Function at 0x415870
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x234
mov eax, dword [0x451944]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x240], eax
xor eax, eax
mov byte [esp + 0x13c], 0
mov ecx, 0x40
lea edi, [esp + 0x13d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x248]
push eax
push 0x440ff0
lea ecx, [esp + 0x144]
push 0x104
push ecx
call fcn.004254a8
mov esi, dword [0x4508e8]
mov ecx, dword [0x4508f4]
mov edi, dword [0x4508d8]
imul ecx, ecx, 0x185
mov eax, 0xa61fcc17
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
sub edx, eax
sub edx, edi
mov edi, dword [0x4508dc]
lea ebx, [edx + edi + 0xd7]
mov edx, dword [0x4508f0]
mov eax, 0x49e28fbb
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x73d0e82d
imul esi
sub edx, esi
mov esi, dword [0x4508ec]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul esi, esi, 0x1a8
imul edx, edx, 0x315
sub eax, ebp
sub eax, edx
mov edx, dword [0x4508d4]
add eax, ebx
lea eax, [edx + eax - 0x30e]
mov dword [0x4508d4], eax
mov eax, 0x97012e03
imul edi
add edx, edi
mov edi, dword [0x4508e0]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
add esp, 0x10
sub eax, edi
push 0
add eax, 0x4f2
push 2
mov dword [str._r_____r_____n], ebx
mov dword [esp + 0x18], 0
mov dword [0x4508d8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov ecx, dword [0x4508f0]
mov edi, dword [0x4508d4]
mov esi, dword [0x4508e8]
mov eax, 0x197b05f9
imul ecx
mov ebp, dword [0x4508d8]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, edi
imul ecx, ecx, 0x2a4
mov eax, esi
imul eax, eax, 0x1b2
sub ecx, edx
add ecx, eax
sub ecx, ebp
sub ecx, 0x163
cmp ebx, 0xffffffff
mov dword [0x4508f0], ecx
jne 0x415a46
mov eax, 0x49e28fbb
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x73d0e82d
imul esi
sub edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r_____n]
sub eax, ecx
mov ecx, dword [0x4508ec]
imul ecx, ecx, 0x315
sub eax, ecx
add eax, edx
lea edx, [edi + eax - 0x30e]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x4508d4], edx
call fcn.00424e6d
add esp, 4
jmp 0x415f60
mov ecx, dword [0x4508dc]
mov eax, 0x197b05f9
imul esi
sar edx, 6
mov eax, edx
mov edi, dword [0x4508ec]
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x21d814d3
imul ecx
sub edx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4508f4]
sub ecx, esi
sub ecx, edi
lea eax, [ecx + edx - 0x30e]
lea ecx, [esp + 0x14]
push ecx
push ebx
mov dword [0x4508dc], eax
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x415af7
mov ecx, dword [0x4508e8]
mov esi, dword [0x4508e4]
mov eax, 0x60f25deb
imul esi, esi, 0x377
imul ecx
mov ecx, dword [0x4508d8]
sar edx, 8
imul ecx, ecx, 0x1a8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4508f0]
sub esi, eax
add esi, edx
lea edx, [ecx + esi - 0x15c]
push ebx
mov dword [0x4508e0], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x415f60
mov ecx, dword [0x4508e0]
mov esi, dword [0x4508f4]
mov eax, 0x68fed1fd
imul esi, esi, 0x30f
imul ecx
sub edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
sub edi, esi
mov esi, dword [0x4508e4]
mov eax, 0xa8791709
imul esi
add edx, esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edi, edx
lea edx, [eax + edi + 0x456]
mov dword [0x4508e4], edx
lea esp, [esp]
mov edx, dword [0x4508d8]
imul ecx, ecx, 0x30f
mov eax, edx
imul eax, eax, 0x3a7
sub ecx, eax
mov eax, 0x49e28fbb
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4508dc]
imul edx, edx, 0x315
sub ecx, eax
add ecx, edx
lea eax, [esp + 0x13c]
mov dword [0x4508e8], ecx
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.0042eafe
add esp, 8
test eax, eax
je 0x415d23
mov ecx, dword [0x4508d8]
mov esi, dword [0x4508e4]
mov eax, 0xde27eb2d
imul esi, esi, 0x222
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 9
imul ecx, ecx, 0x24e
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [esp + 0x1c]
