Function at 0x406680
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x23c
mov eax, dword [0x460640]
mov edx, dword [esp + 0x240]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x248], eax
xor eax, eax
mov byte [esp + 0x144], 0
mov ecx, 0x40
lea edi, [esp + 0x145]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44f064
stosb byte es:[edi], al
lea eax, [esp + 0x14c]
push 0x104
push eax
call fcn.004320ac
mov ebx, dword [0x45ebd8]
mov ecx, dword [0x45ebcc]
mov eax, 0x1671bc81
imul ebx
sar edx, 0x1a
mov esi, edx
mov ebp, dword [0x45ebd4]
shr esi, 0x1f
add esi, edx
mov eax, 0x1671bc81
imul ecx
mov ecx, dword [0x45ebdc]
sar edx, 0x1a
imul ecx, ecx, 0x564c079b
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x1a129787
imul ebp
sar edx, 0x1a
add edi, ecx
add edi, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, edi
mov edi, dword [0x45ebe0]
mov edx, edi
imul edx, edx, 0xe74a505
add ecx, edx
mov eax, 0x4eb7d3f9
imul ebp
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, edi
imul eax, eax, 0x5c7bb4
mov dword [esp + 0x24], eax
mov eax, 0x78d1ad69
imul edi
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x24]
sub edx, eax
mov dword [esp + 0x24], edx
mov eax, 0x46d65f19
imul dword [0x45ebd0]
mov eax, dword [esp + 0x24]
sar edx, 0x1a
mov edi, edx
sub ecx, esi
add eax, edx
mov edx, dword [0x45ebe4]
shr edi, 0x1f
add esp, 0x10
mov dword [str._r_____r____], ecx
add edi, eax
mov eax, 0x81b5a619
imul ebx, ebx, 0x7e501e9
imul ecx, ecx, 0x34652235
imul edx
add edx, dword [0x45ebe4]
sar edx, 0x1a
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [esp + 0x14], eax
mov eax, 0x4c8f4365
imul dword [0x45ebdc]
mov eax, dword [esp + 0x14]
sar edx, 0x1c
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
add edi, ebx
mov eax, 0x3dbc891d
imul dword [0x45ebdc]
sar edx, 0x1b
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x1671bc81
imul edi
sar edx, 0x1a
add ebx, edx
mov dword [0x45ebc8], edi
mov edi, edx
mov eax, 0x78d1ad69
imul dword [0x45ebd0]
sar edx, 0x1c
shr edi, 0x1f
add edi, ebx
mov ebx, edx
add edi, edx
mov eax, 0x4eb7d3f9
imul dword [0x45ebe0]
shr ebx, 0x1f
sar edx, 0x1c
add ebx, edi
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x81b5a619
imul ebp
add edx, ebp
sar edx, 0x1a
sub ebx, ecx
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
push 0
sub eax, esi
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45ebcc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [str._r_____r____]
mov ebx, eax
mov eax, 0x3dbc891d
imul edi
sar edx, 0x1b
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ebe4]
mov eax, 0x1671bc81
imul edx
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], ebx
sub ecx, eax
mov edx, dword [0x45ebd4]
imul edx, edx, 0x43ce2184
mov esi, dword [0x45ebd8]
add ecx, edx
mov edx, dword [0x45ebcc]
mov eax, 0x1a129787
imul edx
mov ebp, dword [0x45ebd0]
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x2746608a
sub ecx, eax
add ecx, edx
mov eax, 0x4eb7d3f9
imul ebp
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp ebx, 0xffffffff
mov dword [0x45ebe4], ecx
jne 0x406985
mov edx, dword [0x45ebe0]
imul esi, esi, 0x7e501e9
mov edi, edx
mov eax, 0x78d1ad69
imul edi, edi, 0x5c7bb4
imul edx
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x46d65f19
imul ebp
sar edx, 0x1a
add edi, edx
mov ebx, edx
mov eax, 0x81b5a619
imul ecx
