Function at 0x405430
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x456fc0]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24c]
push eax
push 0x445f7c
lea ecx, [esp + 0x148]
push 0x104
push ecx
call fcn.00429dbc
mov ebp, dword [0x45569c]
mov ebx, dword [0x455690]
mov eax, 0x59da2e6b
imul ebp
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov esi, dword [0x4556a8]
mov eax, 0x9cbd99d5
imul esi, esi, 0xaef
imul ebx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, dword [0x45568c]
imul eax, eax, 0x140f
add eax, esi
mov dword [esp + 0x20], eax
mov eax, 0x4700d503
imul dword [0x455694]
mov eax, dword [esp + 0x20]
sar edx, 9
sub edi, ecx
add eax, edi
mov edi, dword [0x4556a0]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, eax
mov eax, edi
imul eax, eax, 0x16cb
mov dword [esp + 0x20], eax
mov eax, 0x5e17e411
imul ebp
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov ebp, eax
mov eax, dword [esp + 0x20]
sub ebp, eax
mov eax, 0x6d62dd3b
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0x5cc
sub ebp, eax
mov eax, dword [0x455688]
sub ebp, edx
add ebp, ecx
add esp, 0x10
mov dword [str._r_____r____], ecx
add eax, ebp
mov ecx, dword [0x45568c]
imul edi, edi, 0x140f
mov dword [0x455688], eax
mov eax, 0x903bb8bb
imul ecx
add edx, ecx
sar edx, 0xb
add edi, edx
mov ecx, edx
mov eax, 0x4700d503
imul ebx
shr ecx, 0x1f
sar edx, 9
add ecx, edi
mov edi, dword [0x455694]
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
sub eax, esi
sub eax, edi
push 0
add eax, 0x11d7
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45568c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x45569c]
mov ebp, eax
mov eax, 0x59da2e6b
imul esi
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x4556a4]
mov eax, 0x9cbd99d5
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
sub ecx, edi
mov edi, dword [0x455688]
mov edx, edi
imul edx, edx, 0xe33
mov eax, esi
imul eax, eax, 0x736
add ecx, edx
mov edx, dword [0x45568c]
add ecx, eax
mov eax, 0x4700d503
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp ebp, 0xffffffff
mov dword [0x4556a4], ecx
jne 0x405684
mov eax, 0x5e17e411
imul esi
mov ebx, dword [0x4556a0]
sar edx, 0xb
imul ebx, ebx, 0x16cb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x6d62dd3b
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455690]
imul edx, edx, 0x5cc
sub esi, ebx
mov ebx, dword [str._r_____r____]
sub esi, ecx
sub esi, edx
add esi, ebx
add edi, esi
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x455688], edi
call fcn.00429d56
add esp, 4
jmp 0x405c99
mov ebx, dword [0x4556a8]
imul edi, edi, 0x12b9
mov ecx, dword [0x455690]
imul ebx, ebx, 0x14a2
mov eax, 0x6342662b
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1cb32649
imul ecx
mov eax, dword [0x4556a0]
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ebx, edi
add ecx, edx
sub ebx, ecx
lea edx, [esp + 0x18]
sub ebx, eax
push edx
sub ebx, 0x5cc
push ebp
mov dword [0x455690], ebx
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40574c
mov esi, dword [0x45568c]
mov eax, dword [0x455698]
imul esi, esi, 0x140f
mov ecx, dword [0x45569c]
imul eax, eax, 0x12b9
add esi, eax
mov eax, 0x903bb8bb
imul ecx
add edx, ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x736
sub esi, ecx
add esi, dword [0x4556a4]
lea eax, [edx + esi - 0x5cc]
push ebp
mov dword [0x455694], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405c99
mov esi, dword [0x4556a8]
mov edi, dword [0x4556a0]
mov eax, 0xcc33a611
imul edi, edi, 0xe33
imul esi
add edx, esi
imul esi, esi, 0x5cc
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x455698]
mov eax, 0x5da803a9
imul ecx
mov ecx, dword [0x455694]
sar edx, 0xa
add edi, edx
mov ebx, edx
mov eax, 0x4700d503
imul ecx
sar edx, 9
shr ebx, 0x1f
mov eax, edx
shr eax, 0x1f
add ebx, edi
add eax, edx
sub ebx, eax
sub ebx, esi
mov dword [0x455698], ebx
jmp 0x4057c0
mov esi, dword [0x45568c]
mov edi, dword [0x455690]
mov edx, esi
imul edi, edi, 0x16cb
imul edx, edx, 0x15c4
add edi, edx
mov eax, 0x6342662b
imul ecx
imul ecx, ecx, 0x5cc
sar edx, 0xb
mov ebx, edx
add edi, edx
mov eax, 0x6d62dd3b
imul esi
sar edx, 0xb
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add eax, edx
add ebx, edi
sub ebx, eax
add ebx, ecx
lea ecx, [esp + 0x140]
push ecx
lea edx, [esp + 0x40]
push edx
mov dword [0x45569c], ebx
call fcn.00433ade
add esp, 8
test eax, eax
je 0x4059ed
mov ecx, dword [0x45568c]
mov eax, 0x1cb32649
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 9
imul ecx, ecx, 0x11d7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
imul edx, edx, 0x509
