ecx, dword [0x456824]
mov edi, dword [0x45681c]
mov esi, dword [0x456838]
imul edi, edi, 0x536f78
mov eax, 0x606c8017
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xbc70579
imul esi
sar edx, 0x10
add edi, edx
mov ebx, edx
mov eax, 0x61e4609d
imul esi
imul esi, esi, 0x45ab63
sar edx, 0x15
shr ebx, 0x1f
mov eax, edx
shr eax, 0x1f
add ebx, edi
add eax, edx
sub ebx, eax
sub ebx, esi
mov dword [0x456828], ebx
mov edx, dword [0x456820]
imul ecx, ecx, 0x45ab63
mov esi, edx
mov eax, 0x329dfa79
imul esi, esi, 0x537276
imul edx
sar edx, 0x14
mov edi, edx
add esi, edx
mov edx, dword [0x456830]
imul edx, edx, 0x31e0ba
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0x224214b1
imul dword [0x45681c]
sar edx, 0x14
mov eax, edx
add edi, ecx
shr eax, 0x1f
add eax, edx
lea ecx, [esp + 0x13c]
push ecx
lea edx, [esp + 0x3c]
sub edi, eax
push edx
mov dword [0x45682c], edi
call fcn.00434bee
add esp, 8
test eax, eax
je 0x40631b
mov ecx, dword [0x45681c]
mov eax, 0x1eefbef3
imul ecx
mov ecx, dword [0x456824]
imul ecx, ecx, 0x42333a
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub ecx, eax
imul edx, edx, 0x45ab63
mov eax, dword [0x456828]
imul eax, eax, 0x1c242f
sub ecx, edx
add ecx, eax
mov dword [0x456830], ecx
mov ecx, dword [esp + 0x1c]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x456824]
mov esi, eax
mov ecx, dword [0x45682c]
mov eax, 0x606c8017
imul edi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x329dfa79
imul edi
sub ebx, ecx
mov ecx, dword [0x456838]
sar edx, 0x14
imul ecx, ecx, 0x15bc8b
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
mov ecx, dword [0x456830]
mov edx, ecx
imul edx, edx, 0x53af19
add ebx, edx
test esi, esi
mov dword [str._r_____r____], ebx
jne 0x40622c
push 0x446f90
call fcn.0042ae95
add esp, 4
jmp 0x406301
mov edi, dword [0x456820]
imul ecx, ecx, 0x537276
mov eax, 0x521ee247
imul edi
imul edi, edi, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x456834]
mov eax, 0x759571eb
imul ecx
add ebx, edi
sar edx, 0x15
mov edi, edx
add ebx, edx
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov ecx, edx
shr edi, 0x1f
shr ecx, 0x1f
add ecx, edx
add edi, ebx
sub edi, ecx
push esi
mov dword [0x456818], edi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40629f
push 0x446f7c
call fcn.0042ae95
add esp, 4
mov ecx, dword [0x456820]
mov edi, ecx
mov eax, 0x329dfa79
imul edi, edi, 0x537276
imul ecx
mov eax, dword [0x456824]
mov ecx, dword [0x45681c]
imul eax, eax, 0x45ab63
sar edx, 0x14
mov ebx, edx
add edi, edx
mov edx, dword [0x456830]
imul edx, edx, 0x31e0ba
shr ebx, 0x1f
add ebx, edi
add ebx, edx
add ebx, eax
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
push esi
mov dword [0x45682c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x14]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406380
mov ecx, dword [0x456824]
jmp 0x4060e0
mov esi, dword [0x456824]
mov ebx, dword [0x45681c]
mov edi, dword [0x456838]
imul ebx, ebx, 0x536f78
mov eax, 0x606c8017
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbc70579
imul edi
sar edx, 0x10
add ebx, edx
mov ecx, edx
mov eax, 0x61e4609d
imul edi
imul edi, edi, 0x45ab63
sar edx, 0x15
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, ebx
add eax, edx
sub ecx, eax
sub ecx, edi
mov edi, dword [esp + 0x1c]
mov dword [0x456828], ecx
jmp 0x406390
mov esi, dword [0x456824]
mov ecx, dword [0x456828]
mov edi, dword [esp + 0x10]
mov eax, 0x1eefbef3
imul esi, esi, 0x42333a
imul ecx, ecx, 0x1c242f
imul dword [0x45681c]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
imul edx, edx, 0x45ab63
sub esi, eax
sub esi, edx
add esi, ecx
push ebp
mov dword [0x456830], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x456838]
mov ecx, dword [0x45681c]
mov eax, 0x606c8017
imul esi
imul esi, esi, 0x15bc8b
sar edx, 0x15
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x622f07f9
imul ecx
mov eax, dword [0x456830]
sar edx, 0x15
imul eax, eax, 0x53af19
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
sub ecx, esi
mov esi, dword [0x456824]
add ecx, eax
sub ecx, esi
add ecx, 0x42333a
test edi, edi
mov dword [0x45681c], ecx
je 0x406563
mov ecx, dword [esp + 0x1c]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x45682c]
mov esi, dword [str._r_____r____]
mov ecx, dword [0x456820]
mov edi, eax
mov eax, 0x329dfa79
imul ebx
sar edx, 0x14
mov ebp, esi
imul ebp, ebp, 0x50ebd8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x1eefbef3
imul ecx
mov eax, dword [0x456830]
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebp, ecx
mov ecx, dword [0x456818]
mov edx, ecx
imul edx, edx, 0x779018
add ebp, edx
sub ebp, eax
sub ebp, 0x45ab63
test edi, edi
mov dword [0x456820], ebp
je 0x4065c6
mov ebp, dword [0x456834]
imul ecx, ecx, 0x53af19
imul esi, esi, 0x54f550
mov eax, 0x622f07f9
imul ebx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
imul edx, edx, 0x779018
sub esi, eax
add ecx, ebp
add ecx, esi
push 0
lea eax, [edx + ecx - 0x45ab63]
push edi
mov dword [0x456824], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45681c]
mov eax, 0x1eefbef3
imul ecx
mov eax, dword [0x45682c]
sar edx, 0x13
imul eax, eax, 0x45ab63
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456824]
imul edx, edx, 0x42333a
sub edx, ecx
mov ecx, dword [0x456828]
imul ecx, ecx, 0x1c242f
sub edx, eax
add edx, ecx
push edi
mov dword [0x456830], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x230]
call fcn.0042a161
add esp, 0x234
ret
mov esi, dword [0x456828]
mov eax, 0x606c8017
imul ecx
sar edx, 0x15
mov edi, esi
imul edi, edi, 0x54f550
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xc4570565
imul esi
add edx, esi
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x536f78
sub edi, ecx
mov ecx, dword [0x456834]
add edi, edx
mov eax, 0x329dfa79
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [0x456834], edi
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.0042a161
add esp, 0x234
ret