Function at 0x406630
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x45f640]
mov edx, dword [esp + 0x23c]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44e064
stosb byte es:[edi], al
lea eax, [esp + 0x148]
push 0x104
push eax
call fcn.004314dc
mov edi, dword [0x45dbd4]
mov ecx, dword [0x45dbcc]
mov eax, 0xc69fb513
imul edi
add edx, edi
sar edx, 0x19
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x2ee68aa5
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbdc]
imul edx, edx, 0x362805a
mov ebp, ecx
imul ebp, ebp, 0x33bbc84
sub ebp, eax
add ebp, edx
mov esi, dword [0x45dbe8]
mov eax, 0xc41087d7
imul esi, esi, 0x20e865f
imul edi
add edx, edi
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0xc41087d7
imul ecx
add edx, ecx
sar edx, 0x1a
mov ecx, edx
add ebp, esi
shr ecx, 0x1f
add ecx, edx
mov dword [esp + 0x20], esi
mov esi, dword [0x45dbd0]
mov eax, 0x1066a8b3
imul esi
sar edx, 0x16
add ecx, ebp
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3e6f678
add ebp, edx
mov eax, 0x4f2cca89
imul esi
sar edx, 0x18
add ecx, ebx
mov eax, edx
add esp, 0x10
shr eax, 0x1f
mov dword [str._r_____r____], ecx
add ebp, edx
add eax, ebp
mov dword [esp + 0x14], eax
mov eax, 0x4c3a114b
imul esi
mov eax, dword [esp + 0x14]
mov esi, dword [0x45dbe4]
sar edx, 0x18
add eax, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, eax
mov eax, dword [0x45dbe0]
imul eax, eax, 0xac2519
sub ebp, eax
mov eax, 0x974409b3
imul esi
add edx, esi
imul esi, esi, 0x3e6f678
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, dword [0x45dbe0]
imul eax, eax, 0x33bbc84
add esi, eax
mov dword [0x45dbc8], ebp
mov ebp, dword [0x45dbcc]
mov eax, 0x83228937
imul ebp
add edx, ebp
sar edx, 0x19
mov ebp, edx
add esi, edx
mov eax, 0x974409b3
imul edi
add edx, edi
shr ebp, 0x1f
sar edx, 0x19
add ebp, esi
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
sub eax, dword [esp + 0x10]
sub eax, ecx
push 0
lea ecx, [eax + ebx + 0x276937b]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45dbcc], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edx, dword [0x45dbd4]
mov esi, dword [0x45dbd8]
mov ebx, dword [0x45dbc8]
mov ecx, dword [str._r_____r____]
mov ebp, eax
lea edi, [ebx + edx]
mov eax, 0xc69fb513
imul edi, edi, 0x3e78532
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x293e68d
sub edi, eax
add edi, edx
mov eax, 0x2ee68aa5
imul esi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xcfdc5805
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
add edi, edx
shr ecx, 0x1f
add ecx, edi
mov edi, dword [0x45dbe4]
mov eax, 0xc41087d7
imul edi
add edx, edi
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp ebp, 0xffffffff
mov dword [0x45dbe4], ecx
mov eax, 0x1066a8b3
jne 0x406909
mov esi, dword [0x45dbd0]
imul ebx, ebx, 0x3e6f678
imul esi
sar edx, 0x16
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x4f2cca89
imul esi
sar edx, 0x18
add edi, ebx
mov ebx, edx
add edi, edx
mov eax, 0x4c3a114b
imul esi
sar edx, 0x18
mov esi, edx
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0xac2519
shr esi, 0x1f
add esi, ebx
sub esi, edx
mov eax, 0x974409b3
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45dbc8], esi
call fcn.00431476
add esp, 4
jmp 0x407110
imul esi
imul ebx, ebx, 0x362805a
imul esi, esi, 0x5390766
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbd0]
mov edi, eax
mov eax, 0xcfdc5805
imul edx
add edx, dword [0x45dbd0]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x20e865f
sub edi, eax
add edi, edx
add edi, ebx
add edi, esi
mov esi, dword [0x45dbdc]
mov eax, 0xc41087d7
imul esi
add edx, esi
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
sub edi, ecx
lea ecx, [esp + 0x18]
push ecx
sub edi, 0x3e6f678
push ebp
mov dword [0x45dbd0], edi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
mov eax, 0xc69fb513
jne 0x406a09
mov ecx, dword [0x45dbdc]
mov esi, dword [str._r_____r____]
mov edx, dword [0x45dbd8]
lea edi, [edx + esi]
imul ecx
imul esi, esi, 0x293e68d
add edx, ecx
imul edi, edi, 0x362805a
mov eax, ecx
sar edx, 0x19
imul eax, eax, 0x33bbc84
mov ebx, edx
add edi, edx
shr ebx, 0x1f
add ebx, edi
add ebx, esi
add ebx, eax
mov eax, 0x83228937
