Function at 0x416290
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x234
mov eax, dword [0x452944]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x240], eax
xor eax, eax
mov byte [esp + 0x13c], 0
mov ecx, 0x40
lea edi, [esp + 0x13d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x248]
push eax
push 0x442000
lea ecx, [esp + 0x144]
push 0x104
push ecx
call fcn.00425e4d
mov esi, dword [0x4518e8]
mov ecx, dword [0x4518f4]
mov edi, dword [0x4518d8]
imul ecx, ecx, 0x926
mov eax, 0x6614bc37
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
sub edx, eax
sub edx, edi
mov edi, dword [0x4518dc]
lea ebx, [edx + edi + 0x1503]
mov eax, 0x4152dddf
imul esi
mov esi, dword [0x4518ec]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f0]
mov ebp, esi
imul esi, esi, 0x1538
imul ebp, ebp, 0xfffff5f8
sub ebp, eax
mov eax, 0x6a79dd7b
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d4]
sub ebp, eax
add ebp, ebx
lea eax, [edx + ebp - 0x86c]
mov dword [0x4518d4], eax
mov eax, 0x8c03f71d
imul edi
add edx, edi
mov edi, dword [0x4518e0]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, esi
sub eax, ecx
add esp, 0x10
xor ebp, ebp
sub eax, edi
push ebp
add eax, 0x2044
push 2
mov dword [str._r_____r_____n], ebx
mov dword [0x4518d8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x4518f0]
mov ebx, eax
mov eax, 0x8b081419
imul ecx
mov esi, dword [0x4518e8]
mov edi, dword [0x4518d4]
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, esi
imul ecx, ecx, 0x1d41
mov eax, edi
imul eax, eax, 0x14ed
sub ecx, edx
add ecx, eax
sub ecx, dword [0x4518d8]
add ecx, 0x1339
cmp ebx, 0xffffffff
mov dword [0x4518f0], ecx
jne 0x416457
mov eax, 0x4152dddf
imul esi
mov esi, dword [0x4518ec]
sar edx, 0xa
imul esi, esi, 0xfffff5f8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x6a79dd7b
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
sub esi, ecx
add esi, edx
lea edx, [edi + esi - 0x86c]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x4518d4], edx
call fcn.004257cd
add esp, 4
jmp 0x41695c
mov ecx, dword [0x4518dc]
mov eax, 0x8b081419
imul esi
add edx, esi
sar edx, 0xc
mov edi, dword [0x4518ec]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xa5b2ed37
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518f4]
sub ecx, esi
sub ecx, edi
lea eax, [ecx + edx - 0x866]
lea ecx, [esp + 0x14]
push ecx
push ebx
mov dword [0x4518dc], eax
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x416508
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518d8]
mov eax, 0x61dea4df
imul esi, esi, 0x1538
imul ecx
mov ecx, dword [0x4518e4]
sar edx, 0xb
imul ecx, ecx, 0x4cf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f0]
sub esi, eax
add esi, edx
lea edx, [ecx + esi + 0x14d5]
push ebx
mov dword [0x4518e0], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41695c
mov ecx, dword [0x4518e0]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
mov esi, eax
mov eax, 0x1bfba0af
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x86d
sub eax, esi
sub eax, edx
add eax, 0x322e
mov dword [0x4518e4], eax
mov edx, dword [0x4518d8]
imul ecx, ecx, 0x86d
mov esi, dword [0x4518dc]
mov eax, edx
imul esi, esi, 0xa08
imul eax, eax, 0xfad
sub esi, eax
mov eax, 0x6a79dd7b
imul edx
add esi, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x13c]
push edx
lea eax, [esp + 0x3c]
sub esi, ecx
push eax
mov dword [0x4518e8], esi
call fcn.0042f45e
add esp, 8
test eax, eax
je 0x416722
mov ecx, dword [0x4518d8]
mov eax, 0x5a4d12c9
imul ecx
mov eax, dword [0x4518e4]
sar edx, 0xa
imul eax, eax, 0x687
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0xb57
sub edx, ecx
lea ecx, [edx + eax - 0x86c]
