Function at 0x405260
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x458190]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24c]
push eax
push 0x446fbc
lea ecx, [esp + 0x148]
push 0x104
push ecx
call fcn.0042ae0c
mov eax, 0x4b226983
imul dword [0x456824]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x4c8d67b3
imul dword [0x45681c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov ebx, dword [0x456830]
mov eax, 0x2760f26d
imul dword [0x456824]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x955f5465
imul dword [0x456834]
mov esi, ebx
imul ebx, ebx, 0xd606
sar edx, 0xf
imul esi, esi, 0xd429
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov dword [esp + 0x20], eax
mov ebp, dword [0x456838]
mov eax, 0x2dbafdc3
imul dword [0x456834]
mov eax, dword [esp + 0x20]
sar edx, 0xd
add eax, edx
mov ebx, edx
mov edx, dword [0x456818]
imul edx, edx, 0xb323
shr ebx, 0x1f
add ebx, eax
add ebx, edx
mov edx, dword [0x456820]
mov eax, 0x7fe60547
imul edx
mov edi, ebp
imul edi, edi, 0x38bb
sar edx, 0xe
add ecx, edi
mov eax, edx
add ecx, esi
shr eax, 0x1f
add ebx, edx
add esp, 0x10
add eax, ebx
mov dword [str._r_____r____], ecx
mov dword [0x456818], eax
mov dword [esp + 0x14], 0
mov eax, 0x4b226983
imul ebp
sar edx, 0xe
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x4da3463f
imul dword [0x45681c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, edi
sub eax, ecx
push 0
lea ecx, [eax + esi + 0xa9e2]
push 2
mov dword [0x45681c], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x456828]
mov ebx, eax
mov eax, 0x4b226983
imul esi
sar edx, 0xe
mov ecx, esi
imul ecx, ecx, 0xda10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x4c8d67b3
imul esi
mov esi, dword [0x456818]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0xd308
sub ecx, eax
add ecx, edx
mov edx, dword [0x456834]
mov eax, 0x2760f26d
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp ebx, 0xffffffff
mov dword [0x456834], ecx
jne 0x4054a7
mov edi, dword [0x456830]
imul esi, esi, 0xb323
mov eax, 0x955f5465
imul edi, edi, 0xd606
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x2dbafdc3
imul ecx
mov ecx, dword [0x456820]
sub ebx, edi
sar edx, 0xd
mov edi, edx
add ebx, edx
mov eax, 0x7fe60547
imul ecx
shr edi, 0x1f
sar edx, 0xe
add edi, ebx
mov ecx, edx
add edi, esi
shr ecx, 0x1f
add edi, edx
add ecx, edi
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x456818], ecx
call fcn.0042ada6
add esp, 4
jmp 0x405af6
mov edx, dword [0x45682c]
imul esi, esi, 0x13350
mov edi, dword [str._r_____r____]
mov eax, 0x2760f26d
imul edi, edi, 0xd008
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, esi
mov esi, dword [0x456820]
mov eax, 0xc0e2caa9
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
sub edi, ecx
lea ecx, [esp + 0x18]
push ecx
sub edi, 0xb323
push ebx
mov dword [0x456820], edi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x405574
mov esi, dword [str._r_____r____]
mov edx, dword [0x456818]
imul esi, esi, 0xda10
mov ecx, dword [0x45682c]
imul edx, edx, 0xd429
add esi, edx
mov eax, 0x4da3463f
imul ecx
mov ecx, dword [0x456828]
sar edx, 0xe
imul ecx, ecx, 0x13350
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
sub esi, eax
add esi, edx
lea edx, [ecx + esi - 0xb323]
push ebx
mov dword [0x456824], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405af6
mov ecx, dword [0x456824]
mov eax, 0x4b226983
imul ecx
mov ecx, dword [0x456838]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x658cf6d9
imul ecx
sub edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45681c]
imul edx, edx, 0xd308
mov edi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetPriorityClass]
sub edi, esi
add edi, edx
mov eax, 0x2419bc59
imul ecx
imul ecx, ecx, 0xb323
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
mov dword [0x456828], eax
mov edi, edi
mov ecx, dword [0x456820]
mov esi, ecx
mov eax, 0x2760f26d
imul esi, esi, 0xd606
imul ecx
sar edx, 0xd
mov ecx, edx
add esi, edx
mov edx, dword [0x45682c]
imul edx, edx, 0xb323
shr ecx, 0x1f
add ecx, esi
add ecx, edx
mov eax, 0x6aa0ab9b
imul dword [0x45681c]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x801a
sub ecx, eax
add ecx, edx
lea eax, [esp + 0x140]
mov dword [0x45682c], ecx
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.00434b2e
add esp, 8
test eax, eax
je 0x405a1f
mov esi, dword [0x456824]
mov edx, dword [0x45682c]
imul esi, esi, 0x7127
mov ecx, dword [0x45681c]
imul edx, edx, 0xb323
sub esi, edx
mov eax, 0xc0e2caa9
imul ecx
add edx, ecx
mov ecx, dword [0x456828]
sar edx, 0xf
imul ecx, ecx, 0x801a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
push edx
sub esi, eax
push 0
add esi, ecx
push 0x1f0fff
