Function at 0x406420
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x45e640]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24c]
push eax
push 0x44cffc
lea ecx, [esp + 0x148]
push 0x104
push ecx
call fcn.0043083c
mov ecx, dword [0x45ccd4]
mov eax, 0x38e38e39
imul ecx
sar edx, 7
mov esi, edx
mov edi, dword [0x45cccc]
shr esi, 0x1f
add esi, edx
mov eax, 0x4f576647
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x4f576647
imul edi
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x242
mov eax, edi
imul eax, eax, 0x203
sub ecx, ebp
add ecx, edx
add ecx, eax
mov eax, 0x93459be7
imul edi
add edx, edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x71625345
imul dword [0x45cce4]
sar edx, 8
mov ebx, dword [0x45cce8]
mov eax, edx
imul ebx, ebx, 0x21e
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0xd8a5df
imul dword [0x45ccd0]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
mov dword [esp + 0x20], eax
mov eax, 0x7f411e53
imul dword [0x45ccd0]
add ecx, ebx
add ecx, esi
add esp, 0x10
sar edx, 8
mov dword [str._r_____r____], ecx
mov ebp, edx
mov eax, dword [esp + 0x10]
add eax, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0x91a2b3c5
imul dword [0x45ccd0]
add edx, dword [0x45ccd0]
sar edx, 7
add ebp, edx
mov eax, edx
mov edx, dword [0x45ccc8]
shr eax, 0x1f
imul edx, edx, 0xe1
add eax, ebp
mov ebp, dword [0x45cce0]
add eax, edx
mov edx, ebp
imul ebp, ebp, 0x203
imul edx, edx, 0x61
add eax, edx
mov dword [0x45ccc8], eax
mov eax, 0x71625345
imul dword [0x45ccd4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov edx, eax
mov eax, dword [0x45cce4]
imul eax, eax, 0xe1
add edx, eax
mov dword [esp + 0x10], edx
mov eax, 0xd20d20d3
imul edi
add edx, edi
mov edi, dword [esp + 0x10]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ebx
sub eax, ecx
push 0
lea ecx, [eax + esi + 0x16f]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45cccc], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edx, dword [0x45ccd4]
mov edi, dword [0x45ccc8]
mov ecx, dword [0x45cce4]
mov ebx, eax
mov esi, dword [0x45ccd8]
lea ebp, [edi + edx]
mov eax, 0x4f576647
imul ebp, ebp, 0x9c
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x38e38e39
imul esi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x93459be7
imul esi
add edx, esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
sub ebp, ecx
add eax, edx
sub ebp, eax
mov ecx, dword [str._r_____r____]
lea edx, [ecx + ecx*8]
shl edx, 6
add ebp, edx
mov eax, 0x59493e15
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
cmp ebx, 0xffffffff
mov dword [0x45cce4], ecx
jne 0x4066fb
mov eax, 0x71625345
imul edi, edi, 0xe1
imul ecx
mov ecx, dword [0x45ccd0]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xd8a5df
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x7f411e53
imul ecx
sar edx, 8
sub ebx, esi
mov esi, edx
add ebx, edx
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 7
shr esi, 0x1f
mov ecx, edx
add esi, ebx
add esi, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x61
shr ecx, 0x1f
add ecx, esi
add ecx, edi
add ecx, edx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45ccc8], ecx
call fcn.004307d6
add esp, 4
jmp 0x406ef5
mov edx, dword [0x45ccdc]
imul edi, edi, 0x242
mov eax, 0x4f576647
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x21e
mov ebp, esi
imul ebp, ebp, 0x33a
sub ebp, eax
add ebp, edi
add ebp, edx
mov edx, dword [0x45ccd0]
mov eax, 0x59493e15
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x91a2b3c5
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
sub eax, ecx
lea ecx, [esp + 0x18]
push ecx
sub eax, 0xe1
push ebx
mov dword [0x45ccd0], eax
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4067f7
mov ecx, dword [0x45ccdc]
mov esi, dword [str._r_____r____]
mov edx, dword [0x45ccd8]
lea edi, [edx + esi]
mov eax, 0x38e38e39
imul edi, edi, 0x242
imul ecx
sar edx, 7
mov eax, ecx
imul eax, eax, 0x203
mov ebp, edx
add edi, edx
shr ebp, 0x1f
add ebp, edi
add ebp, eax
lea edx, [esi + esi*8]
