Function at 0x406440
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x45e540]
mov edx, dword [esp + 0x23c]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44d064
stosb byte es:[edi], al
lea eax, [esp + 0x148]
push 0x104
push eax
call fcn.00430a4c
mov ebx, dword [0x45cbd4]
mov ebp, dword [0x45cbcc]
mov eax, 0xa3c4e0d7
imul ebx
mov eax, dword [0x45cbdc]
imul eax, eax, 0x63e546
add edx, ebx
sar edx, 0x16
mov ecx, ebp
imul ecx, ecx, 0x5643ad
add eax, ecx
mov ecx, eax
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x1b2eb4bf
imul ebx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x1b2eb4bf
imul ebp
sar edx, 0x14
mov eax, ecx
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x7a2fd6e1
imul ebp
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edi, dword [0x45cbe8]
mov eax, 0x2900b7f9
imul edi, edi, 0x53439e
imul dword [0x45cbe4]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x3e38df13
imul dword [0x45cbd0]
sar edx, 0x14
mov eax, edx
add ecx, esi
shr eax, 0x1f
add ecx, edi
add eax, edx
mov edx, dword [0x45cbc8]
add esp, 0x10
mov dword [str._r_____r____], ecx
sub eax, ebp
imul edx, edx, 0x41d422
add eax, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x32d358
sub eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x5ef6c237
imul dword [0x45cbd0]
mov eax, dword [esp + 0x10]
sar edx, 0x15
add eax, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0x3d3e7a09
imul dword [0x45cbd0]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov dword [0x45cbc8], eax
mov eax, 0x2900b7f9
imul ebx
mov eax, dword [0x45cbe4]
imul eax, eax, 0x41d422
sar edx, 0x14
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, eax
mov eax, dword [0x45cbe0]
imul eax, eax, 0x5643ad
add ebx, eax
mov eax, 0x4f7fd81
imul dword [0x45cbcc]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, edi
sub eax, ecx
push 0
lea ecx, [eax + esi + 0x41fb8b]
push 2
mov dword [esp + 0x18], 0
mov dword [0x45cbcc], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edx, dword [0x45cbd4]
mov ebx, dword [0x45cbc8]
mov edi, dword [str._r_____r____]
mov ebp, eax
lea esi, [ebx + edx]
mov eax, 0x3e13b50f
imul esi, esi, 0x670b79
imul edi
sar edx, 0x14
add esi, edx
mov ecx, edx
mov edx, dword [0x45cbe4]
mov eax, 0x1b2eb4bf
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45cbd8]
sub ecx, eax
mov eax, 0x7a2fd6e1
imul esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xa3c4e0d7
imul esi
add edx, esi
sar edx, 0x16
imul edi, edi, 0x640b17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, edi
cmp ebp, 0xffffffff
mov dword [0x45cbe4], ecx
jne 0x406714
mov eax, 0x2900b7f9
imul ebx, ebx, 0x41d422
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x45cbd0]
mov eax, 0x3e38df13
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x32d358
mov edi, eax
sub edi, esi
add edi, ebx
sub edi, edx
mov eax, 0x5ef6c237
imul ecx
sar edx, 0x15
mov esi, edx
add edi, edx
mov eax, 0x3d3e7a09
imul ecx
sar edx, 0x15
shr esi, 0x1f
mov eax, edx
add esi, edi
shr eax, 0x1f
add esi, edx
add eax, esi
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45cbc8], eax
call fcn.004309e6
add esp, 4
jmp 0x406ef1
mov edx, dword [0x45cbd0]
imul ebx, ebx, 0x63e546
mov eax, 0x3e13b50f
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3e38df13
imul esi
imul esi, esi, 0x96af7c
sar edx, 0x14
mov edi, edx
add ebx, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x53439e
shr edi, 0x1f
add edi, ebx
add edi, edx
mov edx, dword [0x45cbdc]
mov eax, 0x1b2eb4bf
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add edi, esi
add eax, edx
sub edi, eax
sub edi, ecx
lea ecx, [esp + 0x18]
push ecx
sub edi, 0x41d422
push ebp
mov dword [0x45cbd0], edi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40680d
mov esi, dword [0x45cbdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45cbd8]
lea edi, [edx + ecx]
imul ecx, ecx, 0x640b17
imul edi, edi, 0x63e546
mov eax, esi
imul eax, eax, 0x5643ad
add edi, eax
mov eax, 0xa3c4e0d7
imul esi
add edx, esi
sar edx, 0x16
mov ebx, edx
