Function at 0x405e10
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x23c
mov eax, dword [0x458190]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x248], eax
xor eax, eax
mov byte [esp + 0x144], 0
mov ecx, 0x40
lea edi, [esp + 0x145]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x250]
push eax
push 0x446fc4
lea ecx, [esp + 0x14c]
push 0x104
push ecx
call fcn.0042b15b
mov edi, dword [0x456824]
mov eax, 0x281003eb
imul edi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x9b24a0b5
imul edi
add edx, edi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
mov edi, eax
mov ebx, dword [0x456830]
mov esi, dword [0x456838]
mov eax, 0x4eff369
imul esi, esi, 0xdc19cb
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, ebp
sub edi, eax
mov eax, 0x6cf5c25f
imul dword [0x456834]
mov ecx, ebx
sar edx, 0x19
imul ecx, ecx, 0x340e3f9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
add edi, esi
add edi, ecx
mov dword [str._r_____r____], edi
mov edi, dword [0x456820]
mov eax, 0x858372bd
imul edi
add edx, edi
imul edi, edi, 0x2b747a3
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
add eax, edi
mov ebp, eax
mov eax, 0x17908a77
imul dword [0x456834]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add ebp, edx
add esp, 0x10
add eax, ebp
mov edi, dword [0x456838]
imul ebx, ebx, 0x33d9a16
sub eax, ebx
mov dword [0x456818], eax
mov eax, 0x9b24a0b5
imul edi
add edx, edi
sar edx, 0x19
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45681c]
mov eax, 0x4eff7f81
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [0x456824]
add eax, edi
sub eax, esi
sub eax, edx
push 0
lea ecx, [eax + ecx + 0x298583a]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45681c], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x456834]
mov edi, dword [0x456828]
mov ebx, eax
mov esi, dword [0x45681c]
mov eax, 0x281003eb
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, edi
imul ecx, ecx, 0x34cd890
sub ecx, eax
mov eax, 0x9b24a0b5
imul esi
add edx, esi
sar edx, 0x19
mov esi, dword [0x456818]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x4eff369
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x33d9718
sub ecx, eax
add ecx, edx
cmp ebx, 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [0x456834], ecx
jne 0x406071
mov esi, dword [0x456820]
mov eax, 0x6cf5c25f
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x858372bd
imul esi
add edx, esi
imul esi, esi, 0x2b747a3
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x17908a77
imul ecx
sar edx, 0x16
sub ebx, edi
mov ecx, edx
add ebx, esi
add ebx, edx
mov edx, dword [0x456830]
imul edx, edx, 0x33d9a16
shr ecx, 0x1f
add ecx, ebx
sub ecx, edx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x456818], ecx
call fcn.0042b0f5
add esp, 4
jmp 0x4066a2
mov ecx, dword [0x45682c]
imul esi, esi, 0x4b2efd8
mov eax, 0x281003eb
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x17
imul ecx, ecx, 0x331ebb8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov ebp, dword [0x456830]
add esi, ecx
mov ecx, dword [0x456820]
mov eax, 0x62a5c8bd
imul ecx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea ecx, [esp + 0x1c]
sub esi, ebp
push ecx
sub esi, 0x2b747a3
push ebx
mov dword [0x456820], esi
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x406140
mov esi, dword [0x456828]
mov edx, dword [0x456818]
imul esi, esi, 0x4b2efd8
mov eax, dword [str._r_____r____]
imul edx, edx, 0x340e3f9
mov ecx, dword [0x45682c]
imul eax, eax, 0x34cd890
add esi, edx
add esi, eax
mov eax, 0x4eff7f81
imul ecx
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456834]
sub esi, ecx
lea eax, [esi + edx - 0x2b747a3]
push ebx
mov dword [0x456824], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4066a2
mov esi, dword [0x456838]
mov eax, 0x2757ae75
imul esi
sar edx, 0x17
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x456824]
mov eax, 0x64db5f4b
imul ecx
sub edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x2b747a3
mov ebp, eax
sub ebp, edi
sub ebp, edx
mov eax, 0x4a704a7b
imul esi
sar edx, 0x16
add ebp, edx
mov eax, edx
mov edx, dword [0x45681c]
imul edx, edx, 0x33d9718
shr eax, 0x1f
add eax, ebp
add eax, edx
mov dword [0x456828], eax
jmp 0x4061b0
mov esi, dword [0x456820]
imul ecx, ecx, 0x2b747a3
mov eax, 0x6cf5c25f
imul dword [0x45681c]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x281003eb
imul esi
imul esi, esi, 0x33d9a16
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x1eadb5a
sub eax, edi
add eax, edx
add eax, ecx
add eax, esi
mov dword [0x45682c], eax
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00434e4e
add esp, 8
test eax, eax
je 0x4065d0
mov ecx, dword [0x45681c]
mov eax, 0x62a5c8bd
imul ecx
mov ecx, dword [0x456824]
imul ecx, ecx, 0x298583a
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub ecx, eax
imul edx, edx, 0x2b747a3