add edx, ecx
mov ecx, dword [0x45ebdc]
sar edx, 0x1a
shr ebx, 0x1f
add ebx, edi
mov edi, edx
add ebx, edx
mov eax, 0x4c8f4365
imul ecx
sar edx, 0x1c
shr edi, 0x1f
mov ecx, edx
add edi, ebx
shr ecx, 0x1f
add edi, edx
add ecx, edi
add ecx, esi
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45ebc8], ecx
call fcn.00432046
add esp, 4
jmp 0x4071a8
mov eax, 0x3dbc891d
imul ecx, ecx, 0x21e6e566
imul edi, edi, 0x2d9fc474
imul ebp
sar edx, 0x1b
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0xe98e437f
imul dword [0x45ebe8]
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
add eax, edi
add eax, ecx
mov ebp, eax
mov eax, dword [0x45ebe8]
imul eax, eax, 0x34652235
add ebp, eax
mov eax, 0x81b5a619
imul esi
add edx, esi
sar edx, 0x1a
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov ebp, dword [0x45ebe0]
lea edx, [esp + 0x1c]
sub ecx, ebp
push edx
sub ecx, 0x7e501e9
push ebx
mov dword [0x45ebd0], ecx
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
mov eax, 0x1a129787
jne 0x406a80
mov ecx, dword [0x45ebdc]
mov esi, dword [0x45ebe8]
imul ecx
imul esi, esi, 0x2746608a
sar edx, 0x1a
mov ebp, dword [0x45ebe4]
mov edi, edx
add esi, edx
mov eax, 0x1e3444b9
imul ecx
mov ecx, dword [0x45ebc8]
sar edx, 0x1a
imul ecx, ecx, 0xe74a505
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x43cdcacc
shr edi, 0x1f
add edi, esi
sub edi, eax
add ecx, ebp
add ecx, edi
lea eax, [edx + ecx - 0x7e501e9]
push ebx
mov dword [0x45ebd4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4071a8
mov edi, dword [0x45ebc8]
imul edi
sar edx, 0x1a
mov ecx, edx
mov esi, edi
imul esi, esi, 0x2746608a
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45ebcc]
mov edx, ecx
imul edx, edx, 0x21e710c2
add esi, edx
mov edx, dword [0x45ebe0]
mov eax, 0x1e3444b9
imul edx
sar edx, 0x1a
add esi, edx
mov ebp, edx
mov eax, 0x46d65f19
imul dword [0x45ebe8]
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebp, 0x1f
add ebp, esi
mov esi, dword [str._r_____r____]
sub ebp, eax
mov eax, 0x9c59c36b
imul esi
add edx, esi
sar edx, 0x1d
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov ebp, eax
mov eax, dword [0x45ebe8]
imul eax, eax, 0x7e501e9
sub ebp, eax
mov dword [0x45ebd8], ebp
lea esp, [esp]
mov edx, dword [0x45ebd0]
imul edi, edi, 0x3580338c
imul esi, esi, 0x7e501e9
mov eax, 0x1671bc81
imul edx
sar edx, 0x1a
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x45ebe4]
mov eax, 0x1a129787
imul edx
sar edx, 0x1a
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x78d1ad69
imul ecx
imul ecx, ecx, 0x68114d02
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
lea ecx, [esp + 0x144]
add ebp, edi
push ecx
lea edx, [esp + 0x44]
add ebp, esi
push edx
mov dword [0x45ebdc], ebp
call fcn.0043be7e
add esp, 8
test eax, eax
je 0x406dea
mov ecx, dword [0x45ebd0]
mov eax, dword [0x45ebd4]
lea esi, [ecx + eax]
mov eax, 0x3dbc891d
imul esi, esi, 0x212c5ae6
imul ecx
sar edx, 0x1b
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ebc8]
imul edx, edx, 0x34652235
sub esi, ecx
mov ecx, dword [0x45ebe8]
sub esi, edx
mov eax, 0x4eb7d3f9
imul ecx
mov ecx, dword [0x45ebcc]
sar edx, 0x1c
imul ecx, ecx, 0x7e501e9
mov eax, edx
add esi, edx
mov edx, dword [0x45ebd8]
imul edx, edx, 0x3580338c
shr eax, 0x1f
add eax, esi
sub eax, ecx
add eax, edx
mov dword [0x45ebe0], eax
mov eax, dword [esp + 0x24]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45ebcc]
