Function at 0x405fb0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x45c540]
mov edx, dword [esp + 0x23c]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44b064
stosb byte es:[edi], al
lea eax, [esp + 0x148]
push 0x104
push eax
call fcn.0042ed0c
mov ecx, dword [0x45abd4]
mov eax, 0x3159721f
imul ecx
sar edx, 4
mov esi, edx
mov edi, dword [0x45abcc]
mov ebp, dword [0x45abdc]
shr esi, 0x1f
imul ebp, ebp, 0x37
add esi, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, edi
imul edx, edx, 0x59
sub ebp, ecx
add ebp, edx
mov eax, 0x63e7063f
imul edi
sar edx, 5
add ebp, edx
mov ecx, edx
mov eax, 0x78787879
imul edi
mov edi, dword [0x45abe0]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abc8]
shr ecx, 0x1f
add ecx, ebp
sub ecx, eax
mov ebx, dword [0x45abe8]
lea ebp, [edi + edx]
imul ebx, ebx, 0x54
mov eax, 0xb81702e1
imul dword [0x45abd0]
add edx, dword [0x45abd0]
sar edx, 6
mov eax, edx
shr eax, 0x1f
shl ebp, 4
add ebp, edx
add eax, ebp
mov ebp, eax
mov eax, 0x94f2095
imul dword [0x45abe4]
sar edx, 1
add ecx, esi
mov eax, edx
add ecx, ebx
shr eax, 0x1f
add esp, 0x10
mov dword [str._r_____r____], ecx
add eax, edx
imul edi, edi, 0x59
sub ebp, eax
mov eax, 0x3e0f83e1
imul dword [0x45abd0]
sar edx, 3
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, dword [0x45abd0]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add ebp, eax
mov eax, dword [0x45abe4]
shl eax, 4
add edi, eax
mov eax, 0x94f2095
imul dword [0x45abd4]
sar edx, 1
mov dword [0x45abc8], ebp
mov ebp, edx
add edi, edx
shr ebp, 0x1f
add ebp, edi
mov edi, dword [0x45abcc]
mov eax, 0xdd67c8a7
imul edi
add edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
sub eax, ebx
sub eax, ecx
push 0
lea ecx, [eax + esi + 0x4c]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45abcc], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edx, dword [0x45abd4]
mov edi, dword [0x45abc8]
mov esi, dword [0x45abd8]
mov ebx, eax
lea ebp, [edi + edx]
mov eax, 0x3159721f
imul ebp, ebp, 0x25
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x78787879
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebp, ecx
mov ecx, dword [0x45abe4]
mov eax, 0x63e7063f
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x53
sub ebp, eax
add ebp, edx
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
cmp ebx, 0xffffffff
mov dword [0x45abe4], ecx
jne 0x406244
mov eax, dword [0x45abe0]
mov esi, dword [0x45abd0]
add edi, eax
mov eax, 0xb81702e1
imul esi
add edx, esi
sar edx, 6
mov ebx, edx
shl edi, 4
add edi, edx
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x3e0f83e1
imul esi
shr ebx, 0x1f
sar edx, 3
add ebx, edi
sub ebx, ecx
mov ecx, edx
add ebx, edx
mov eax, esi
cdq
and edx, 0xf
shr ecx, 0x1f
add eax, edx
add ecx, ebx
sar eax, 4
add ecx, eax
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45abc8], ecx
call fcn.0042eca6
add esp, 4
jmp 0x406976
mov edx, dword [0x45abd0]
imul edi, edi, 0x37
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, esi
imul ebp, ebp, 0x52
sub ebp, eax
mov eax, esi
cdq
and edx, 0xf
add eax, edx
mov edx, dword [0x45abdc]
sar eax, 4
add ebp, eax
mov eax, 0x63e7063f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abe8]
imul edx, edx, 0x54
sub ebp, eax
add ebp, edi
add ebp, edx
lea eax, [esp + 0x18]
sub ebp, ecx
push eax
sub ebp, 0x10
push ebx
mov dword [0x45abd0], ebp
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x406322
mov esi, dword [0x45abdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45abd8]
lea edi, [edx + ecx]
imul ecx, ecx, 0x53
imul edi, edi, 0x37
mov eax, esi
imul eax, eax, 0x59
add edi, eax
mov eax, 0x3159721f
imul esi
sar edx, 4
mov ebp, edx
add edi, edx
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr ebp, 0x1f
shr eax, 0x1f
add ebp, edi
add eax, edx
mov edx, dword [0x45abe0]
sub ebp, eax
add ebp, edx
lea ecx, [ecx + ebp - 0x10]