shl edx, 6
add ebp, edx
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
mov ecx, dword [0x45cce0]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
lea edx, [ecx + ebp - 0xe1]
push ebx
mov dword [0x45ccd4], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406ef5
mov eax, dword [0x45ccc8]
mov ecx, dword [0x45ccd4]
lea eax, [eax + eax*8]
shl eax, 6
mov esi, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45cce8]
mov eax, 0xf1d48bd
imul ecx
sar edx, 5
add esi, edx
mov edi, edx
mov eax, 0x7f411e53
imul ecx
imul ecx, ecx, 0xe1
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
add edi, esi
sub edi, eax
sub edi, ecx
mov ecx, dword [0x45cce0]
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
sar edx, 7
add edi, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x9c
shr eax, 0x1f
add eax, edi
add eax, edx
mov dword [0x45ccd8], eax
jmp 0x406880
mov esi, dword [0x45cccc]
imul ecx, ecx, 0x25d
mov eax, dword [0x45ccd0]
mov edi, dword [0x45cce4]
lea ebp, [eax + esi]
mov eax, 0x4f576647
imul ebp, ebp, 0x1bd
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
add eax, ecx
mov ebp, eax
mov eax, 0x38e38e39
imul edi
sar edx, 7
mov ecx, edx
add ebp, edx
mov eax, 0x71625345
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0xe1
shr ecx, 0x1f
add ecx, ebp
sub ecx, eax
add ecx, edx
lea eax, [esp + 0x140]
mov dword [0x45ccdc], ecx
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.0043a56e
add esp, 8
test eax, eax
je 0x406b5f
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccd8]
lea esi, [edx + ecx]
imul eax, eax, 0x25d
mov edx, dword [0x45ccd4]
imul esi, esi, 0x16f
imul edx, edx, 0x21e
add esi, eax
sub esi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sar edx, 8
mov edi, edx
add esi, edx
mov eax, 0x59493e15
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 7
imul ecx, ecx, 0xe1
mov eax, edx
shr eax, 0x1f
shr edi, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
add edi, esi
push edx
sub edi, eax
push 0
sub edi, ecx
push 0x1f0fff
mov dword [0x45cce0], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x45ccd4]
mov esi, eax
mov ecx, dword [0x45cccc]
mov eax, 0x4f576647
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x4f576647
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x242
sub eax, ebp
add eax, edx
mov ebp, eax
mov eax, 0x38e38e39
imul edi
mov eax, dword [0x45cce8]
sar edx, 7
imul eax, eax, 0x21e
add ebp, edx
mov edi, edx
mov edx, ecx
imul edx, edx, 0x203
shr edi, 0x1f
add edi, ebp
add edi, eax
add edi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
test esi, esi
mov dword [str._r_____r____], edi
jne 0x406a31
push 0x44cfc8
call fcn.004307d6
add esp, 4
jmp 0x406b41
mov ecx, dword [0x45cce4]
mov eax, 0x71625345
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x45ccd0]
mov eax, 0xd8a5df
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x7f411e53
imul ecx
sar edx, 8
sub ebp, edi
mov edi, edx
add ebp, edx
mov eax, 0x91a2b3c5
imul ecx
mov eax, dword [0x45cce0]
add edx, ecx
imul eax, eax, 0x61
sar edx, 7
shr edi, 0x1f
mov ecx, edx
add edi, ebp
add edi, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0xe1
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add ecx, eax
push esi
mov dword [0x45ccc8], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406ac2
push 0x44cfb4
call fcn.004307d6
add esp, 4
mov ecx, dword [0x45cccc]
mov edx, dword [0x45ccd0]
mov edi, dword [0x45cce4]
lea ebp, [edx + ecx]
mov eax, 0x4f576647
imul ebp, ebp, 0x1bd
imul edi
sar edx, 8
add ebp, edx
mov eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x25d
shr eax, 0x1f
add eax, ebp
add eax, edx
mov ebp, eax
mov eax, 0x38e38e39
imul edi
sar edx, 7
mov edi, edx
add ebp, edx
mov eax, 0x71625345
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 8
imul ecx, ecx, 0xe1
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, ebp
add eax, edx
sub edi, eax
add edi, ecx
push esi
mov dword [0x45ccdc], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x18]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406be9
