Function at 0x406440
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x238
mov eax, dword [0x45e640]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24c]
push eax
push 0x44cffc
lea ecx, [esp + 0x148]
push 0x104
push ecx
call fcn.004309fc
mov ecx, dword [0x45ccd4]
mov edi, dword [0x45cccc]
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x950cb67f
imul edi
add edx, edi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, edi
imul ebp, ebp, 0x84dd7
sub ebp, eax
mov ebx, dword [0x45cce8]
mov eax, 0x9baa0995
imul ebx, ebx, 0x8a702
imul ecx
add edx, ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x9baa0995
imul edi
sub ebp, ecx
mov ecx, dword [0x45ccdc]
add edx, edi
imul ecx, ecx, 0x8276a
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ebx
add eax, ebp
mov ebp, dword [0x45ccd0]
add ecx, eax
mov eax, 0x10449d67
imul ebp
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0x3ef21
add eax, edx
mov dword [esp + 0x24], eax
mov eax, 0x3da8152f
imul ebp
mov eax, dword [esp + 0x24]
sar edx, 0x11
add ecx, esi
mov ebp, edx
add esp, 0x10
shr ebp, 0x1f
mov dword [str._r_____r____], ecx
add eax, edx
add ebp, eax
mov eax, dword [0x45cce0]
imul eax, eax, 0x1c83d
add ebp, eax
mov eax, 0x3ecaa423
imul dword [0x45cce4]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0xcbb2b9d
imul dword [0x45ccd0]
sar edx, 0xf
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, dword [0x45cce4]
mov dword [0x45ccc8], eax
imul ebp, ebp, 0x3ef21
mov eax, 0x69f239fb
imul edi
mov eax, dword [0x45cce0]
imul eax, eax, 0x84dd7
sar edx, 0x10
mov edi, edx
add ebp, edx
shr edi, 0x1f
add edi, ebp
add edi, eax
mov eax, 0x3ecaa423
imul dword [0x45ccd4]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ebx
sub eax, ecx
push 0
lea ecx, [eax + esi + 0x54963]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45cccc], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edx, dword [0x45ccd4]
mov esi, dword [0x45ccd8]
mov ebx, dword [0x45ccc8]
mov ebp, eax
lea edi, [ebx + edx]
mov eax, 0x950cb67f
imul edi, edi, 0x26a94
imul esi
add edx, esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x85c24
add edi, edx
mov eax, 0x60d8eff
imul ecx
sar edx, 0xd
mov ecx, edx
add edi, edx
shr ecx, 0x1f
add ecx, edi
mov edi, dword [0x45cce4]
mov eax, 0x9baa0995
imul edi
add edx, edi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp ebp, 0xffffffff
mov dword [0x45cce4], ecx
mov eax, 0x10449d67
jne 0x40670c
mov esi, dword [0x45ccd0]
imul ebx, ebx, 0x3ef21
imul esi
sar edx, 0xe
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x3da8152f
imul esi
sar edx, 0x11
add edi, ebx
mov ebx, edx
add edi, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1c83d
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0x3ecaa423
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xcbb2b9d
imul esi
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45ccc8], ecx
call fcn.00430996
add esp, 4
jmp 0x406f05
imul esi
imul esi, esi, 0xd2812
imul ebx, ebx, 0x8276a
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd0]
mov edi, eax
mov eax, 0x60d8eff
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, esi
mov esi, dword [0x45ccdc]
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x8a702
sub edi, eax
add edi, ebx
add edi, edx
lea eax, [esp + 0x18]
sub edi, ecx
push eax
sub edi, 0x3ef21
push ebp
mov dword [0x45ccd0], edi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
mov eax, 0x69f239fb
jne 0x4067ff
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ccd8]
mov esi, dword [0x45ccdc]
lea edi, [edx + ecx]
imul esi
imul ecx, ecx, 0x85c24
imul edi, edi, 0x8276a
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1e9f4e3
imul esi
imul esi, esi, 0x84dd7
sar edx, 0xc
mov eax, edx
add edi, edx
shr eax, 0x1f
add eax, edi
add ecx, dword [0x45cce0]
add ecx, eax
lea ecx, [esi + ecx - 0x3ef21]
push ebp