add edi, edx
mov eax, 0x4f7fd81
imul esi
shr ebx, 0x1f
add ebx, edi
add ebx, ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cbe0]
sub ebx, ecx
lea eax, [ebx + edx - 0x41d422]
push ebp
mov dword [0x45cbd4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406ef1
mov ecx, dword [0x45cbe8]
mov eax, 0xa1093dc9
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov esi, ecx
imul esi, esi, 0x41d422
mov eax, 0x6262bd7d
imul ecx
mov ecx, dword [0x45cbc8]
sar edx, 0x15
imul ecx, ecx, 0x640b17
sub edi, esi
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
add esi, ecx
mov ecx, dword [0x45cbd4]
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
mov ecx, dword [0x45cbe0]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4f7fd81
imul ecx
sar edx, 0x11
add esi, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x670b79
shr eax, 0x1f
add eax, esi
add eax, edx
mov dword [0x45cbd8], eax
mov edx, dword [0x45cbcc]
imul ecx, ecx, 0x85c28b
mov eax, dword [0x45cbd0]
lea esi, [eax + edx]
mov eax, 0x2900b7f9
imul esi, esi, 0x8616f6
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0x41d422
sub esi, eax
add esi, edx
add esi, ecx
mov ecx, dword [0x45cbe4]
mov eax, 0x1b2eb4bf
imul ecx
sar edx, 0x14
mov edi, edx
add esi, edx
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
sar edx, 0x16
shr edi, 0x1f
mov eax, edx
add edi, esi
add edi, edx
lea ecx, [esp + 0x140]
shr eax, 0x1f
push ecx
lea edx, [esp + 0x40]
add eax, edi
push edx
mov dword [0x45cbdc], eax
call fcn.0043a81e
add esp, 8
test eax, eax
je 0x406b6c
mov ecx, dword [0x45cbe8]
mov eax, dword [0x45cbd0]
mov edx, dword [0x45cbcc]
lea esi, [eax + ecx]
mov eax, 0x3e13b50f
imul esi, esi, 0x41fb8b
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0x41d422
sub esi, eax
mov eax, dword [0x45cbd4]
sub esi, edx
imul eax, eax, 0x53439e
mov edx, dword [0x45cbd8]
imul edx, edx, 0x85c28b
sub esi, eax
add esi, edx
mov eax, 0x7a2fd6e1
imul ecx
mov ecx, dword [esp + 0x20]
sar edx, 0x16
mov eax, edx
push ecx
shr eax, 0x1f
add esi, edx
push 0
add eax, esi
push 0x1f0fff
mov dword [0x45cbe0], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45cbcc]
mov ebx, dword [0x45cbdc]
mov esi, eax
imul ebx, ebx, 0x63e546
mov eax, dword [0x45cbe8]
mov edi, dword [0x45cbd4]
imul eax, eax, 0x53439e
mov edx, ecx
imul edx, edx, 0x5643ad
add ebx, edx
add ebx, eax
mov eax, 0x1b2eb4bf
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1b2eb4bf
imul ecx
sar edx, 0x14
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x7a2fd6e1
imul ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xa3c4e0d7
imul edi
add edx, edi
sar edx, 0x16
sub ebx, ecx
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
test esi, esi
mov dword [str._r_____r____], eax
jne 0x406a3d
push 0x44d030
call fcn.004309e6
add esp, 4
jmp 0x406b4e
mov ecx, dword [0x45cbe4]
mov eax, 0x2900b7f9
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x45cbd0]
mov eax, 0x3e38df13
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbc8]
mov ebx, eax
imul edx, edx, 0x41d422
mov eax, dword [0x45cbe0]
imul eax, eax, 0x32d358
sub ebx, edi
add ebx, edx
sub ebx, eax
mov eax, 0x5ef6c237
imul ecx
sar edx, 0x15
mov edi, edx
add ebx, edx
mov eax, 0x3d3e7a09
imul ecx
sar edx, 0x15
shr edi, 0x1f
mov ecx, edx
add edi, ebx
shr ecx, 0x1f
add edi, edx
add ecx, edi
push esi
mov dword [0x45cbc8], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406ad0
push 0x44d01c
call fcn.004309e6
add esp, 4
mov ecx, dword [0x45cbcc]
mov edx, dword [0x45cbd0]
lea edi, [edx + ecx]
mov eax, 0x2900b7f9
imul edi, edi, 0x8616f6
imul ecx
mov ecx, dword [0x45cbdc]
sar edx, 0x14
imul ecx, ecx, 0x41d422
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x85c28b
sub edi, eax
add edi, ecx
mov ecx, dword [0x45cbe4]
add edi, edx
mov eax, 0x1b2eb4bf
imul ecx
sar edx, 0x14
mov ebx, edx
add edi, edx
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
shr ebx, 0x1f
sar edx, 0x16
add ebx, edi
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
push esi