mov esi, eax
mov eax, 0x1671bc81
imul ecx
sar edx, 0x1a
mov ecx, edx
mov ebx, dword [0x45ebdc]
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x45ebd8]
mov ebp, dword [0x45ebd4]
mov eax, 0x1671bc81
imul ecx
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov edx, ebx
imul edx, edx, 0x564c079b
add edi, edx
mov eax, 0x1a129787
imul ebp
sar edx, 0x1a
mov eax, edx
add edi, edx
shr eax, 0x1f
add eax, edi
mov edi, dword [0x45ebe0]
mov edx, edi
imul edx, edx, 0xe74a505
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x4eb7d3f9
imul ebp
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
test esi, esi
mov dword [str._r_____r____], edx
jne 0x406cb5
push 0x44f030
call fcn.00432046
add esp, 4
jmp 0x406db8
mov eax, 0x78d1ad69
imul ecx, ecx, 0x7e501e9
imul edi
mov ebp, edi
sar edx, 0x1c
imul ebp, ebp, 0x5c7bb4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ebd0]
sub ebp, eax
mov edi, dword [0x45ebe4]
mov eax, 0x46d65f19
imul edx
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov ebp, eax
mov eax, 0x81b5a619
imul edi
add edx, edi
sar edx, 0x1a
mov edi, edx
add ebp, edx
mov eax, 0x4c8f4365
imul ebx
sar edx, 0x1c
shr edi, 0x1f
mov eax, edx
add edi, ebp
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, ecx
push esi
mov dword [0x45ebc8], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406d3e
push 0x44f01c
call fcn.00432046
add esp, 4
mov ecx, dword [0x45ebd0]
mov eax, 0x1671bc81
imul ecx
mov ecx, dword [0x45ebe4]
sar edx, 0x1a
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x1a129787
imul ecx
mov ecx, dword [0x45ebcc]
sar edx, 0x1a
mov ebx, edx
add edi, edx
mov eax, 0x78d1ad69
imul ecx
imul ecx, ecx, 0x68114d02
sar edx, 0x1c
shr ebx, 0x1f
mov eax, edx
add ebx, edi
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub ebx, eax
imul edx, edx, 0x7e501e9
add ebx, ecx
mov ecx, dword [0x45ebc8]
imul ecx, ecx, 0x3580338c
add ebx, ecx
add ebx, edx
push esi
mov dword [0x45ebdc], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
mov ebx, dword [esp + 0x18]
je 0x406e86
mov esi, dword [str._r_____r____]
mov ecx, dword [0x45ebcc]
mov edi, dword [0x45ebc8]
jmp 0x406b10
mov esi, dword [0x45ebc8]
mov edi, dword [0x45ebcc]
mov eax, 0x1a129787
imul esi
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, esi
imul ebp, ebp, 0x2746608a
sub ebp, eax
mov ecx, edi
imul ecx, ecx, 0x21e710c2
add ebp, ecx
mov ecx, dword [0x45ebe0]
mov eax, 0x1e3444b9
imul ecx
sar edx, 0x1a
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ecx, dword [str._r_____r____]
mov ebp, eax
mov eax, 0x46d65f19
imul dword [0x45ebe8]
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x9c59c36b
imul ecx
mov eax, dword [esp + 0x24]
add edx, ecx
sar edx, 0x1d
add ebp, edx
mov ecx, edx
mov edx, dword [0x45ebe8]
imul edx, edx, 0x7e501e9
shr ecx, 0x1f
add ecx, ebp
sub ecx, edx
mov dword [0x45ebd8], ecx
mov dword [esp + 0x14], eax
jmp 0x406e98
mov ecx, dword [0x45ebd8]
mov edi, dword [0x45ebcc]
mov esi, dword [0x45ebc8]
mov edx, dword [0x45ebd0]
imul esi, esi, 0x34652235
imul edi, edi, 0x7e501e9
mov eax, dword [0x45ebd4]
imul ecx, ecx, 0x3580338c
lea ebp, [edx + eax]
mov eax, 0x3dbc891d
imul ebp, ebp, 0x212c5ae6
imul edx
sar edx, 0x1b
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x4eb7d3f9
imul dword [0x45ebe8]
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