mov dword [0x45ccd4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406f05
mov ecx, dword [0x45cce0]
mov esi, dword [0x45cce8]
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [0x45ccc8]
imul eax, eax, 0x85c24
mov edi, esi
imul edi, edi, 0x3ef21
mov edx, ecx
imul edx, edx, 0x26a94
sub ebx, edi
add ebx, edx
mov edx, dword [0x45ccd4]
add ebx, eax
mov eax, 0x1e9f4e3
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3da8152f
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x76595943
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x45ccd8], eax
mov edi, edi
mov edi, dword [0x45cccc]
imul ecx, ecx, 0xa0dd9
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
mov esi, dword [0x45cce4]
imul eax, eax, 0x3ef21
lea ebx, [edx + edi]
imul ebx, ebx, 0x6dec5
add ebx, eax
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov esi, edx
add ebx, edx
mov eax, 0x3ecaa423
imul edi
sar edx, 0x11
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add eax, edx
add esi, ebx
sub esi, eax
add esi, ecx
lea ecx, [esp + 0x140]
push ecx
lea edx, [esp + 0x40]
push edx
mov dword [0x45ccdc], esi
call fcn.0043a72e
add esp, 8
test eax, eax
je 0x406b64
mov ecx, dword [0x45cce8]
mov eax, dword [0x45ccd0]
mov edx, dword [0x45ccdc]
lea esi, [eax + ecx]
imul edx, edx, 0x3ef21
imul esi, esi, 0x54963
sub esi, edx
mov eax, 0x950cb67f
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sar edx, 0x12
mov edi, edx
add esi, edx
mov eax, 0x60d8eff
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0xd
imul ecx, ecx, 0x8a702
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd8]
shr edi, 0x1f
imul edx, edx, 0xa0dd9
add edi, esi
sub edi, eax
mov eax, dword [esp + 0x20]
push eax
sub edi, ecx
push 0
add edi, edx
push 0x1f0fff
mov dword [0x45cce0], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45cccc]
mov esi, eax
mov edi, dword [0x45ccd4]
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x1e9f4e3
imul edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x84dd7
sub eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x9baa0995
imul edi
add edx, edi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x9baa0995
imul ecx
mov eax, dword [0x45cce8]
add edx, ecx
imul eax, eax, 0x8a702
sar edx, 0x13
add ebx, edx
mov ecx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x8276a
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
add ecx, eax
mov dword [str._r_____r____], ecx
test esi, esi
jne 0x406a37
push 0x44cfc8
call fcn.00430996
add esp, 4
jmp 0x406b46
mov ecx, dword [0x45ccd0]
mov eax, 0x10449d67
imul ecx
sar edx, 0xe
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0x3ef21
add edi, edx
mov eax, 0x3da8152f
imul ecx
mov eax, dword [0x45cce0]
imul eax, eax, 0x1c83d
sar edx, 0x11
mov ebx, edx
add edi, edx
mov edx, dword [0x45cce4]
shr ebx, 0x1f
add ebx, edi
add ebx, eax
mov eax, 0x3ecaa423
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xcbb2b9d
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
push esi
mov dword [0x45ccc8], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406ac6
push 0x44cfb4
call fcn.00430996
add esp, 4
mov edi, dword [0x45cccc]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
mov ecx, dword [0x45cce4]
imul eax, eax, 0x3ef21
lea ebx, [edx + edi]
imul ebx, ebx, 0x6dec5
add ebx, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
mov ecx, edx
add ebx, edx
mov eax, 0x3ecaa423
imul edi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0xa0dd9
shr ecx, 0x1f
add ecx, ebx
sub ecx, eax
add ecx, edx
push esi
mov dword [0x45ccdc], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x18]
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406bf2
mov ecx, dword [0x45cce0]
jmp 0x406880
mov ecx, dword [0x45cce0]
mov esi, dword [0x45cce8]
mov eax, 0x69f239fb
imul ecx
imul ecx, ecx, 0x26a94
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, esi
imul edi, edi, 0x3ef21
mov ebx, eax