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe0]
sub ebx, ecx
lea eax, [ebx + edx - 0x3e6f678]
push ebp
mov dword [0x45dbd4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407110
mov esi, dword [0x45dbe8]
mov edi, dword [0x45dbc8]
imul edi, edi, 0x293e68d
mov ecx, esi
imul ecx, ecx, 0x3e6f678
sub edi, ecx
mov ecx, dword [0x45dbd4]
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x4f2cca89
imul esi
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45dbe0]
mov eax, 0x83228937
imul ecx
add edx, ecx
sar edx, 0x19
add edi, edx
mov ebx, edx
mov edx, ecx
imul edx, edx, 0x3e78532
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0x7c780d21
imul esi
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x45dbd8], eax
jmp 0x406a90
mov edi, dword [0x45dbcc]
imul ecx, ecx, 0x35bbff4
mov edx, dword [0x45dbd0]
mov eax, dword [0x45dbdc]
mov esi, dword [0x45dbe4]
imul eax, eax, 0x3e6f678
lea ebx, [edx + edi]
imul ebx, ebx, 0x2baab78
add ebx, eax
mov eax, 0xc69fb513
imul esi
add edx, esi
sar edx, 0x19
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, ecx
mov ebx, eax
mov eax, 0x974409b3
imul edi
add edx, edi
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xc41087d7
imul esi
add edx, esi
sar edx, 0x1a
sub ebx, ecx
mov eax, edx
add ebx, edx
lea ecx, [esp + 0x140]
shr eax, 0x1f
push ecx
lea edx, [esp + 0x40]
add eax, ebx
push edx
mov dword [0x45dbdc], eax
call fcn.0043b2ae
add esp, 8
test eax, eax
je 0x406d77
mov ecx, dword [0x45dbe8]
mov eax, dword [0x45dbd0]
mov edx, dword [0x45dbdc]
lea esi, [eax + ecx]
imul edx, edx, 0x3e6f678
mov eax, dword [0x45dbd8]
imul esi, esi, 0x276937b
imul eax, eax, 0x35bbff4
sub esi, edx
add esi, eax
mov eax, 0x2ee68aa5
imul ecx
mov ecx, dword [0x45dbcc]
sar edx, 0x17
mov edi, edx
add esi, edx
mov eax, 0xcfdc5805
imul ecx
mov eax, dword [esp + 0x20]
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbd4]
imul edx, edx, 0x20e865f
shr edi, 0x1f
add edi, esi
push eax
sub edi, ecx
push 0
sub edi, edx
push 0x1f0fff
mov dword [0x45dbe0], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45dbd4]
mov edi, eax
mov esi, dword [0x45dbcc]
mov eax, 0xc69fb513
imul ecx
add edx, ecx
sar edx, 0x19
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, esi
imul edx, edx, 0x33bbc84
add ebx, edx
mov eax, 0x2ee68aa5
imul esi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
sub ebx, eax
imul edx, edx, 0x20e865f
mov eax, dword [0x45dbdc]
imul eax, eax, 0x362805a
add ebx, edx
add ebx, eax
mov eax, 0xc41087d7
imul ecx
add edx, ecx
sar edx, 0x1a
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xc41087d7
imul esi
add edx, esi
sar edx, 0x1a
sub ebx, ecx
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
test edi, edi
mov dword [str._r_____r____], eax
jne 0x406c44
push 0x44e030
call fcn.00431476
add esp, 4
jmp 0x406d59
mov ecx, dword [0x45dbd0]
mov eax, 0x1066a8b3
imul ecx
sar edx, 0x16
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3e6f678
add esi, edx
mov eax, 0x4f2cca89
imul ecx
sar edx, 0x18
add esi, edx
mov ebx, edx
mov eax, 0x4c3a114b
imul ecx
mov eax, dword [0x45dbe0]
mov ecx, dword [0x45dbe4]
imul eax, eax, 0xac2519
sar edx, 0x18
shr ebx, 0x1f
add ebx, esi
mov esi, edx
add ebx, edx
shr esi, 0x1f
add esi, ebx
sub esi, eax
mov eax, 0x974409b3
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
push edi
mov dword [0x45dbc8], esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406cd5
push 0x44e01c
call fcn.00431476
add esp, 4
mov esi, dword [0x45dbcc]
mov edx, dword [0x45dbd0]
mov eax, dword [0x45dbdc]
mov ecx, dword [0x45dbe4]
imul eax, eax, 0x3e6f678
lea ebx, [edx + esi]
imul ebx, ebx, 0x2baab78
add ebx, eax
mov eax, 0xc69fb513
imul ecx
add edx, ecx
sar edx, 0x19
add ebx, edx
mov eax, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x35bbff4
shr eax, 0x1f
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x974409b3
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xc41087d7
imul ecx
add edx, ecx
sar edx, 0x1a
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
push edi
mov dword [0x45dbdc], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x18]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406e04
mov ecx, dword [0x45dbe0]
jmp 0x406a90
mov esi, dword [0x45dbe8]
