Function at 0x406440
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x238
mov eax, dword [0x45e540]
mov edx, dword [esp + 0x23c]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44d064
stosb byte es:[edi], al
lea eax, [esp + 0x148]
push 0x104
push eax
call fcn.00430bbc
mov ecx, dword [0x45cbd4]
mov ebx, dword [0x45cbcc]
mov eax, 0x331da7cd
imul ecx
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x98eb62a3
imul ebx
add edx, ebx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, ebx
imul ebp, ebp, 0x898dd
sub ebp, eax
mov eax, 0x220de0d
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x220de0d
imul ebx
sub ebp, ecx
mov ecx, dword [0x45cbdc]
sar edx, 0xd
imul ecx, ecx, 0xa0576
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, esi
add eax, ebp
mov ebp, dword [0x45cbd0]
add ecx, eax
mov edi, dword [0x45cbe8]
mov eax, 0x99335f19
imul edi, edi, 0x857ee
imul ebp
add edx, ebp
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x24], eax
mov eax, 0x4d49d1e9
imul ebp
mov eax, dword [esp + 0x24]
sar edx, 0x11
mov ebp, edx
add eax, edx
mov edx, dword [0x45cbc8]
shr ebp, 0x1f
add ecx, edi
add esp, 0x10
add ebp, eax
imul edx, edx, 0x69fe2
mov dword [str._r_____r____], ecx
add ebp, edx
mov eax, 0x3b8e0831
imul dword [0x45cbd0]
sar edx, 0x11
add ebp, edx
mov eax, edx
mov edx, dword [0x45cbe0]
shr eax, 0x1f
imul edx, edx, 0x50c98
add eax, ebp
sub eax, edx
mov ebp, eax
mov eax, 0x662e995b
imul dword [0x45cbe4]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x63b1cbb5
imul ebx
mov eax, dword [0x45cbe4]
imul eax, eax, 0x69fe2
sar edx, 0x12
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, eax
mov eax, dword [0x45cbe0]
imul eax, eax, 0x898dd
add ebx, eax
mov eax, 0x662e995b
imul dword [0x45cbd4]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, edi
sub eax, ecx
push 0
lea ecx, [eax + esi + 0x6a03b]
push 2
mov dword [0x45cbc8], ebp
mov dword [esp + 0x1c], 0
mov dword [0x45cbcc], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edx, dword [0x45cbd4]
mov ebx, dword [0x45cbc8]
mov edi, dword [0x45cbd8]
mov ebp, eax
lea eax, [ebx + edx]
imul eax, eax, 0xa4579
mov ecx, eax
mov esi, dword [str._r_____r____]
mov eax, 0x98eb62a3
imul edi
add edx, edi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x9a8b8787
imul esi
add edx, esi
sar edx, 0x12
mov eax, ecx
add eax, edx
mov ecx, edx
mov edx, dword [0x45cbe4]
shr ecx, 0x1f
add ecx, eax
mov eax, 0x220de0d
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
imul esi, esi, 0xa0437
sub ecx, eax
mov eax, 0x331da7cd
imul edi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
cmp ebp, 0xffffffff
mov dword [0x45cbe4], ecx
jne 0x406717
mov esi, dword [0x45cbd0]
imul ebx, ebx, 0x69fe2
mov eax, 0x99335f19
imul esi
add edx, esi
sar edx, 0x13
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x4d49d1e9
imul esi
sar edx, 0x11
mov ebp, edx
add edi, edx
mov eax, 0x3b8e0831
imul esi
shr ebp, 0x1f
sar edx, 0x11
add ebp, edi
mov esi, edx
add ebp, ebx
add ebp, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x50c98
shr esi, 0x1f
add esi, ebp
sub esi, edx
mov eax, 0x662e995b
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45cbc8], esi
call fcn.00430b56
add esp, 4
jmp 0x406f02
mov edx, dword [0x45cbd0]
imul ebx, ebx, 0xa0576
mov esi, dword [0x45cbe8]
mov eax, 0x9a8b8787
imul esi, esi, 0x857ee
imul edx
add edx, dword [0x45cbd0]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4d49d1e9
imul edi
imul edi, edi, 0xf08ec
sar edx, 0x11
add esi, edx
mov eax, edx
mov edx, dword [0x45cbdc]
shr eax, 0x1f
add eax, esi
add eax, edi
mov esi, eax
mov eax, 0x220de0d
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ebx
sub esi, ecx
lea ecx, [esp + 0x18]
push ecx
sub esi, 0x69fe2
push ebp
mov dword [0x45cbd0], esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x406817
mov esi, dword [0x45cbdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45cbd8]
lea edi, [edx + ecx]
imul ecx, ecx, 0xa0437
mov eax, 0x63b1cbb5
imul edi, edi, 0xa0576
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x898dd
sub edi, eax
add edi, edx
mov eax, 0x331da7cd
