Function at 0x405940
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x457000]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24c]
push eax
push 0x445fc4
lea ecx, [esp + 0x148]
push 0x104
push ecx
call fcn.00429c7b
mov eax, dword [0x4556a8]
mov ecx, eax
mov ebp, dword [0x45569c]
mov ebx, dword [0x455690]
shl ecx, 4
add ecx, eax
mov eax, 0x5397829d
imul ebp
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xd5555555
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x66666667
imul dword [0x455694]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub edi, esi
mov esi, dword [0x45568c]
add eax, ecx
imul esi, esi, 0x34
add eax, edi
add esi, eax
mov edi, dword [0x4556a0]
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0xffffffcf
sub edx, eax
mov dword [esp + 0x20], edx
mov eax, 0x151d07eb
imul ebp
mov ebp, dword [esp + 0x20]
sar edx, 3
add ebp, edx
mov eax, edx
mov edx, ebx
imul edx, edx, 0x39
shr eax, 0x1f
add eax, ebp
mov ebp, dword [0x455688]
sub eax, edx
add eax, esi
add esp, 0x10
add ebp, eax
mov dword [str._r_____r____], esi
mov dword [0x455688], ebp
mov eax, 0x30c30c31
imul edi, edi, 0x34
imul dword [0x45568c]
sar edx, 3
mov esi, edx
add edi, edx
mov eax, 0x66666667
imul ebx
sar edx, 2
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, edi
add esi, edx
mov edx, dword [0x455694]
add eax, esi
sub eax, ecx
sub eax, edx
push 0
add eax, 0x37
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45568c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x4556a4]
mov edi, dword [0x455688]
mov ebp, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov esi, edi
imul esi, esi, 0x2a
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea edx, [ecx + ecx*4]
lea esi, [esi + edx*2]
mov edx, dword [0x45568c]
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
cmp ebp, 0xffffffff
mov dword [0x4556a4], esi
jne 0x405b68
mov eax, 0x38e38e39
imul esi
mov esi, dword [0x4556a0]
sar edx, 3
imul esi, esi, 0xffffffcf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x151d07eb
imul ecx
sar edx, 3
add esi, edx
mov ecx, edx
mov edx, dword [0x455690]
imul edx, edx, 0x39
shr ecx, 0x1f
add ecx, esi
mov esi, dword [str._r_____r____]
sub ecx, edx
add ecx, esi
add edi, ecx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x455688], edi
call fcn.00429c15
add esp, 4
jmp 0x406103
mov eax, dword [0x4556a8]
lea eax, [eax + eax*2]
shl eax, 4
lea edx, [edi + edi*8]
lea esi, [eax + edx*4]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov ebx, dword [0x4556a0]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x455690]
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea ecx, [esp + 0x18]
sub esi, ebx
push ecx
sub esi, 0x39
push ebp
mov dword [0x455690], esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x405c22
mov eax, dword [0x455698]
mov ecx, dword [0x45569c]
mov ebx, dword [0x4556a4]
lea edx, [eax + eax*8]
shl edx, 2
mov esi, edx
mov eax, 0x30c30c31
imul ecx
mov ecx, dword [0x45568c]
imul ecx, ecx, 0x34
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [str._r_____r____]
add ecx, ebx
lea edx, [eax + eax*4]
add ecx, esi
lea eax, [ecx + edx*2 - 0x39]
push ebp
mov dword [0x455694], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406103
mov ecx, dword [0x455698]
mov eax, 0x78787879
imul ecx
mov ecx, dword [0x4556a0]
sar edx, 3
imul ecx, ecx, 0x2a
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, ecx
mov ecx, dword [0x4556a8]
mov edx, ecx
imul edx, edx, 0x39
sub esi, edx
mov eax, 0x4ec4ec4f
imul ecx
mov ecx, dword [0x455694]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x455698], esi
mov esi, ecx
mov eax, 0x2aaaaaab
imul esi, esi, 0x39
imul ecx
mov ecx, dword [0x45568c]
mov eax, dword [0x455690]
sar edx, 3
imul eax, eax, 0x31
mov edi, edx
add esi, edx
mov edx, ecx
imul edx, edx, 0x61
shr edi, 0x1f
add edi, esi
add edi, edx
add edi, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
sub edi, ecx
push eax
mov dword [0x45569c], edi
call fcn.0043396e
add esp, 8
test eax, eax
je 0x405e8f
mov ecx, dword [0x45568c]
mov esi, dword [0x455698]
mov eax, 0x94f2095
imul esi, esi, 0x17
imul ecx
mov eax, dword [esp + 0x20]
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x37
push eax
sub esi, ecx
push 0
add esi, edx
push 0x1f0fff
mov dword [0x4556a0], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x45569c]
