Function at 0x406370
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x238
mov eax, dword [0x45e640]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24c]
push eax
push 0x44cffc
lea ecx, [esp + 0x148]
push 0x104
push ecx
call fcn.0043073c
mov ebx, dword [0x45ccd4]
mov ecx, dword [0x45cccc]
mov eax, 0x61fd3f09
imul ebx
sar edx, 0x15
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x3b87af8d
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0xe0e0bbb3
imul ebx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, dword [0x45cce8]
mov ebx, eax
imul edi, edi, 0x569052
mov eax, 0x1f1f444d
imul ecx
sar edx, 0x14
mov eax, edx
sub ebx, ebp
add ebx, edx
mov ebp, dword [0x45cce0]
mov edx, ecx
imul ebp, ebp, 0x11c215
mov ecx, dword [0x45ccdc]
imul edx, edx, 0x530e8f
shr eax, 0x1f
imul ecx, ecx, 0x5184aa
add eax, ebx
mov ebx, dword [0x45ccd0]
add edx, edi
add edx, eax
add ecx, edx
mov eax, 0xd0d507c9
imul ebx
add edx, ebx
sar edx, 0x15
add ebp, edx
mov eax, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0x273a49
shr eax, 0x1f
add eax, ebp
add eax, edx
mov dword [esp + 0x24], eax
mov eax, 0xc5432eb
imul ebx
add ecx, esi
add esp, 0x10
sar edx, 0x12
mov dword [str._r_____r____], ecx
mov ebp, edx
mov eax, dword [esp + 0x14]
add eax, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0xa2f64c79
imul ebx
add edx, ebx
mov ebx, dword [0x45cce4]
sar edx, 0x16
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x647e2ce7
imul ebx
imul ebx, ebx, 0x273a49
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x54a93351
imul dword [0x45cccc]
mov eax, dword [0x45cce0]
imul eax, eax, 0x530e8f
mov dword [0x45ccc8], ebp
sar edx, 0x13
mov ebp, edx
add ebx, edx
shr ebp, 0x1f
add ebp, ebx
add ebp, eax
mov eax, 0x647e2ce7
imul dword [0x45ccd4]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
sub eax, edi
sub eax, ecx
push 0
lea ecx, [eax + esi + 0x34e0fb]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45cccc], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edx, dword [0x45ccd4]
mov ebx, dword [0x45ccc8]
mov esi, dword [str._r_____r____]
mov ebp, eax
lea edi, [ebx + edx]
mov eax, 0x26bae4e5
imul edi, edi, 0x1830cc
imul esi
sar edx, 0x13
mov ecx, edx
add edi, edx
shr ecx, 0x1f
add ecx, edi
mov edi, dword [0x45ccd8]
mov eax, 0x3b87af8d
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce4]
sub ecx, eax
mov eax, 0x1f1f444d
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x61fd3f09
imul edi
sar edx, 0x15
imul esi, esi, 0x5399dc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
cmp ebp, 0xffffffff
mov dword [0x45cce4], ecx
jne 0x406640
mov esi, dword [0x45ccd0]
imul ebx, ebx, 0x273a49
mov edi, dword [0x45cce0]
mov eax, 0xd0d507c9
imul edi, edi, 0x11c215
imul esi
add edx, esi
sar edx, 0x15
add edi, edx
mov ebp, edx
mov eax, 0xc5432eb
imul esi
sar edx, 0x12
shr ebp, 0x1f
add ebp, edi
mov edi, edx
add ebp, ebx
add ebp, edx
mov eax, 0xa2f64c79
imul esi
add edx, esi
sar edx, 0x16
shr edi, 0x1f
mov esi, edx
add edi, ebp
add edi, edx
mov eax, 0x647e2ce7
imul ecx
sar edx, 0x15
mov ecx, edx
shr esi, 0x1f
shr ecx, 0x1f
add ecx, edx
add esi, edi
sub esi, ecx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45ccc8], esi
call fcn.004306d6
add esp, 4
jmp 0x406e33
mov edx, dword [0x45ccd0]
imul ebx, ebx, 0x5184aa
mov eax, 0x26bae4e5
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xd0d507c9
imul edi
add edx, edi
imul edi, edi, 0x839c4a
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
sub eax, esi
add eax, edi
mov esi, eax
mov eax, 0x1f1f444d
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x569052
sub esi, eax
add esi, edx
add esi, ebx
lea eax, [esp + 0x18]
sub esi, ecx
push eax
sub esi, 0x273a49
push ebp
mov dword [0x45ccd0], esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
mov eax, 0x54a93351
jne 0x40673a
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ccd8]
mov esi, dword [0x45ccdc]
lea edi, [edx + ecx]
imul esi
imul ecx, ecx, 0x5399dc
imul edi, edi, 0x5184aa
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x61fd3f09
imul esi
imul esi, esi, 0x530e8f
sar edx, 0x15
mov eax, edx