imul esi
mov esi, dword [0x45cbe0]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, esi
add eax, edi
lea ecx, [ecx + eax - 0x69fe2]
push ebp
mov dword [0x45cbd4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406f02
mov esi, dword [0x45cbe8]
mov ecx, dword [0x45cbe0]
mov eax, 0x7abb0ab
imul esi
sar edx, 0xe
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x63b1cbb5
imul ecx
sar edx, 0x12
add edi, edx
mov ebx, edx
mov edx, ecx
imul edx, edx, 0xa4579
mov eax, esi
imul eax, eax, 0x69fe2
shr ebx, 0x1f
add ebx, edi
add ebx, edx
sub ebx, eax
mov eax, 0x3b8e0831
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0xa0437
sub ebx, eax
add ebx, edx
mov edx, dword [0x45cbd4]
mov eax, 0x331da7cd
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov dword [0x45cbd8], ebx
jmp 0x4068a0
mov esi, dword [0x45cbcc]
imul ecx, ecx, 0xd5e3b
mov edx, dword [0x45cbd0]
mov eax, dword [0x45cbdc]
lea edi, [edx + esi]
imul eax, eax, 0x69fe2
imul edi, edi, 0xd6486
add edi, ecx
mov ecx, dword [0x45cbe4]
add edi, eax
mov eax, 0x220de0d
imul ecx
sar edx, 0xd
mov ebx, edx
add edi, edx
mov eax, 0x662e995b
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebx, 0x1f
add ebx, edi
sub ebx, eax
mov eax, 0x331da7cd
imul ecx
sar edx, 0x11
mov ecx, edx
add ebx, edx
lea edx, [esp + 0x140]
shr ecx, 0x1f
push edx
lea eax, [esp + 0x40]
add ecx, ebx
push eax
mov dword [0x45cbdc], ecx
call fcn.0043a98e
add esp, 8
test eax, eax
je 0x406b7a
mov ecx, dword [0x45cbe8]
mov edx, dword [0x45cbd0]
lea esi, [edx + ecx]
mov eax, 0x98eb62a3
imul esi, esi, 0x6a03b
imul ecx
mov eax, dword [0x45cbd8]
add edx, ecx
imul eax, eax, 0xd5e3b
mov ecx, dword [0x45cbd4]
sar edx, 0x13
imul ecx, ecx, 0x857ee
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, eax
sub edi, ecx
mov ecx, dword [0x45cbcc]
mov eax, 0x9a8b8787
imul ecx
add edx, ecx
mov ecx, dword [0x45cbdc]
sar edx, 0x12
imul ecx, ecx, 0x69fe2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
push edx
sub edi, eax
push 0
sub edi, ecx
push 0x1f0fff
mov dword [0x45cbe0], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45cbcc]
mov esi, eax
mov ebx, dword [0x45cbe8]
mov eax, 0x98eb62a3
imul ebx, ebx, 0x857ee
imul ecx
add edx, ecx
mov edi, dword [0x45cbd4]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x898dd
sub ebx, eax
add ebx, edx
mov eax, 0x220de0d
imul edi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x220de0d
imul ecx
sar edx, 0xd
add ebx, edx
mov ecx, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0xa0576
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
mov eax, 0x331da7cd
imul edi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
test esi, esi
mov dword [str._r_____r____], eax
jne 0x406a4d
push 0x44d030
call fcn.00430b56
add esp, 4
jmp 0x406b5c
mov ecx, dword [0x45cbd0]
mov eax, 0x99335f19
imul ecx
add edx, ecx
sar edx, 0x13
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x4d49d1e9
imul ecx
sar edx, 0x11
add edi, edx
mov ebx, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0x69fe2
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0x3b8e0831
imul ecx
mov eax, dword [0x45cbe0]
mov ecx, dword [0x45cbe4]
imul eax, eax, 0x50c98
sar edx, 0x11
mov edi, edx
add ebx, edx
shr edi, 0x1f
add edi, ebx
sub edi, eax
mov eax, 0x662e995b
imul ecx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push esi
mov dword [0x45cbc8], edi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406ade
push 0x44d01c
call fcn.00430b56
add esp, 4
mov ecx, dword [0x45cbcc]
mov edx, dword [0x45cbd0]
mov eax, dword [0x45cbe0]
mov edi, dword [0x45cbe4]
imul eax, eax, 0xd5e3b
lea ebx, [edx + ecx]
mov edx, dword [0x45cbdc]
imul ebx, ebx, 0xd6486
add ebx, eax
imul edx, edx, 0x69fe2
add ebx, edx
mov eax, 0x220de0d
imul edi
sar edx, 0xd
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x662e995b
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x331da7cd
imul edi
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
push esi
mov dword [0x45cbdc], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x18]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406c06