mov eax, dword [0x456828]
imul eax, eax, 0x10ec18f
sub ecx, edx
add ecx, eax
mov dword [0x456830], ecx
mov ecx, dword [esp + 0x24]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x456824]
mov edi, dword [0x456830]
mov esi, eax
mov eax, 0x281003eb
imul ecx
sar edx, 0x17
mov eax, edx
mov ebp, edi
imul ebp, ebp, 0x340e3f9
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x9b24a0b5
imul ecx
add edx, ecx
mov ecx, dword [0x45682c]
sar edx, 0x19
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x4eff369
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456838]
imul edx, edx, 0xdc19cb
sub ebp, ecx
add ebp, edx
test esi, esi
mov dword [str._r_____r____], ebp
jne 0x4062fb
push 0x446f90
call fcn.0042b0f5
add esp, 4
jmp 0x4063d8
mov ebx, dword [0x456834]
imul edi, edi, 0x33d9a16
mov ecx, dword [0x456820]
mov eax, 0x6cf5c25f
imul ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x858372bd
imul ecx
add edx, ecx
imul ecx, ecx, 0x2b747a3
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
add eax, ecx
mov ebp, eax
mov eax, 0x17908a77
imul ebx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
sub ecx, edi
push esi
mov dword [0x456818], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406372
push 0x446f7c
call fcn.0042b0f5
add esp, 4
mov ecx, dword [0x45681c]
mov eax, 0x6cf5c25f
imul ecx
mov ecx, dword [0x456820]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x281003eb
imul ecx
imul ecx, ecx, 0x33d9a16
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x1eadb5a
sub eax, edi
add eax, edx
mov edx, dword [0x456824]
imul edx, edx, 0x2b747a3
add eax, edx
add eax, ecx
push esi
mov dword [0x45682c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
mov ecx, dword [0x456824]
jne 0x4061b0
mov esi, dword [0x456828]
mov edi, dword [esp + 0x14]
mov eax, 0x62a5c8bd
imul ecx, ecx, 0x298583a
imul esi, esi, 0x10ec18f
imul dword [0x45681c]
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
imul edx, edx, 0x2b747a3
sub ecx, eax
sub ecx, edx
add ecx, esi
push ebx
mov dword [0x456830], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x456838]
mov esi, dword [0x456830]
mov eax, 0x9b24a0b5
imul esi, esi, 0x340e3f9
imul ecx
add edx, ecx
imul ecx, ecx, 0xdc19cb
sar edx, 0x19
mov ebx, edx
add esi, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x456824]
sub ebx, ecx
mov ecx, dword [0x45681c]
mov eax, 0x4eff7f81
imul ecx
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
sub ecx, esi
add ecx, 0x298583a
test edi, edi
mov dword [0x45681c], ecx
je 0x40663f
mov eax, dword [esp + 0x24]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x45682c]
mov ecx, dword [0x456818]
mov edi, dword [str._r_____r____]
mov esi, eax
mov eax, 0x281003eb
imul ebx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, ecx
imul ebp, ebp, 0x4b2efd8
mov edx, edi
imul edx, edx, 0x331ebb8
sub ebp, eax
add ebp, edx
mov edx, dword [0x456820]
mov eax, 0x62a5c8bd
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
sub ebp, dword [0x456830]
sub ebp, 0x2b747a3
test esi, esi
mov dword [0x456820], ebp
je 0x4066a2
mov ebp, dword [0x456828]
imul ecx, ecx, 0x340e3f9
imul edi, edi, 0x34cd890
mov eax, 0x4eff7f81
imul ebp, ebp, 0x4b2efd8
imul ebx
add ebp, ecx
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456834]
add ebp, edi
sub ebp, ecx
push 0
lea eax, [edx + ebp - 0x2b747a3]
push esi
mov dword [0x456824], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45681c]
mov eax, 0x62a5c8bd
imul ecx
mov eax, dword [0x45682c]
sar edx, 0x18
imul eax, eax, 0x2b747a3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456824]
imul edx, edx, 0x298583a
sub edx, ecx
mov ecx, dword [0x456828]
imul ecx, ecx, 0x10ec18f
sub edx, eax
add edx, ecx
push esi
mov dword [0x456830], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x238]
call fcn.0042a3c1
add esp, 0x23c
ret
mov esi, dword [0x456838]
mov eax, 0x2757ae75
imul esi
sar edx, 0x17
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x456824]
mov eax, 0x64db5f4b
imul ecx
sub edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x2b747a3
mov ebp, eax
sub ebp, edi
mov edi, dword [esp + 0x24]
sub ebp, edx
mov eax, 0x4a704a7b
imul esi
mov eax, dword [0x45681c]
imul eax, eax, 0x33d9718
sar edx, 0x16
mov esi, edx
shr esi, 0x1f
add ebp, edx
add esi, ebp
add esi, eax
mov dword [0x456828], esi
jmp 0x4063fb
mov edx, dword [0x456834]
mov esi, dword [0x456828]
mov eax, 0x281003eb
imul edx
sar edx, 0x17
mov edi, esi
imul edi, edi, 0x34cd890
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x9b24a0b5
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x4eff369
imul esi
sub edi, ecx
mov ecx, dword [0x456818]
sar edx, 0x14
imul ecx, ecx, 0x33d9718
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov dword [0x456834], edi
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.0042a3c1
add esp, 0x23c
ret