sub ebx, edi
mov edi, dword [0x45ccd4]
add ebx, ecx
mov ecx, dword [0x45ccc8]
mov eax, 0x1e9f4e3
imul ecx, ecx, 0x85c24
imul edi
sar edx, 0xc
mov eax, edx
add ebx, ecx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3da8152f
imul esi
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x76595943
imul esi
sar edx, 0x12
sub ebx, ecx
mov ecx, edx
add ebx, edx
mov edx, dword [esp + 0x20]
shr ecx, 0x1f
add ecx, ebx
mov dword [0x45ccd8], ecx
mov dword [esp + 0x14], edx
jmp 0x406c04
mov edi, dword [0x45ccd4]
mov esi, dword [0x45cce8]
mov ecx, dword [0x45ccd8]
mov eax, dword [0x45ccd0]
imul edi, edi, 0x8a702
imul ecx, ecx, 0xa0dd9
mov edx, dword [0x45ccdc]
lea ebx, [eax + esi]
imul edx, edx, 0x3ef21
imul ebx, ebx, 0x54963
sub ebx, edx
mov eax, 0x950cb67f
imul esi
add edx, esi
sar edx, 0x12
mov esi, edx
add ebx, edx
mov edx, dword [0x45cccc]
mov eax, 0x60d8eff
imul edx
sar edx, 0xd
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, ebx
add eax, edx
sub esi, eax
sub esi, edi
add esi, ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x45cce0], esi
call ebp
mov ecx, dword [0x45cccc]
mov esi, dword [0x45cce4]
mov eax, 0x69f239fb
imul ecx
mov ecx, dword [0x45ccd4]
mov edi, esi
imul edi, edi, 0x3ef21
sar edx, 0x10
add edi, edx
mov ebx, edx
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov edi, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x84dd7
shr edi, 0x1f
add edi, ebx
add edi, edx
mov eax, 0x3ecaa423
imul ecx
sar edx, 0x11
add edi, edx
mov eax, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x8a702
shr eax, 0x1f
add eax, edi
mov edi, dword [str._r_____r____]
sub eax, edx
sub eax, edi
add eax, 0x54963
mov dword [0x45cccc], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x406e90
mov eax, dword [esp + 0x20]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x45ccd8]
mov edi, eax
mov eax, 0x10449d67
imul ebx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
mov ecx, dword [0x45ccd0]
mov dword [esp + 0x10], eax
mov esi, dword [0x45ccdc]
mov eax, 0x60d8eff
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, ebx
imul edx, edx, 0xd2812
add ecx, edx
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
sub ecx, eax
imul edx, edx, 0x8276a
mov eax, dword [0x45cce8]
imul eax, eax, 0x8a702
add ecx, edx
add ecx, eax
sub ecx, dword [0x45cce4]
sub ecx, 0x3ef21
test edi, edi
mov dword [0x45ccd0], ecx
je 0x406f05
mov ecx, dword [str._r_____r____]
add ebx, ecx
imul ecx, ecx, 0x85c24
mov eax, 0x69f239fb
imul ebx, ebx, 0x8276a
imul esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1e9f4e3
imul esi
imul esi, esi, 0x84dd7
sar edx, 0xc
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
add ecx, dword [0x45cce0]
add ecx, eax
push 0
lea ecx, [esi + ecx - 0x3ef21]
push edi
mov dword [0x45ccd4], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
lea esi, [edx + ecx]
imul eax, eax, 0x3ef21
imul esi, esi, 0x54963
sub esi, eax
mov eax, 0x950cb67f
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sar edx, 0x12
mov ebx, edx
add esi, edx
mov eax, 0x60d8eff
imul ecx
mov eax, dword [0x45ccd8]
sar edx, 0xd
imul eax, eax, 0xa0dd9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccd4]
imul edx, edx, 0x8a702
shr ebx, 0x1f
add ebx, esi
sub ebx, ecx
sub ebx, edx
add ebx, eax
push edi
mov dword [0x45cce0], ebx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.0042fcc1
add esp, 0x238
ret
mov edx, dword [0x45ccc8]
lea ebx, [edx + ecx]
mov ecx, dword [0x45ccd8]
imul ebx, ebx, 0x26a94
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, edi
imul edx, edx, 0x85c24
sub ebx, ecx
add ebx, edx
mov eax, 0x60d8eff
imul edi
sar edx, 0xd
add ebx, edx
mov ecx, edx
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr ecx, 0x1f
shr eax, 0x1f
add ecx, ebx
add eax, edx
sub ecx, eax
mov dword [0x45cce4], ecx
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.0042fcc1
add esp, 0x238
ret