mov dword [0x45cbdc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406c00
mov ecx, dword [0x45cbe0]
jmp 0x406894
mov edi, dword [0x45cbe8]
mov eax, 0xa1093dc9
imul edi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov ecx, edi
imul ecx, ecx, 0x41d422
sub esi, ecx
mov ecx, dword [0x45cbc8]
mov eax, 0x6262bd7d
imul ecx, ecx, 0x640b17
imul edi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, dword [0x45cbd4]
add eax, ecx
mov ecx, eax
mov ebx, dword [0x45cbe0]
mov eax, 0xa3c4e0d7
imul esi
add edx, esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x4f7fd81
imul ebx
imul ebx, ebx, 0x670b79
mov eax, ecx
sar edx, 0x11
mov ecx, edx
add eax, edx
mov edx, dword [esp + 0x20]
shr ecx, 0x1f
add ecx, eax
add ecx, ebx
mov dword [0x45cbd8], ecx
mov dword [esp + 0x10], edx
jmp 0x406c12
mov esi, dword [0x45cbd4]
mov edi, dword [0x45cbe8]
mov ecx, dword [0x45cbd8]
mov eax, dword [0x45cbd0]
imul esi, esi, 0x53439e
imul ecx, ecx, 0x85c28b
mov edx, dword [0x45cbcc]
lea ebx, [eax + edi]
mov eax, 0x3e13b50f
imul ebx, ebx, 0x41fb8b
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0x41d422
sub ebx, eax
sub ebx, edx
mov eax, 0x7a2fd6e1
imul edi
sar edx, 0x16
sub ebx, esi
add ebx, ecx
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x45cbe0], eax
call ebp
mov ecx, dword [0x45cbd4]
mov edi, dword [0x45cbe4]
mov eax, 0x2900b7f9
imul ecx
mov eax, dword [0x45cbe0]
sar edx, 0x14
imul eax, eax, 0x5643ad
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, edi
imul edx, edx, 0x41d422
add esi, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x53439e
add esi, eax
sub esi, edx
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
sar edx, 0x16
add esi, edx
mov ebx, edx
mov edx, dword [0x45cbcc]
mov eax, 0x4f7fd81
imul edx
shr ebx, 0x1f
sar edx, 0x11
add ebx, esi
mov esi, dword [str._r_____r____]
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
add eax, 0x41fb8b
mov dword [0x45cbcc], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406e81
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45cbd0]
mov edi, eax
mov ebx, dword [0x45cbd8]
mov eax, 0x3e13b50f
imul ecx
mov ecx, dword [0x45cbc8]
sar edx, 0x14
imul ecx, ecx, 0x63e546
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x3e38df13
imul ebx
sar edx, 0x14
add ecx, edx
mov esi, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x53439e
mov eax, ebx
imul eax, eax, 0x96af7c
shr esi, 0x1f
add esi, ecx
mov ecx, dword [0x45cbdc]
add esi, edx
add esi, eax
mov eax, 0x1b2eb4bf
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, dword [0x45cbe4]
sub esi, 0x41d422
test edi, edi
mov dword [0x45cbd0], esi
je 0x406ef1
mov esi, dword [str._r_____r____]
add ebx, esi
imul esi, esi, 0x640b17
mov edx, ecx
imul ebx, ebx, 0x63e546
imul edx, edx, 0x5643ad
add ebx, edx
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
mov ebx, eax
mov eax, 0x4f7fd81
imul ecx
mov ecx, dword [0x45cbe0]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
push 0
lea edx, [ebx + ecx - 0x41d422]
push edi
mov dword [0x45cbd4], edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45cbe8]
mov eax, dword [0x45cbd0]
mov edx, dword [0x45cbcc]
lea esi, [eax + ecx]
mov eax, 0x3e13b50f
imul esi, esi, 0x41fb8b
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0x41d422
sub esi, eax
mov eax, dword [0x45cbd4]
sub esi, edx
imul eax, eax, 0x53439e
mov edx, dword [0x45cbd8]
imul edx, edx, 0x85c28b
sub esi, eax
add esi, edx
mov eax, 0x7a2fd6e1
imul ecx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
push edi
mov dword [0x45cbe0], eax
call ebp
mov eax, 1
jmp 0x406ef3
mov edx, dword [0x45cbc8]
add ecx, edx
imul ecx, ecx, 0x670b79
mov eax, 0x3e13b50f
imul esi
imul esi, esi, 0x640b17
sar edx, 0x14
add ecx, edx
mov ebx, edx
mov eax, 0x1b2eb4bf
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x45cbd8]
sub ebx, eax
mov eax, 0x7a2fd6e1
imul ecx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
add ebx, esi
mov dword [0x45cbe4], ebx
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042fd0d
add esp, 0x238
ret