push ebx
mov dword [0x45abd4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406976
mov ecx, dword [0x45abe0]
mov esi, dword [0x45abc8]
mov eax, 0xdd67c8a7
imul esi, esi, 0x53
imul ecx
add edx, ecx
sar edx, 5
add esi, edx
mov edi, edx
mov edx, ecx
imul edx, edx, 0x25
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45abe8]
add edi, edx
mov eax, 0xb81702e1
imul esi
add edx, esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x30c30c31
imul esi
sar edx, 4
add edi, edx
mov ebp, edx
mov edx, dword [0x45abd4]
mov eax, 0x3159721f
imul edx
sar edx, 4
shr ebp, 0x1f
mov eax, edx
shr eax, 0x1f
add ebp, edi
add eax, edx
sub ebp, eax
shl esi, 4
sub ebp, esi
mov dword [0x45abd8], ebp
nop
mov esi, dword [0x45abcc]
imul ecx, ecx, 0x21
mov edx, dword [0x45abd0]
mov edi, dword [0x45abe4]
lea ebp, [edx + esi]
mov eax, 0x3159721f
imul ebp, ebp, 0x44
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov ebp, eax
mov eax, 0x63e7063f
imul edi
mov eax, dword [0x45abdc]
sar edx, 5
mov edi, edx
add ebp, edx
shr edi, 0x1f
add edi, ebp
add edi, ecx
shl eax, 4
add edi, eax
mov eax, 0x94f2095
imul esi
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
sub edi, ecx
push eax
mov dword [0x45abdc], edi
call fcn.00438ade
add esp, 8
test eax, eax
je 0x40663f
mov ecx, dword [0x45abe8]
mov edx, dword [0x45abd0]
mov eax, dword [0x45abd8]
lea esi, [edx + ecx]
imul eax, eax, 0x21
imul esi, esi, 0x4c
add esi, eax
mov eax, 0x78787879
imul ecx
mov ecx, dword [0x45abd4]
imul ecx, ecx, 0x54
sar edx, 5
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
sub edi, ecx
mov ecx, dword [0x45abcc]
mov eax, 0x6bca1af3
imul ecx
mov ecx, dword [0x45abdc]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
push edx
sub edi, eax
shl ecx, 4
push 0
sub edi, ecx
push 0x1f0fff
mov dword [0x45abe0], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x45abe8]
mov ecx, dword [0x45abd4]
imul edi, edi, 0x54
mov esi, eax
mov eax, dword [0x45abdc]
imul eax, eax, 0x37
add edi, eax
mov eax, 0x3159721f
imul ecx
sar edx, 4
add edi, edx
mov ebp, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov ecx, edx
shr ebp, 0x1f
add ebp, edi
shr ecx, 0x1f
add ecx, edx
sub ebp, ecx
mov ecx, dword [0x45abcc]
mov edx, ecx
imul edx, edx, 0x59
add ebp, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
add ebp, edx
mov edi, edx
mov eax, 0x78787879
imul ecx
sar edx, 5
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, ebp
add eax, edx
sub edi, eax
test esi, esi
mov dword [str._r_____r____], edi
jne 0x40652a
push 0x44b030
call fcn.0042eca6
add esp, 4
jmp 0x406621
mov ecx, dword [0x45abc8]
mov edx, dword [0x45abe0]
lea edi, [edx + ecx]
mov ecx, dword [0x45abd0]
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
mov ebp, edx
shl edi, 4
add edi, edx
mov edx, dword [0x45abe4]
mov eax, 0x94f2095
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebp, 0x1f
add ebp, edi
sub ebp, eax
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
mov edi, edx
add ebp, edx
mov eax, ecx
cdq
and edx, 0xf
shr edi, 0x1f
add eax, edx
sar eax, 4
add edi, ebp
add edi, eax
push esi
mov dword [0x45abc8], edi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x4065ad
push 0x44b01c
call fcn.0042eca6
add esp, 4
mov ecx, dword [0x45abcc]
mov edx, dword [0x45abd0]
mov edi, dword [0x45abe4]
lea ebp, [edx + ecx]
mov eax, 0x3159721f
imul ebp, ebp, 0x44
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov ebp, eax
mov eax, 0x63e7063f
imul edi
mov eax, dword [0x45abe0]
imul eax, eax, 0x21
sar edx, 5
mov edi, edx
add ebp, edx
mov edx, dword [0x45abdc]
shr edi, 0x1f
add edi, ebp
add edi, eax
shl edx, 4
add edi, edx
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push esi
mov dword [0x45abdc], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
push ecx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4066c2