mov ebx, dword [0x45dbc8]
mov ecx, dword [0x45dbd4]
imul ebx, ebx, 0x293e68d
mov eax, esi
imul eax, eax, 0x3e6f678
sub ebx, eax
mov eax, 0xc69fb513
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edi, dword [0x45dbe0]
mov eax, 0x4f2cca89
imul esi
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x83228937
imul edi
add edx, edi
imul edi, edi, 0x3e78532
sar edx, 0x19
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, edi
mov ebx, eax
mov eax, 0x7c780d21
imul esi
sar edx, 0x18
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, dword [esp + 0x20]
mov dword [0x45dbd8], eax
jmp 0x406e19
mov ecx, dword [0x45dbd4]
mov esi, dword [0x45dbe8]
mov eax, dword [0x45dbd8]
mov ebx, dword [esp + 0x14]
mov edx, dword [0x45dbd0]
imul eax, eax, 0x35bbff4
imul ecx, ecx, 0x20e865f
lea edi, [edx + esi]
mov edx, dword [0x45dbdc]
imul edi, edi, 0x276937b
imul edx, edx, 0x3e6f678
sub edi, edx
add edi, eax
mov eax, 0x2ee68aa5
imul esi
mov esi, dword [0x45dbcc]
sar edx, 0x17
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0xcfdc5805
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
sub edi, ecx
push ebp
mov dword [0x45dbe0], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x45dbd4]
mov edi, dword [0x45dbe4]
mov eax, 0xc69fb513
imul ecx
mov esi, edi
imul esi, esi, 0x3e6f678
add edx, ecx
sar edx, 0x19
add esi, edx
mov ebp, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x33bbc84
shr ebp, 0x1f
add ebp, esi
mov esi, dword [0x45dbcc]
add ebp, edx
mov eax, 0x83228937
imul esi
mov eax, dword [0x45dbe8]
add edx, esi
imul eax, eax, 0x20e865f
sar edx, 0x19
mov esi, edx
shr esi, 0x1f
add ebp, edx
add esi, ebp
sub esi, eax
mov eax, 0x974409b3
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, dword [str._r_____r____]
sub eax, esi
add eax, 0x276937b
test ebx, ebx
mov dword [0x45dbcc], eax
je 0x40709a
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x45dbd8]
mov edi, eax
mov ecx, dword [0x45dbd0]
mov eax, 0x1066a8b3
imul ebx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xcfdc5805
imul ecx
mov eax, dword [0x45dbc8]
add edx, ecx
imul eax, eax, 0x362805a
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe8]
sub esi, ecx
imul edx, edx, 0x20e865f
mov ecx, ebx
imul ecx, ecx, 0x5390766
add esi, edx
add esi, eax
mov ebp, dword [0x45dbe4]
add esi, ecx
mov ecx, dword [0x45dbdc]
mov eax, 0xc41087d7
imul ecx
add edx, ecx
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ebp
sub esi, 0x3e6f678
test edi, edi
mov dword [0x45dbd0], esi
je 0x407110
mov esi, dword [str._r_____r____]
mov eax, 0xc69fb513
imul ecx
add ebx, esi
imul esi, esi, 0x293e68d
add edx, ecx
imul ebx, ebx, 0x362805a
sar edx, 0x19
mov ebp, edx
add ebx, edx
mov edx, ecx
imul edx, edx, 0x33bbc84
shr ebp, 0x1f
add ebp, ebx
add ebp, esi
add ebp, edx
mov eax, 0x83228937
imul ecx
add edx, ecx
mov ecx, dword [0x45dbe0]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
push 0
lea edx, [ecx + ebp - 0x3e6f678]
push edi
mov dword [0x45dbd4], edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45dbe8]
mov eax, dword [0x45dbd0]
mov edx, dword [0x45dbdc]
lea esi, [eax + ecx]
imul edx, edx, 0x3e6f678
mov eax, dword [0x45dbd8]
imul esi, esi, 0x276937b
imul eax, eax, 0x35bbff4
sub esi, edx
add esi, eax
mov eax, 0x2ee68aa5
imul ecx
mov ecx, dword [0x45dbcc]
sar edx, 0x17
mov ebx, edx
add esi, edx
mov eax, 0xcfdc5805
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbd4]
imul edx, edx, 0x20e865f
shr ebx, 0x1f
add ebx, esi
sub ebx, ecx
sub ebx, edx
push edi
mov dword [0x45dbe0], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x407112
mov eax, dword [0x45dbc8]
lea ebx, [eax + ecx]
mov ecx, dword [0x45dbd8]
imul ebx, ebx, 0x3e78532
mov eax, 0xc69fb513
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, esi
imul edx, edx, 0x293e68d
add ebx, edx
mov eax, 0x2ee68aa5
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xcfdc5805
imul esi
add edx, esi
sar edx, 0x19
add ebx, edx
mov ecx, edx
mov eax, 0xc41087d7
imul edi
add edx, edi
sar edx, 0x1a
mov eax, edx
shr ecx, 0x1f
shr eax, 0x1f
add ecx, ebx
add eax, edx
sub ecx, eax
mov dword [0x45dbe4], ecx
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043079d
add esp, 0x238
ret