sub ebp, esi
add ebp, edx
add eax, ebp
sub eax, edi
add eax, ecx
push ebx
mov dword [0x45ebe0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x45ebdc]
mov eax, 0x3dbc891d
imul ecx
mov ecx, dword [0x45ebc8]
sar edx, 0x1b
mov edi, dword [0x45ebd8]
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x1671bc81
imul ecx
sar edx, 0x1a
add esi, edx
mov ebx, dword [0x45ebd0]
mov ecx, edx
mov eax, 0x1671bc81
imul edi
sar edx, 0x1a
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, dword [str._r_____r____]
add ecx, esi
sub ecx, eax
mov eax, 0x78d1ad69
imul ebx
sar edx, 0x1c
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, ebp
imul ecx, ecx, 0x34652235
add eax, ecx
mov ecx, dword [0x45ebe0]
mov esi, dword [0x45ebd4]
mov dword [esp + 0x10], eax
mov eax, 0x4eb7d3f9
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x81b5a619
imul esi
add edx, esi
sar edx, 0x1a
mov eax, ecx
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [0x45ebcc], ecx
je 0x407140
mov ecx, dword [esp + 0x24]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45ebd0]
mov edi, eax
mov eax, 0x3dbc891d
imul ecx
mov ecx, dword [0x45ebe8]
sar edx, 0x1b
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xe98e437f
imul ecx
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, dword [0x45ebe4]
sub ebp, esi
imul eax, eax, 0x21e6e566
mov esi, dword [str._r_____r____]
mov ebx, dword [0x45ebd8]
mov edx, esi
imul edx, edx, 0x2d9fc474
add ebp, edx
mov edx, ecx
imul edx, edx, 0x34652235
add ebp, eax
add ebp, edx
mov eax, 0x81b5a619
imul ebx
add edx, ebx
mov ebx, dword [0x45ebe0]
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
sub eax, ebx
sub eax, 0x7e501e9
test edi, edi
mov dword [0x45ebd0], eax
je 0x4071a8
mov ebx, dword [0x45ebdc]
imul ecx, ecx, 0x2746608a
imul esi, esi, 0x43cdcacc
mov eax, 0x1a129787
imul ebx
sar edx, 0x1a
add ecx, edx
mov ebp, edx
mov eax, 0x1e3444b9
imul ebx
mov eax, dword [0x45ebe4]
sar edx, 0x1a
shr ebp, 0x1f
add ebp, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ebc8]
imul edx, edx, 0xe74a505
add edx, eax
sub ebp, ecx
add edx, ebp
push 0
lea eax, [esi + edx - 0x7e501e9]
push edi
mov dword [0x45ebd4], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45ebd0]
mov edx, dword [0x45ebd4]
lea esi, [ecx + edx]
mov eax, 0x3dbc891d
imul esi, esi, 0x212c5ae6
imul ecx
mov ecx, dword [0x45ebc8]
sar edx, 0x1b
imul ecx, ecx, 0x34652235
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45ebe8]
mov eax, 0x4eb7d3f9
imul ecx
mov ecx, dword [0x45ebcc]
sar edx, 0x1c
imul ecx, ecx, 0x7e501e9
mov eax, edx
add esi, edx
mov edx, dword [0x45ebd8]
imul edx, edx, 0x3580338c
shr eax, 0x1f
add eax, esi
sub eax, ecx
add eax, edx
push edi
mov dword [0x45ebe0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4071aa
mov eax, 0x3dbc891d
imul esi, esi, 0x43ce2184
imul edi, edi, 0x2746608a
imul ebp
sar edx, 0x1b
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ebe4]
mov ebp, eax
mov eax, 0x1671bc81
imul edx
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x1a129787
imul ecx
sar edx, 0x1a
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x4eb7d3f9
imul ebx
sar edx, 0x1c
add ebp, esi
mov eax, edx
sub ebp, ecx
shr eax, 0x1f
add ebp, edi
add eax, edx
sub ebp, eax
mov dword [0x45ebe4], ebp
xor eax, eax
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043136d
add esp, 0x23c
ret