Function at 0x4063f0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x45e540]
mov edx, dword [esp + 0x23c]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44d064
stosb byte es:[edi], al
lea eax, [esp + 0x148]
push 0x104
push eax
call fcn.0043078c
mov edi, dword [0x45cbd4]
mov ecx, dword [0x45cbcc]
mov eax, 0x1006124d
imul edi
sar edx, 0xc
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x5fa6246b
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0x100de
mov ebp, ecx
imul ebp, ebp, 0xdc65
sub ebp, eax
add ebp, edx
mov eax, 0x2aa871e5
imul edi
sar edx, 0xe
mov edi, dword [0x45cbd0]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x94adc77f
imul edi
add edx, edi
add ebp, esi
sar edx, 0xf
mov ebx, dword [0x45cbe8]
add ecx, ebp
imul ebx, ebx, 0xd60e
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x6051edb
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov ebp, eax
mov eax, 0xc26c7c39
imul edi
add ecx, ebx
add edx, edi
add esp, 0x10
mov dword [str._r_____r____], ecx
sar edx, 0xf
add ebp, edx
mov eax, edx
mov edx, dword [0x45cbc8]
shr eax, 0x1f
imul edx, edx, 0xa88a
add eax, ebp
mov ebp, dword [0x45cbe4]
add eax, edx
mov dword [esp + 0x10], eax
mov edi, dword [0x45cbe0]
mov eax, 0x7f915fef
imul ebp
imul ebp, ebp, 0xa88a
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
mov eax, edi
imul edi, edi, 0xdc65
imul eax, eax, 0x8088
sub edx, eax
mov dword [0x45cbc8], edx
mov eax, 0x3e77639f
imul dword [0x45cbcc]
add edi, ebp
sar edx, 0xe
mov ebp, edx
add edi, edx
mov eax, 0x7f915fef
imul dword [0x45cbd4]
sar edx, 0xf
shr ebp, 0x1f
mov eax, edx
shr eax, 0x1f
add ebp, edi
add ebp, edx
add eax, ebp
sub eax, ebx
sub eax, ecx
push 0
lea ecx, [eax + esi + 0xa8e3]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45cbcc], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edx, dword [0x45cbd4]
mov ebx, dword [0x45cbc8]
mov edi, dword [0x45cbd8]
mov ebp, eax
lea eax, [ebx + edx]
imul eax, eax, 0x10649
mov ecx, eax
mov esi, dword [str._r_____r____]
mov eax, 0x5fa6246b
imul edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x1840c0e3
imul esi
sar edx, 0xc
mov eax, ecx
add eax, edx
mov ecx, edx
mov edx, dword [0x45cbe4]
shr ecx, 0x1f
add ecx, eax
mov eax, 0x2aa871e5
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x1006124d
imul esi, esi, 0xff9f
imul edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
cmp ebp, 0xffffffff
mov dword [0x45cbe4], ecx
jne 0x4066bf
mov esi, dword [0x45cbd0]
imul ebx, ebx, 0xa88a
mov eax, 0x94adc77f
imul esi
add edx, esi
sar edx, 0xf
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x6051edb
imul esi
sar edx, 0xb
mov ebp, edx
add edi, edx
mov eax, 0xc26c7c39
imul esi
add edx, esi
sar edx, 0xf
shr ebp, 0x1f
mov esi, edx
add ebp, edi
add ebp, edx
mov eax, 0x7f915fef
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x8088
shr esi, 0x1f
add esi, ebp
add esi, ebx
sub esi, ecx
sub esi, edx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45cbc8], esi
call fcn.00430726
add esp, 4
jmp 0x406e9f
mov edx, dword [0x45cbd0]
imul ebx, ebx, 0x100de
mov esi, dword [0x45cbe8]
mov eax, 0x1840c0e3
imul esi, esi, 0xd60e
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xc26c7c39
imul edi
add edx, edi
imul edi, edi, 0x18014
sar edx, 0xf
add esi, edx
mov eax, edx
mov edx, dword [0x45cbdc]
shr eax, 0x1f
add eax, esi
add eax, ebx
add eax, edi
mov esi, eax
mov eax, 0x2aa871e5
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
lea ecx, [esp + 0x18]
push ecx
sub esi, 0xa88a
push ebp
mov dword [0x45cbd0], esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4067bb
mov esi, dword [0x45cbdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45cbd8]
lea edi, [edx + ecx]
imul ecx, ecx, 0xff9f
mov eax, esi
imul edi, edi, 0x100de
imul eax, eax, 0xdc65
add edi, eax
mov eax, 0x3e77639f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1006124d
imul esi
mov esi, dword [0x45cbe0]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, esi
add eax, edi
lea ecx, [ecx + eax - 0xa88a]