add edi, edx
shr eax, 0x1f
add eax, edi
add ecx, dword [0x45cce0]
add ecx, eax
lea ecx, [esi + ecx - 0x273a49]
push ebp
mov dword [0x45ccd4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406e33
mov ecx, dword [0x45cce0]
mov esi, dword [0x45cce8]
imul ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [0x45ccc8]
imul eax, eax, 0x5399dc
mov edi, esi
imul edi, edi, 0x273a49
mov edx, ecx
imul edx, edx, 0x1830cc
sub ebx, edi
add ebx, edx
mov edx, dword [0x45ccd4]
add ebx, eax
mov eax, 0x61fd3f09
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbd455a63
imul esi
add edx, esi
sar edx, 0x16
add ebx, edx
mov edi, edx
mov eax, 0xc5432eb
imul esi
sar edx, 0x12
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, ebx
add eax, edx
sub edi, eax
mov dword [0x45ccd8], edi
lea esp, [esp]
mov esi, dword [0x45cccc]
imul ecx, ecx, 0x6489e9
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
mov edi, dword [0x45cce4]
imul eax, eax, 0x273a49
lea ebx, [edx + esi]
imul ebx, ebx, 0x44ce3d
add ebx, eax
mov eax, 0x1f1f444d
imul edi
sar edx, 0x14
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x61fd3f09
imul edi
sar edx, 0x15
mov edi, edx
add ebx, edx
mov eax, 0x647e2ce7
imul esi
shr edi, 0x1f
sar edx, 0x15
add edi, ebx
add edi, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
sub edi, ecx
push eax
mov dword [0x45ccdc], edi
call fcn.0043a46e
add esp, 8
test eax, eax
je 0x406aa1
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
lea esi, [edx + ecx]
mov edx, dword [0x45cccc]
imul esi, esi, 0x34e0fb
mov eax, 0x26bae4e5
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3b87af8d
imul ecx
mov eax, dword [0x45ccd4]
sar edx, 0x14
imul eax, eax, 0x569052
mov ecx, edx
add esi, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x273a49
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
mov edx, dword [0x45ccd8]
imul edx, edx, 0x6489e9
sub ecx, eax
mov eax, dword [esp + 0x20]
push eax
push 0
add ecx, edx
push 0x1f0fff
mov dword [0x45cce0], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45cccc]
mov esi, eax
mov edi, dword [0x45ccd4]
mov eax, 0x3b87af8d
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xe0e0bbb3
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov dword [esp + 0x10], eax
mov eax, 0x1f1f444d
imul ecx
imul ecx, ecx, 0x530e8f
mov eax, dword [esp + 0x10]
sar edx, 0x14
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x61fd3f09
imul edi
sar edx, 0x15
add ebx, edx
mov eax, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x569052
shr eax, 0x1f
add eax, ebx
add eax, edx
add eax, ecx
mov ecx, dword [0x45ccdc]
imul ecx, ecx, 0x5184aa
add eax, ecx
test esi, esi
mov dword [str._r_____r____], eax
jne 0x406971
push 0x44cfc8
call fcn.004306d6
add esp, 4
jmp 0x406a83
mov ecx, dword [0x45ccd0]
mov edi, dword [0x45cce0]
mov eax, 0xd0d507c9
imul edi, edi, 0x11c215
imul ecx
add edx, ecx
sar edx, 0x15
add edi, edx
mov ebx, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0x273a49
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0xc5432eb
imul ecx
sar edx, 0x12
add ebx, edx
mov edi, edx
mov eax, 0xa2f64c79
imul ecx
add edx, ecx
mov ecx, dword [0x45cce4]
sar edx, 0x16
shr edi, 0x1f
add edi, ebx
mov ebx, edx
add edi, edx
mov eax, 0x647e2ce7
imul ecx
sar edx, 0x15
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add eax, edx
add ebx, edi
sub ebx, eax
push esi
mov dword [0x45ccc8], ebx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406a05
push 0x44cfb4
call fcn.004306d6
add esp, 4
mov ecx, dword [0x45cccc]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
mov edi, dword [0x45cce4]
imul eax, eax, 0x273a49
lea ebx, [edx + ecx]
imul ebx, ebx, 0x44ce3d
add ebx, eax
mov eax, 0x1f1f444d
imul edi
sar edx, 0x14
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x61fd3f09
imul edi
sar edx, 0x15
mov edi, edx
add ebx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x6489e9
shr edi, 0x1f
add edi, ebx
add edi, edx
mov eax, 0x647e2ce7
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push esi
mov dword [0x45ccdc], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406b31
mov ecx, dword [0x45cce0]