mov dword [0x456830], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x456824]
mov esi, eax
mov ecx, dword [0x45681c]
mov eax, 0x4b226983
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x4c8d67b3
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov ecx, dword [0x456830]
mov edx, ecx
imul edx, edx, 0xd429
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x2760f26d
imul edi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
mov eax, dword [0x456838]
imul eax, eax, 0x38bb
add edx, eax
test esi, esi
mov dword [str._r_____r____], edx
jne 0x405740
push 0x446f88
call fcn.0042ada6
add esp, 4
jmp 0x40581f
mov edi, dword [0x456834]
imul ecx, ecx, 0xd606
mov eax, 0x955f5465
imul edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x456818]
mov dword [esp + 0x10], eax
imul ecx, ecx, 0xb323
mov eax, 0x2dbafdc3
imul edi
mov eax, dword [esp + 0x10]
sar edx, 0xd
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
add edi, ecx
mov ecx, dword [0x456820]
mov eax, 0x7fe60547
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
push esi
mov dword [0x456818], eax
call ebp
test eax, eax
jne 0x4057ba
push 0x446f74
call fcn.0042ada6
add esp, 4
mov ecx, dword [0x456820]
mov edi, ecx
mov eax, 0x2760f26d
imul edi, edi, 0xd606
imul ecx
mov ecx, dword [0x45682c]
imul ecx, ecx, 0xb323
sar edx, 0xd
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
add eax, ecx
mov ecx, dword [0x45681c]
mov edi, eax
mov eax, 0x6aa0ab9b
imul ecx
mov ecx, dword [0x456830]
sar edx, 0xf
imul ecx, ecx, 0x801a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push esi
mov dword [0x45682c], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x18]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4055e0
mov ecx, dword [0x456824]
mov ebp, dword [0x45681c]
mov esi, dword [0x456828]
mov edi, dword [esp + 0x14]
mov eax, dword [0x45682c]
imul ecx, ecx, 0x7127
imul esi, esi, 0x801a
imul eax, eax, 0xb323
sub ecx, eax
mov eax, 0xc0e2caa9
imul ebp
add edx, ebp
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
push ebx
mov dword [0x456830], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x456838]
mov eax, 0x4b226983
imul ecx
imul ecx, ecx, 0x38bb
sar edx, 0xe
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x456830]
imul edx, edx, 0xd429
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x4da3463f
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, ecx
sub eax, edx
add eax, 0xa9e2
test edi, edi
mov dword [0x45681c], eax
je 0x405a95
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [str._r_____r____]
mov edi, dword [0x456818]
mov esi, eax
mov ebx, dword [0x456820]
mov eax, 0x2760f26d
imul dword [0x45682c]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, ecx
imul ebp, ebp, 0xd008
mov edx, edi
imul edx, edx, 0x13350
sub ebp, eax
add ebp, edx
mov eax, 0xc0e2caa9
imul ebx
add edx, ebx
mov ebx, dword [0x456834]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
sub ebp, ebx
sub ebp, 0xb323
test esi, esi
mov dword [0x456820], ebp
je 0x405af6
mov eax, 0x4da3463f
imul ecx, ecx, 0xda10
imul edi, edi, 0xd429
imul dword [0x45682c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
imul edx, edx, 0x13350
add ecx, edi
mov edi, dword [0x456830]
sub ecx, eax
add ecx, edi
push 0
lea eax, [edx + ecx - 0xb323]
push esi
mov dword [0x456824], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [0x456824]
mov ecx, dword [0x45682c]
imul edi, edi, 0x7127
imul ecx, ecx, 0xb323
sub edi, ecx
mov ecx, dword [0x45681c]
mov eax, 0xc0e2caa9
imul ecx
add edx, ecx
mov ecx, dword [0x456828]
sar edx, 0xf
imul ecx, ecx, 0x801a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push esi
mov dword [0x456830], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.0042a0b1
add esp, 0x238
ret
mov ecx, dword [0x456824]
mov edi, dword [0x456838]
mov eax, 0x4b226983
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov ebp, dword [0x45681c]
mov eax, 0x658cf6d9
imul edi
sub edx, edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebp
imul edx, edx, 0xd308
sub eax, esi
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x2419bc59
imul edi
imul edi, edi, 0xb323
mov eax, dword [esp + 0x10]
sar edx, 0xb
mov esi, edx
shr esi, 0x1f
add eax, edx
add esi, eax
sub esi, edi
mov edi, dword [esp + 0x20]
mov dword [0x456828], esi
jmp 0x405848
mov ecx, dword [0x456828]
mov eax, 0x4b226983
imul ecx
mov esi, ecx
sar edx, 0xe
imul esi, esi, 0xda10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4c8d67b3
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0xd308
sub esi, ecx
mov ecx, dword [0x456834]
add esi, edx
mov eax, 0x2760f26d
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x456834], esi
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.0042a0b1
add esp, 0x238
ret