push ebp
mov dword [0x45cbd4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406e9f
mov ecx, dword [0x45cbe8]
mov eax, 0x94adc77f
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x264545a3
imul ecx
imul ecx, ecx, 0xa88a
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
sub edi, ecx
mov ecx, dword [0x45cbe0]
mov eax, 0x3e77639f
imul ecx
mov eax, dword [0x45cbc8]
sar edx, 0xe
imul eax, eax, 0xff9f
add edi, edx
mov esi, edx
mov edx, ecx
imul edx, edx, 0x10649
shr esi, 0x1f
add esi, edi
add esi, edx
mov edx, dword [0x45cbd4]
add esi, eax
mov eax, 0x1006124d
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x45cbd8], esi
mov edx, dword [0x45cbcc]
imul ecx, ecx, 0x15433
mov eax, dword [0x45cbd0]
lea esi, [eax + edx]
imul esi, esi, 0x15696
add esi, ecx
mov ecx, dword [0x45cbdc]
mov eax, 0x7f915fef
imul ecx, ecx, 0xa88a
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, ecx
mov ecx, dword [0x45cbe4]
sub esi, eax
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
mov edi, edx
add esi, edx
mov eax, 0x1006124d
imul ecx
shr edi, 0x1f
sar edx, 0xc
add edi, esi
mov ecx, edx
add edi, edx
lea edx, [esp + 0x140]
shr ecx, 0x1f
push edx
lea eax, [esp + 0x40]
add ecx, edi
push eax
mov dword [0x45cbdc], ecx
call fcn.0043a55e
add esp, 8
test eax, eax
je 0x406b16
mov ecx, dword [0x45cbe8]
mov edx, dword [0x45cbd0]
lea esi, [edx + ecx]
mov eax, 0x5fa6246b
imul esi, esi, 0xa8e3
imul ecx
mov eax, dword [0x45cbd4]
mov ecx, dword [0x45cbd8]
imul eax, eax, 0xd60e
sar edx, 0xf
imul ecx, ecx, 0x15433
mov edi, edx
shr edi, 0x1f
add esi, edx
add edi, esi
sub edi, eax
add edi, ecx
mov ecx, dword [0x45cbcc]
mov eax, 0x1840c0e3
imul ecx
mov ecx, dword [0x45cbdc]
sar edx, 0xc
imul ecx, ecx, 0xa88a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
push edx
sub edi, eax
push 0
sub edi, ecx
push 0x1f0fff
mov dword [0x45cbe0], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45cbcc]
mov esi, eax
mov eax, 0x5fa6246b
imul ecx
sar edx, 0xf
mov edi, dword [0x45cbd4]
mov ebx, ecx
imul ebx, ebx, 0xdc65
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe8]
sub ebx, eax
imul edx, edx, 0xd60e
mov eax, dword [0x45cbdc]
imul eax, eax, 0x100de
add ebx, edx
add ebx, eax
mov eax, 0x2aa871e5
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
add ebx, edx
mov ecx, edx
mov eax, 0x1006124d
imul edi
shr ecx, 0x1f
sar edx, 0xc
add ecx, ebx
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
test esi, esi
mov dword [str._r_____r____], eax
jne 0x4069e8
push 0x44d030
call fcn.00430726
add esp, 4
jmp 0x406af8
mov ecx, dword [0x45cbd0]
mov eax, 0x94adc77f
imul ecx
add edx, ecx
sar edx, 0xf
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x6051edb
imul ecx
sar edx, 0xb
add edi, edx
mov ebx, edx
mov eax, 0xc26c7c39
imul ecx
add edx, ecx
mov ecx, dword [0x45cbc8]
imul ecx, ecx, 0xa88a
sar edx, 0xf
shr ebx, 0x1f
add ebx, edi
mov edi, edx
shr edi, 0x1f
add ebx, edx
add edi, ebx
add edi, ecx
mov ecx, dword [0x45cbe4]
mov eax, 0x7f915fef
imul ecx
mov ecx, dword [0x45cbe0]
sar edx, 0xf
imul ecx, ecx, 0x8088
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
sub edi, ecx
push esi
mov dword [0x45cbc8], edi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406a7c
push 0x44d01c
call fcn.00430726
add esp, 4
mov ecx, dword [0x45cbcc]
mov edx, dword [0x45cbd0]
mov eax, dword [0x45cbe0]
lea edi, [edx + ecx]
imul eax, eax, 0x15433
mov edx, dword [0x45cbdc]
imul edi, edi, 0x15696
imul edx, edx, 0xa88a
add edi, eax
add edi, edx
mov eax, 0x7f915fef
imul ecx
mov ecx, dword [0x45cbe4]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
mov ebx, edx
add edi, edx
mov eax, 0x1006124d
imul ecx
shr ebx, 0x1f
sar edx, 0xc
add ebx, edi
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
push esi
mov dword [0x45cbdc], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x18]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406ba4
mov ecx, dword [0x45cbe0]
jmp 0x406842
mov esi, dword [0x45cbe8]
mov eax, 0x94adc77f