mov esi, eax
mov edi, dword [0x455690]
mov eax, 0x5397829d
imul ebx
mov eax, dword [0x4556a8]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, eax
shl edx, 4
add eax, edx
sub eax, ecx
mov ecx, eax
mov eax, 0x2aaaaaab
imul edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [0x455694]
mov eax, 0x66666667
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 2
add eax, edx
mov ecx, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x34
shr ecx, 0x1f
add ecx, eax
add ecx, edx
test esi, esi
mov dword [str._r_____r____], ecx
jne 0x405db6
push 0x445f90
call fcn.00429c15
add esp, 4
jmp 0x405e75
mov edx, dword [0x4556a4]
imul edi, edi, 0x39
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a0]
imul edx, edx, 0xffffffcf
sub edx, eax
mov dword [esp + 0x10], edx
mov eax, 0x151d07eb
imul ebx
mov ebx, dword [esp + 0x10]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, edi
mov edi, dword [0x455688]
add eax, ecx
add edi, eax
push esi
mov dword [0x455688], edi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x405e20
push 0x445f7c
call fcn.00429c15
add esp, 4
mov ecx, dword [0x455694]
mov edi, ecx
mov eax, 0x2aaaaaab
imul edi, edi, 0x39
imul ecx
mov ecx, dword [0x45568c]
mov eax, dword [0x455690]
sar edx, 3
imul eax, eax, 0x31
mov ebx, edx
add edi, edx
mov edx, ecx
imul edx, edx, 0x61
shr ebx, 0x1f
add ebx, edi
add ebx, edx
add ebx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
push esi
mov dword [0x45569c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x18]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405ef5
mov ecx, dword [0x455694]
jmp 0x405c83
mov ecx, dword [0x455698]
mov eax, 0x78787879
imul ecx
mov eax, dword [0x4556a0]
imul eax, eax, 0x2a
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4556a8]
add ecx, eax
mov eax, edx
imul eax, eax, 0x39
sub ecx, eax
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455694]
mov esi, dword [esp + 0x20]
sub ecx, eax
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x455698], ecx
jmp 0x405eff
mov ecx, dword [0x455698]
mov esi, dword [esp + 0x14]
mov edx, dword [0x45568c]
imul ecx, ecx, 0x17
mov eax, 0x94f2095
imul edx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x37
sub ecx, eax
add ecx, edx
push ebp
mov dword [0x4556a0], ecx
call ebx
mov edi, dword [0x4556a0]
mov eax, dword [0x4556a8]
imul edi, edi, 0x34
mov ecx, eax
shl ecx, 4
add ecx, eax
sub edi, ecx
mov ecx, dword [0x45568c]
mov eax, 0x30c30c31
imul ecx
mov ecx, dword [0x455690]
sar edx, 3
add edi, edx
mov ebp, edx
mov eax, 0x66666667
imul ecx
shr ebp, 0x1f
sar edx, 2
add ebp, edi
mov edi, dword [0x455694]
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
sub ecx, edi
add ecx, 0x37
test esi, esi
mov dword [0x45568c], ecx
je 0x4060a9
mov edx, dword [esp + 0x20]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x45569c]
mov esi, eax
mov eax, dword [0x455688]
lea ecx, [eax + eax*8]
mov eax, dword [0x4556a8]
lea edx, [eax + eax*2]
shl edx, 4
lea ebp, [edx + ecx*4]
mov ecx, dword [0x455690]
mov eax, 0x2aaaaaab
imul edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4556a0]
sub ebp, ecx
sub ebp, edx
sub ebp, 0x39
test esi, esi
mov dword [0x455690], ebp
je 0x406103
mov eax, dword [0x455698]
lea edx, [eax + eax*8]
shl edx, 2
mov ecx, edx
mov ebp, dword [0x4556a4]
mov eax, 0x30c30c31
imul edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x34
sub ecx, eax
mov eax, dword [str._r_____r____]
add edx, ebp
lea eax, [eax + eax*4]
add edx, ecx
push 0
lea ecx, [edx + eax*2 - 0x39]
push esi
mov dword [0x455694], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45568c]
mov edi, dword [0x455698]
mov eax, 0x94f2095
imul edi, edi, 0x17
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 1
imul ecx, ecx, 0x37
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push esi
mov dword [0x4556a0], edi
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.00428ee1
add esp, 0x238
ret
mov edx, dword [0x4556a4]
mov edi, dword [0x455688]
mov esi, dword [0x45569c]
imul edi, edi, 0x2a
mov eax, 0x2aaaaaab
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x5397829d
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
lea edx, [esi + esi*4]
lea esi, [edi + edx*2]
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x4556a4], esi
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.00428ee1
add esp, 0x238
ret