mov edx, dword [esp + 0x1c]
push edx
push 0
push 0x1f0fff
mov dword [0x4518ec], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x4518e8]
mov esi, eax
mov eax, 0x6614bc37
imul ecx
mov edi, dword [0x4518d8]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x926
sub edx, eax
mov eax, dword [0x4518dc]
sub edx, edi
test esi, esi
lea edi, [edx + eax + 0x1503]
mov dword [str._r_____r_____n], edi
jne 0x416654
push 0x441fcc
call fcn.004257cd
add esp, 4
jmp 0x416708
mov eax, 0x4152dddf
imul ecx
mov eax, dword [0x4518ec]
imul eax, eax, 0xfffff5f8
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov ecx, dword [0x4518f0]
mov dword [esp + 0x10], eax
mov eax, 0x6a79dd7b
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d4]
sub ecx, eax
add ecx, edi
lea eax, [edx + ecx - 0x86c]
push esi
mov dword [0x4518d4], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x4166bf
push 0x441fb8
call fcn.004257cd
add esp, 4
mov ecx, dword [0x4518d8]
mov edi, dword [0x4518dc]
mov eax, dword [0x4518e0]
imul edi, edi, 0xa08
mov edx, ecx
imul eax, eax, 0x86d
imul edx, edx, 0xfad
sub edi, edx
add edi, eax
mov eax, 0x6a79dd7b
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push esi
mov dword [0x4518e8], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x14]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x416776
mov ecx, dword [0x4518e0]
jmp 0x416554
mov ecx, dword [0x4518e0]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
mov ecx, dword [0x4518e4]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x1bfba0af
imul ecx
mov ebp, dword [esp + 0x1c]
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x86d
sub ecx, esi
sub ecx, edx
add ecx, 0x322e
mov dword [0x4518e4], ecx
jmp 0x41677c
mov ecx, dword [0x4518e4]
mov edx, dword [0x4518d8]
imul ecx, ecx, 0x687
mov eax, 0x5a4d12c9
imul edx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0xb57
sub edx, eax
lea eax, [edx + ecx - 0x86c]
push ebx
mov dword [0x4518ec], eax
call edi
mov ecx, dword [0x4518dc]
mov eax, 0x8c03f71d
imul ecx
mov eax, dword [0x4518f4]
add edx, ecx
imul eax, eax, 0x926
mov esi, dword [0x4518e0]
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518ec]
imul edx, edx, 0x1538
add ecx, edx
sub ecx, eax
sub ecx, esi
add ecx, 0x2044
test ebp, ebp
mov dword [0x4518d8], ecx
je 0x41691a
mov ecx, dword [esp + 0x1c]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x4518e8]
mov esi, eax
mov eax, 0x8b081419
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518dc]
mov ebx, eax
mov eax, 0xa5b2ed37
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518ec]
sub eax, ebx
sub eax, edx
test esi, esi
mov edx, dword [0x4518f4]
lea eax, [eax + edx - 0x866]
mov dword [0x4518dc], eax
je 0x41695c
mov ebx, dword [0x4518d8]
mov ebp, dword [0x4518f0]
imul ebx, ebx, 0x1538
mov eax, 0x61dea4df
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x4cf
sub ebx, ecx
add ebx, ebp
push 0
lea eax, [edx + ebx + 0x14d5]
push esi
mov dword [0x4518e0], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x4518d8]
mov eax, 0x5a4d12c9
imul ecx
mov eax, dword [0x4518e4]
sar edx, 0xa
imul eax, eax, 0x687
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0xb57
sub edx, ecx
lea ecx, [edx + eax - 0x86c]
push esi
mov dword [0x4518ec], ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x230]
call fcn.004249c1
add esp, 0x234
ret
mov esi, dword [0x4518f0]
mov eax, 0x8b081419
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e8]
imul edx, edx, 0x1d41
sub edx, eax
mov eax, dword [0x4518d4]
imul eax, eax, 0x14ed
add edx, eax
sub edx, ecx
add edx, 0x1339
mov dword [0x4518f0], edx
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.004249c1
add esp, 0x234
ret