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov edi, dword [0x45cbe0]
mov eax, 0x264545a3
imul esi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ecx
mov ecx, esi
imul ecx, ecx, 0xa88a
mov eax, 0x3e77639f
imul edi
imul edi, edi, 0x10649
sub ebx, ecx
sar edx, 0xe
add ebx, edx
mov ecx, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0xff9f
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [esp + 0x20]
add ecx, edi
mov edi, dword [0x45cbd4]
add ecx, edx
mov eax, 0x1006124d
imul edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x45cbd8], ecx
jmp 0x406bba
mov edi, dword [0x45cbd4]
mov esi, dword [0x45cbe8]
mov ecx, dword [0x45cbd8]
mov ebx, dword [esp + 0x14]
mov edx, dword [0x45cbd0]
imul ecx, ecx, 0x15433
imul edi, edi, 0xd60e
lea eax, [edx + esi]
imul eax, eax, 0xa8e3
mov dword [esp + 0x14], eax
mov eax, 0x5fa6246b
imul esi
mov eax, dword [esp + 0x14]
sar edx, 0xf
add eax, edx
mov esi, edx
shr esi, 0x1f
add esi, eax
sub esi, edi
add esi, ecx
mov ecx, dword [0x45cbcc]
mov eax, 0x1840c0e3
imul ecx
mov ecx, dword [0x45cbdc]
sar edx, 0xc
imul ecx, ecx, 0xa88a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
push ebp
mov dword [0x45cbe0], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x45cbe0]
mov edx, dword [0x45cbe8]
imul esi, esi, 0xdc65
mov edi, dword [0x45cbe4]
imul edx, edx, 0xd60e
mov ecx, dword [0x45cbcc]
mov eax, edi
imul eax, eax, 0xa88a
sub esi, edx
add esi, eax
mov eax, 0x3e77639f
imul ecx
sar edx, 0xe
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45cbd4]
mov eax, 0x7f915fef
imul esi
sar edx, 0xf
add ecx, edx
mov ebp, edx
mov eax, 0x1006124d
imul esi
shr ebp, 0x1f
sar edx, 0xc
add ebp, ecx
mov ecx, dword [str._r_____r____]
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
sub eax, ecx
add eax, 0xa8e3
test ebx, ebx
mov dword [0x45cbcc], eax
je 0x406e30
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45cbd0]
mov esi, dword [0x45cbe8]
mov edi, eax
imul esi, esi, 0xd60e
mov ebx, dword [0x45cbd8]
mov eax, 0x1840c0e3
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xc26c7c39
imul ebx
add edx, ebx
sar edx, 0xf
add esi, edx
mov ecx, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0x100de
mov eax, ebx
imul eax, eax, 0x18014
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45cbdc]
mov ebp, dword [0x45cbe4]
add ecx, edx
add ecx, eax
mov eax, 0x2aa871e5
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, ebp
sub ecx, 0xa88a
test edi, edi
mov dword [0x45cbd0], ecx
je 0x406e9f
mov ecx, dword [str._r_____r____]
add ebx, ecx
imul ecx, ecx, 0xff9f
mov edx, esi
imul ebx, ebx, 0x100de
imul edx, edx, 0xdc65
add ebx, edx
mov eax, 0x3e77639f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1006124d
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, dword [0x45cbe0]
add eax, ebx
push 0
lea ecx, [ecx + eax - 0xa88a]
push edi
mov dword [0x45cbd4], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45cbe8]
mov edx, dword [0x45cbd0]
lea esi, [edx + ecx]
mov eax, 0x5fa6246b
imul esi, esi, 0xa8e3
imul ecx
mov eax, dword [0x45cbd4]
mov ecx, dword [0x45cbd8]
imul eax, eax, 0xd60e
imul ecx, ecx, 0x15433
sar edx, 0xf
mov ebx, edx
shr ebx, 0x1f
add esi, edx
add ebx, esi
sub ebx, eax
add ebx, ecx
mov ecx, dword [0x45cbcc]
mov eax, 0x1840c0e3
imul ecx
mov ecx, dword [0x45cbdc]
sar edx, 0xc
imul ecx, ecx, 0xa88a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, ecx
push edi
mov dword [0x45cbe0], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x406ea1
mov edx, dword [0x45cbc8]
lea ebx, [edx + esi]
mov esi, dword [0x45cbd8]
imul ebx, ebx, 0x10649
mov eax, 0x5fa6246b
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1840c0e3
imul ecx
imul ecx, ecx, 0xff9f
sar edx, 0xc
add ebx, edx
mov ebp, edx
mov eax, 0x2aa871e5
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebp, 0x1f
add ebp, ebx
sub ebp, eax
mov eax, 0x1006124d
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov dword [0x45cbe4], ebp
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042fa4d
add esp, 0x238
ret