mov ecx, dword [0x45cce0]
jmp 0x406880
mov eax, dword [0x45ccc8]
mov esi, dword [0x45ccd4]
lea eax, [eax + eax*8]
shl eax, 6
mov edi, eax
mov eax, 0x38e38e39
imul esi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45cce8]
mov eax, 0xf1d48bd
imul ecx
sar edx, 5
add edi, edx
mov ebp, edx
mov eax, 0x7f411e53
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0xe1
shr ebp, 0x1f
add ebp, edi
mov edi, dword [0x45cce0]
sub ebp, eax
sub ebp, edx
mov eax, 0xd20d20d3
imul edi
add edx, edi
imul edi, edi, 0x9c
sar edx, 7
mov eax, edx
add ebp, edx
shr eax, 0x1f
add eax, ebp
mov ebp, dword [esp + 0x20]
add eax, edi
mov dword [0x45ccd8], eax
jmp 0x406bfe
mov esi, dword [0x45ccd4]
mov ecx, dword [0x45cce8]
mov eax, dword [0x45ccd8]
mov ebp, dword [esp + 0x14]
mov edx, dword [0x45ccd0]
imul eax, eax, 0x25d
imul esi, esi, 0x21e
lea edi, [edx + ecx]
imul edi, edi, 0x16f
add edi, eax
mov eax, 0x93459be7
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sub edi, esi
sar edx, 8
mov esi, edx
add edi, edx
mov eax, 0x59493e15
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 7
imul ecx, ecx, 0xe1
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add esi, edi
add eax, edx
sub esi, eax
sub esi, ecx
push ebx
mov dword [0x45cce0], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x45ccd4]
mov ecx, dword [0x45cce0]
mov eax, 0x71625345
imul ecx, ecx, 0x203
imul esi
sar edx, 8
add ecx, edx
mov edi, edx
mov eax, 0x38e38e39
imul esi
sar edx, 7
shr edi, 0x1f
mov ebx, edx
add edi, ecx
mov ecx, dword [0x45cccc]
add edi, edx
mov edx, dword [0x45cce8]
shr ebx, 0x1f
imul edx, edx, 0x21e
add ebx, edi
mov edi, dword [0x45cce4]
mov eax, edi
imul eax, eax, 0xe1
sub ebx, edx
add ebx, eax
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, ecx
add eax, 0x16f
test ebp, ebp
mov dword [0x45cccc], eax
je 0x406e85
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45ccdc]
mov edi, dword [0x45ccd8]
mov esi, eax
mov eax, 0x4f576647
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
mov ebx, edi
imul edx, edx, 0x242
imul ebx, ebx, 0x33a
sub ebx, eax
mov eax, dword [0x45cce8]
imul eax, eax, 0x21e
add ebx, edx
mov edx, dword [0x45ccd0]
add ebx, eax
mov eax, 0x59493e15
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x91a2b3c5
imul edi
add edx, edi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, dword [0x45cce4]
sub eax, 0xe1
test esi, esi
mov dword [0x45ccd0], eax
je 0x406ef5
mov ebx, dword [str._r_____r____]
mov eax, 0x38e38e39
imul ecx
add edi, ebx
imul edi, edi, 0x242
sar edx, 7
mov ebp, edx
add edi, edx
mov edx, ecx
imul edx, edx, 0x203
shr ebp, 0x1f
add ebp, edi
add ebp, edx
lea eax, [ebx + ebx*8]
shl eax, 6
add ebp, eax
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cce0]
sub ebp, ecx
push 0
lea eax, [edx + ebp - 0xe1]
push esi
mov dword [0x45ccd4], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccd8]
lea edi, [edx + ecx]
imul eax, eax, 0x25d
mov edx, dword [0x45ccd4]
imul edi, edi, 0x16f
imul edx, edx, 0x21e
add edi, eax
sub edi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sar edx, 8
mov ebx, edx
add edi, edx
mov eax, 0x59493e15
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 7
imul ecx, ecx, 0xe1
shr ebx, 0x1f
mov eax, edx
shr eax, 0x1f
add ebx, edi
add eax, edx
sub ebx, eax
sub ebx, ecx
push esi
mov dword [0x45cce0], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.0042fb01
add esp, 0x238
ret
mov edx, dword [0x45ccc8]
lea ebx, [edx + esi]
mov esi, dword [0x45ccd8]
imul ebx, ebx, 0x9c
mov eax, 0x4f576647
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x38e38e39
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x93459be7
imul esi
add edx, esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
lea edx, [ecx + ecx*8]
shl edx, 6
add ebx, edx
mov eax, 0x59493e15
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x45cce4], eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.0042fb01
add esp, 0x238
ret