push eax
push 0
lea edx, [esi + ecx - 0x30e]
push 0x1f0fff
mov dword [0x4508ec], edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x4508e8]
mov esi, eax
mov eax, 0xa61fcc17
imul ecx
mov edi, dword [0x4508d8]
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4508f4]
imul edx, edx, 0x185
sub edx, eax
mov eax, dword [0x4508dc]
sub edx, edi
test esi, esi
lea edi, [edx + eax + 0xd7]
mov dword [str._r_____r_____n], edi
jne 0x415c55
push 0x440fbc
call fcn.00424e6d
add esp, 4
jmp 0x415d09
mov edx, dword [0x4508f0]
mov eax, 0x49e28fbb
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x73d0e82d
imul ecx
sub edx, ecx
mov eax, dword [0x4508d4]
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4508ec]
imul edx, edx, 0x315
sub ecx, ebp
sub ecx, edx
add ecx, edi
lea ecx, [eax + ecx - 0x30e]
push esi
mov dword [0x4508d4], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x415cbd
push 0x440fa8
call fcn.00424e6d
add esp, 4
mov ecx, dword [0x4508d8]
mov edi, dword [0x4508e0]
mov edx, ecx
imul edi, edi, 0x30f
imul edx, edx, 0x3a7
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub edi, edx
mov eax, 0x49e28fbb
imul ecx
mov ecx, dword [0x4508dc]
sar edx, 8
imul ecx, ecx, 0x315
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push esi
mov dword [0x4508e8], edi
call ebp
lea edx, [esp + 0x14]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x415d78
mov ecx, dword [0x4508e0]
jmp 0x415b50
mov ecx, dword [0x4508e0]
mov esi, dword [0x4508f4]
mov eax, 0x68fed1fd
imul esi, esi, 0x30f
imul ecx
sub edx, ecx
mov ecx, dword [0x4508e4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xa8791709
imul ecx
add edx, ecx
sar edx, 8
sub edi, esi
mov ecx, edx
shr ecx, 0x1f
add edi, edx
lea ecx, [ecx + edi + 0x456]
mov edi, dword [esp + 0x1c]
mov dword [0x4508e4], ecx
jmp 0x415d82
mov ecx, dword [0x4508e4]
mov edi, dword [esp + 0x10]
mov esi, dword [0x4508d8]
imul ecx, ecx, 0x222
mov eax, 0xde27eb2d
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0x24e
sub ecx, eax
lea eax, [ecx + edx - 0x30e]
push ebx
mov dword [0x4508ec], eax
call ebp
mov ecx, dword [0x4508dc]
mov esi, dword [0x4508ec]
mov eax, 0x97012e03
imul esi, esi, 0x1a8
imul ecx
add edx, ecx
sar edx, 8
add esi, edx
mov ecx, edx
mov edx, dword [0x4508f4]
imul edx, edx, 0x185
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x4508e0]
sub ecx, edx
sub ecx, esi
add ecx, 0x4f2
test edi, edi
mov dword [0x4508d8], ecx
je 0x415f20
mov eax, dword [esp + 0x1c]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x4508e8]
mov esi, eax
mov eax, 0x197b05f9
imul edi
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x4508dc]
mov eax, 0x21d814d3
imul ecx
sub edx, ecx
mov ecx, dword [0x4508ec]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
sub eax, ecx
test esi, esi
mov ecx, dword [0x4508f4]
lea edx, [eax + ecx - 0x30e]
mov dword [0x4508dc], edx
je 0x415f60
mov ecx, dword [0x4508e4]
mov eax, 0x60f25deb
imul ecx, ecx, 0x377
imul edi
mov edi, dword [0x4508f0]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4508d8]
imul edx, edx, 0x1a8
sub ecx, eax
add ecx, edi
push 0
lea eax, [edx + ecx - 0x15c]
push esi
mov dword [0x4508e0], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x4508d8]
mov edi, dword [0x4508e4]
mov eax, 0xde27eb2d
imul edi, edi, 0x222
imul ecx
add edx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0x24e
sub edi, ecx
lea eax, [edi + edx - 0x30e]
push esi
mov dword [0x4508ec], eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x230]
call fcn.00424061
add esp, 0x234
ret
mov edx, dword [0x4508f0]
mov eax, 0x197b05f9
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4508d4]
imul edx, edx, 0x2a4
sub edx, eax
mov eax, dword [0x4508e8]
imul eax, eax, 0x1b2
add edx, eax
sub edx, ecx
sub edx, 0x163
mov dword [0x4508f0], edx
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.00424061
add esp, 0x234
ret