mov ecx, dword [0x45abe0]
jmp 0x4063a0
mov ecx, dword [0x45abe0]
mov esi, dword [0x45abc8]
mov eax, 0xdd67c8a7
imul esi, esi, 0x53
imul ecx
add edx, ecx
imul ecx, ecx, 0x25
sar edx, 5
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45abe8]
mov eax, 0xb81702e1
imul esi
add edx, esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, ecx
sub edi, eax
mov eax, 0x30c30c31
imul esi
sar edx, 4
mov ecx, edx
add edi, edx
mov ebp, dword [esp + 0x20]
shr ecx, 0x1f
add ecx, edi
mov edi, dword [0x45abd4]
mov eax, 0x3159721f
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
sub ecx, eax
shl edx, 4
sub ecx, edx
mov dword [0x45abd8], ecx
jmp 0x4066d8
mov edi, dword [0x45abd4]
mov esi, dword [0x45abe8]
mov ecx, dword [0x45abd8]
mov ebp, dword [esp + 0x14]
mov eax, dword [0x45abd0]
imul ecx, ecx, 0x21
imul edi, edi, 0x54
add eax, esi
imul eax, eax, 0x4c
add eax, ecx
mov ecx, dword [0x45abcc]
mov dword [esp + 0x14], eax
mov eax, 0x78787879
imul esi
mov eax, dword [esp + 0x14]
sar edx, 5
mov esi, edx
add eax, edx
shr esi, 0x1f
add esi, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45abdc]
sub esi, edi
sub esi, ecx
shl edx, 4
sub esi, edx
push ebx
mov dword [0x45abe0], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x45abe0]
mov eax, dword [0x45abe8]
imul ecx, ecx, 0x59
mov edi, dword [0x45abe4]
imul eax, eax, 0x54
mov esi, dword [0x45abd4]
mov edx, edi
shl edx, 4
add ecx, edx
sub ecx, eax
mov eax, 0x3159721f
imul esi
sar edx, 4
add ecx, edx
mov ebx, edx
mov eax, 0x94f2095
imul esi
sar edx, 1
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x45abcc]
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, ecx
add eax, 0x4c
test ebp, ebp
mov dword [0x45abcc], eax
je 0x40690c
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45abd0]
mov ebx, dword [0x45abd8]
mov edi, eax
mov eax, 0x6bca1af3
imul ecx
mov ecx, dword [0x45abdc]
sar edx, 5
mov esi, ebx
imul esi, esi, 0x52
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, ebx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add esi, eax
mov eax, 0x63e7063f
imul ecx
mov ebp, dword [0x45abe4]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abc8]
sub esi, eax
imul edx, edx, 0x37
mov eax, dword [0x45abe8]
imul eax, eax, 0x54
add esi, edx
add esi, eax
sub esi, ebp
sub esi, 0x10
test edi, edi
mov dword [0x45abd0], esi
je 0x406976
mov esi, dword [str._r_____r____]
add ebx, esi
imul esi, esi, 0x53
mov edx, ecx
imul ebx, ebx, 0x37
imul edx, edx, 0x59
add ebx, edx
mov eax, 0x3159721f
imul ecx
sar edx, 4
mov ebp, edx
add ebx, edx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr ebp, 0x1f
shr eax, 0x1f
add eax, edx
add ebp, ebx
sub ebp, eax
add ebp, dword [0x45abe0]
push 0
lea ecx, [esi + ebp - 0x10]
push edi
mov dword [0x45abd4], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45abe8]
mov edx, dword [0x45abd0]
mov eax, dword [0x45abd8]
lea esi, [edx + ecx]
imul eax, eax, 0x21
imul esi, esi, 0x4c
add esi, eax
mov eax, 0x78787879
imul ecx
mov ecx, dword [0x45abd4]
imul ecx, ecx, 0x54
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add esi, edx
add ebx, esi
sub ebx, ecx
mov ecx, dword [0x45abcc]
mov eax, 0x6bca1af3
imul ecx
mov ecx, dword [0x45abdc]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
shl ecx, 4
sub ebx, ecx
push edi
mov dword [0x45abe0], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x406978
mov edx, dword [0x45abc8]
lea ebx, [edx + esi]
mov esi, dword [0x45abd8]
imul ebx, ebx, 0x25
mov eax, 0x3159721f
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x78787879
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x63e7063f
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x53
sub ebx, eax
add ebx, edx
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x45abe4], eax
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042dfcd
add esp, 0x238
ret