mov ecx, dword [0x45cbe0]
jmp 0x4068a0
mov esi, dword [0x45cbe8]
mov edi, dword [0x45cbe0]
mov eax, 0x7abb0ab
imul esi
sar edx, 0xe
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x63b1cbb5
imul edi
imul edi, edi, 0xa4579
sar edx, 0x12
mov ecx, edx
add ebx, edx
mov eax, esi
imul eax, eax, 0x69fe2
shr ecx, 0x1f
add ecx, ebx
add ecx, edi
sub ecx, eax
mov eax, 0x3b8e0831
imul esi
mov edi, dword [0x45cbd4]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0xa0437
sub ecx, eax
add ecx, edx
mov eax, 0x331da7cd
imul edi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
sub ecx, eax
mov dword [0x45cbd8], ecx
mov dword [esp + 0x14], edx
jmp 0x406c18
mov edi, dword [0x45cbd4]
mov esi, dword [0x45cbe8]
mov ecx, dword [0x45cbd8]
mov eax, dword [0x45cbd0]
imul ecx, ecx, 0xd5e3b
imul edi, edi, 0x857ee
lea ebx, [eax + esi]
mov eax, 0x98eb62a3
imul ebx, ebx, 0x6a03b
imul esi
add edx, esi
sar edx, 0x13
mov esi, edx
add ebx, edx
shr esi, 0x1f
add esi, ebx
add esi, ecx
mov ecx, dword [0x45cbcc]
mov eax, 0x9a8b8787
imul ecx
add edx, ecx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0x69fe2
sub esi, edi
sub esi, ecx
sub esi, edx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x45cbe0], esi
call ebp
mov ecx, dword [0x45cbcc]
mov esi, dword [0x45cbe8]
mov edi, dword [0x45cbe4]
imul esi, esi, 0x857ee
mov eax, 0x63b1cbb5
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x45cbe0]
imul eax, eax, 0x898dd
mov edx, edi
imul edx, edx, 0x69fe2
sub ecx, esi
mov esi, dword [0x45cbd4]
add ecx, edx
add ecx, eax
mov eax, 0x662e995b
imul esi
sar edx, 0x12
add ecx, edx
mov ebx, edx
mov eax, 0x331da7cd
imul esi
shr ebx, 0x1f
sar edx, 0x11
add ebx, ecx
mov ecx, dword [str._r_____r____]
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, ecx
add eax, 0x6a03b
mov dword [0x45cbcc], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x406e8f
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45cbd0]
mov esi, dword [0x45cbe8]
mov edi, eax
imul esi, esi, 0x857ee
mov ebx, dword [0x45cbd8]
mov eax, 0x9a8b8787
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4d49d1e9
imul ebx
sar edx, 0x11
add esi, edx
mov ecx, edx
mov edx, ebx
imul edx, edx, 0xf08ec
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45cbdc]
add ecx, edx
mov eax, 0x220de0d
imul esi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0xa0576
sub ecx, eax
mov eax, dword [0x45cbe4]
add ecx, edx
sub ecx, eax
sub ecx, 0x69fe2
test edi, edi
mov dword [0x45cbd0], ecx
je 0x406f02
mov ecx, dword [str._r_____r____]
mov eax, 0x63b1cbb5
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, ecx
imul ecx, ecx, 0xa0437
imul ebx, ebx, 0xa0576
mov edx, esi
imul edx, edx, 0x898dd
sub ebx, eax
add ebx, edx
mov eax, 0x331da7cd
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, dword [0x45cbe0]
add eax, ebx
push 0
lea ecx, [ecx + eax - 0x69fe2]
push edi
mov dword [0x45cbd4], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45cbe8]
mov edx, dword [0x45cbd0]
lea esi, [edx + ecx]
mov eax, 0x98eb62a3
imul esi, esi, 0x6a03b
imul ecx
mov eax, dword [0x45cbd8]
add edx, ecx
imul eax, eax, 0xd5e3b
mov ecx, dword [0x45cbd4]
sar edx, 0x13
imul ecx, ecx, 0x857ee
mov ebx, edx
shr ebx, 0x1f
add esi, edx
add ebx, esi
add ebx, eax
sub ebx, ecx
mov ecx, dword [0x45cbcc]
mov eax, 0x9a8b8787
imul ecx
add edx, ecx
mov ecx, dword [0x45cbdc]
sar edx, 0x12
imul ecx, ecx, 0x69fe2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, ecx
push edi
mov dword [0x45cbe0], ebx
call ebp
mov eax, 1
jmp 0x406f04
mov edx, dword [0x45cbc8]
lea ebx, [edx + esi]
mov esi, dword [0x45cbd8]
imul ebx, ebx, 0xa4579
mov eax, 0x98eb62a3
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x9a8b8787
imul ecx
add edx, ecx
imul ecx, ecx, 0xa0437
sar edx, 0x12
add ebx, edx
mov ebp, edx
mov eax, 0x220de0d
imul edi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebp, 0x1f
add ebp, ebx
sub ebp, eax
mov eax, 0x331da7cd
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov dword [0x45cbe4], ebp
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042fe7d
add esp, 0x238
ret