sub ecx, eax
mov eax, dword [esp + 0x20]
push eax
push 0
add ecx, edx
push 0x1f0fff
mov dword [0x4556a0], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x45569c]
mov esi, eax
mov edi, dword [0x455690]
mov eax, 0x59da2e6b
imul ebx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x9cbd99d5
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a8]
sub eax, ecx
imul edx, edx, 0xaef
mov ecx, dword [0x45568c]
imul ecx, ecx, 0x140f
add eax, ecx
mov ecx, dword [0x455694]
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x4700d503
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
test esi, esi
mov dword [str._r_____r____], ecx
jne 0x405903
push 0x445f48
call fcn.00429d56
add esp, 4
jmp 0x4059d3
mov eax, dword [0x4556a0]
imul edi, edi, 0x5cc
imul eax, eax, 0x16cb
mov dword [esp + 0x10], eax
mov eax, 0x5e17e411
imul ebx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov ebx, eax
mov eax, dword [esp + 0x10]
sub ebx, eax
mov eax, 0x6d62dd3b
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, edi
mov edi, dword [0x455688]
add ebx, ecx
add edi, ebx
push esi
mov dword [0x455688], edi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x405974
push 0x445f34
call fcn.00429d56
add esp, 4
mov edi, dword [0x45568c]
mov ebx, dword [0x455690]
imul ebx, ebx, 0x16cb
mov ecx, edi
imul ecx, ecx, 0x15c4
add ebx, ecx
mov ecx, dword [0x455694]
mov eax, 0x6342662b
imul ecx
imul ecx, ecx, 0x5cc
sar edx, 0xb
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x6d62dd3b
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
push esi
mov dword [0x45569c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405a5a
mov ecx, dword [0x455694]
jmp 0x4057c0
mov esi, dword [0x4556a8]
mov edi, dword [0x4556a0]
mov ecx, dword [0x455698]
imul edi, edi, 0xe33
mov eax, 0xcc33a611
imul esi
add edx, esi
imul esi, esi, 0x5cc
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x5da803a9
imul ecx
sar edx, 0xa
add edi, edx
mov ecx, edx
mov edx, dword [0x455694]
mov eax, 0x4700d503
imul edx
sar edx, 9
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, edi
add eax, edx
sub ecx, eax
sub ecx, esi
mov esi, dword [esp + 0x20]
mov dword [0x455698], ecx
jmp 0x405a64
mov ecx, dword [0x455698]
mov esi, dword [esp + 0x14]
mov edx, dword [0x45568c]
imul ecx, ecx, 0x509
mov eax, 0x1cb32649
imul edx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x11d7
sub edx, eax
add edx, ecx
push ebp
mov dword [0x4556a0], edx
call edi
mov ecx, dword [0x45568c]
mov ebx, dword [0x4556a0]
mov eax, 0x903bb8bb
imul ebx, ebx, 0x140f
imul ecx
mov eax, dword [0x4556a8]
add edx, ecx
imul eax, eax, 0xaef
mov ecx, dword [0x455690]
sar edx, 0xb
mov ebp, edx
add ebx, edx
shr ebp, 0x1f
add ebp, ebx
mov ebx, dword [0x455694]
sub ebp, eax
mov eax, 0x4700d503
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
sub ecx, ebx
add ecx, 0x11d7
test esi, esi
mov dword [0x45568c], ecx
je 0x405c36
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45569c]
mov ebx, dword [0x4556a8]
mov esi, eax
imul ebx, ebx, 0x14a2
mov eax, 0x6342662b
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
imul edx, edx, 0x12b9
sub ebx, eax
mov ebp, dword [0x4556a0]
add ebx, edx
mov edx, dword [0x455690]
mov eax, 0x1cb32649
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, ebp
sub ebx, 0x5cc
test esi, esi
mov dword [0x455690], ebx
je 0x405c99
mov ebx, dword [0x45568c]
mov edx, dword [0x455698]
imul ebx, ebx, 0x140f
imul edx, edx, 0x12b9
add ebx, edx
mov eax, 0x903bb8bb
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xb
imul ecx, ecx, 0x736
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub ebx, eax
add ebx, edx
push 0
lea edx, [ecx + ebx - 0x5cc]
push esi
mov dword [0x455694], edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45568c]
mov eax, 0x1cb32649
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 9
imul ecx, ecx, 0x11d7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
imul edx, edx, 0x509
sub ecx, eax
add ecx, edx
push esi
mov dword [0x4556a0], ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.0042904d
add esp, 0x238
ret
mov esi, dword [0x45569c]
mov eax, 0x59da2e6b
imul esi
imul esi, esi, 0x736
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov edi, eax
mov eax, 0x9cbd99d5
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
imul edx, edx, 0xe33
mov ebx, eax
sub ebx, edi
add ebx, edx
mov eax, 0x4700d503
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add ebx, esi
add eax, edx
sub ebx, eax
mov dword [0x4556a4], ebx
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.0042904d
add esp, 0x238
ret