jmp 0x4067c0
mov ecx, dword [0x45cce0]
mov esi, dword [0x45cce8]
mov eax, 0x54a93351
imul ecx
imul ecx, ecx, 0x1830cc
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov edi, esi
imul edi, edi, 0x273a49
sub ebx, edi
mov edi, dword [0x45ccd4]
add ebx, ecx
mov ecx, dword [0x45ccc8]
mov eax, 0x61fd3f09
imul ecx, ecx, 0x5399dc
imul edi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, ecx
sub ebx, eax
mov eax, 0xbd455a63
imul esi
add edx, esi
sar edx, 0x16
add ebx, edx
mov ecx, edx
mov eax, 0xc5432eb
imul esi
sar edx, 0x12
mov eax, edx
shr ecx, 0x1f
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
add ecx, ebx
sub ecx, eax
mov dword [0x45ccd8], ecx
mov dword [esp + 0x14], edx
jmp 0x406b43
mov edi, dword [0x45ccd4]
mov esi, dword [0x45cce8]
mov ecx, dword [0x45ccd8]
mov eax, dword [0x45ccd0]
imul edi, edi, 0x569052
imul ecx, ecx, 0x6489e9
mov edx, dword [0x45cccc]
lea ebx, [eax + esi]
mov eax, 0x26bae4e5
imul ebx, ebx, 0x34e0fb
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3b87af8d
imul esi
sar edx, 0x14
mov eax, edx
add ebx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x273a49
shr eax, 0x1f
add eax, ebx
sub eax, edx
sub eax, edi
add eax, ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x45cce0], eax
call ebp
mov ecx, dword [0x45cccc]
mov edi, dword [0x45cce4]
mov eax, 0x54a93351
imul ecx
mov esi, edi
imul esi, esi, 0x273a49
sar edx, 0x13
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45ccd4]
mov eax, 0x61fd3f09
imul esi
mov eax, dword [0x45cce0]
sar edx, 0x15
imul eax, eax, 0x530e8f
add ecx, edx
mov ebx, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x569052
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [str._r_____r____]
sub ebx, edx
add ebx, eax
mov eax, 0x647e2ce7
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, ecx
add eax, 0x34e0fb
mov dword [0x45cccc], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x406dc6
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45ccd0]
mov edi, eax
mov ebx, dword [0x45ccd8]
mov eax, 0x26bae4e5
imul ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xd0d507c9
imul ebx
add edx, ebx
mov esi, dword [0x45ccdc]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, ebx
imul ecx, ecx, 0x839c4a
add eax, ecx
mov ecx, eax
mov eax, 0x1f1f444d
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce8]
sub ecx, eax
imul edx, edx, 0x569052
mov eax, dword [0x45ccc8]
imul eax, eax, 0x5184aa
add ecx, edx
add ecx, eax
sub ecx, dword [0x45cce4]
sub ecx, 0x273a49
test edi, edi
mov dword [0x45ccd0], ecx
je 0x406e33
mov ecx, dword [str._r_____r____]
mov eax, 0x54a93351
imul esi
add ebx, ecx
imul ecx, ecx, 0x5399dc
sar edx, 0x13
imul ebx, ebx, 0x5184aa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x61fd3f09
imul esi
imul esi, esi, 0x530e8f
sar edx, 0x15
mov eax, edx
add ebx, edx
mov edx, dword [0x45cce0]
shr eax, 0x1f
add ecx, edx
add eax, ebx
add ecx, eax
push 0
lea ecx, [esi + ecx - 0x273a49]
push edi
mov dword [0x45ccd4], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
lea esi, [edx + ecx]
mov edx, dword [0x45cccc]
imul esi, esi, 0x34e0fb
mov eax, 0x26bae4e5
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3b87af8d
imul ecx
mov eax, dword [0x45ccd4]
sar edx, 0x14
imul eax, eax, 0x569052
mov ecx, edx
add esi, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x273a49
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
mov edx, dword [0x45ccd8]
imul edx, edx, 0x6489e9
sub ecx, eax
add ecx, edx
push edi
mov dword [0x45cce0], ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.0042fa01
add esp, 0x238
ret
mov eax, dword [0x45ccc8]
add esi, eax
mov eax, 0x26bae4e5
imul esi, esi, 0x1830cc
imul ecx
imul ecx, ecx, 0x5399dc
sar edx, 0x13
mov ebx, edx
add esi, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45ccd8]
mov eax, 0x3b87af8d
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1f1f444d
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x61fd3f09
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
mov dword [0x45cce4], ebx
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.0042fa01
add esp, 0x238
ret