Function at 0x4065b0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x45f540]
mov edx, dword [esp + 0x23c]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44e064
stosb byte es:[edi], al
lea eax, [esp + 0x148]
push 0x104
push eax
call fcn.0043119c
mov ecx, dword [0x45dbd4]
mov eax, 0x771da23
imul ecx
sar edx, 8
mov ebx, dword [0x45dbcc]
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x77668d35
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x77668d35
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
sub ebp, ecx
mov edi, dword [0x45dbe8]
mov eax, 0x98742075
imul edi, edi, 0x2214
imul ebx
add edx, ebx
mov ecx, ebx
imul ecx, ecx, 0x2179
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebp, ecx
mov ecx, dword [0x45dbdc]
sub ebp, eax
imul ecx, ecx, 0x147d
mov eax, 0x3d2f2c3f
imul dword [0x45dbd0]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebp, edi
add ecx, ebp
mov ebp, eax
mov eax, 0xc7eb4e25
imul dword [0x45dbe4]
add edx, dword [0x45dbe4]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ecx, esi
mov eax, 0x92bc6f7d
add esp, 0x10
imul dword [0x45dbd0]
mov dword [str._r_____r____], ecx
add edx, dword [0x45dbd0]
sar edx, 0xb
add ebp, edx
mov eax, edx
mov edx, dword [0x45dbe0]
shr eax, 0x1f
imul edx, edx, 0x736
add eax, ebp
add eax, edx
mov ebp, eax
mov eax, 0x6931b881
imul dword [0x45dbd0]
sar edx, 9
add ebp, edx
mov eax, edx
mov edx, dword [0x45dbc8]
shr eax, 0x1f
imul edx, edx, 0x4de
add eax, ebp
mov ebp, dword [0x45dbe0]
add eax, edx
imul ebp, ebp, 0x2179
mov dword [0x45dbc8], eax
mov eax, 0xc7eb4e25
imul dword [0x45dbd4]
add edx, dword [0x45dbd4]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov dword [esp + 0x10], eax
mov eax, 0x49e7e4dd
imul ebx
mov eax, dword [esp + 0x10]
sar edx, 0xa
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, dword [0x45dbe4]
imul eax, eax, 0x4de
add ebx, eax
sub ebx, edi
sub ebx, ecx
push 0
lea eax, [ebx + esi + 0x1cbc]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45dbcc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x45dbd8]
mov ecx, dword [0x45dbd4]
mov edi, dword [0x45dbc8]
mov ebx, eax
mov eax, 0x771da23
imul esi
lea ebp, [edi + ecx]
mov ecx, dword [0x45dbe4]
imul ebp, ebp, 0xddb
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x77668d35
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebp, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x2263
mov eax, 0x8e8c0a95
add ebp, edx
imul ecx
add edx, ecx
sar edx, 0xc
add ebp, edx
mov ecx, edx
mov eax, 0x98742075
imul esi
add edx, esi
sar edx, 0xc
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, ebp
add eax, edx
sub ecx, eax
cmp ebx, 0xffffffff
mov dword [0x45dbe4], ecx
jne 0x40689d
mov esi, dword [0x45dbd0]
imul edi, edi, 0x4de
mov eax, 0x3d2f2c3f
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xc7eb4e25
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x92bc6f7d
imul esi
add edx, esi
sub ebx, ecx
sar edx, 0xb
mov ecx, edx
add ebx, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x736
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
mov eax, 0x6931b881
imul esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
add eax, edi
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45dbc8], eax
call fcn.00431136
add esp, 4
jmp 0x4070a5
mov edx, dword [0x45dbdc]
imul edi, edi, 0x147d
mov eax, 0x77668d35
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x2214
mov ebp, esi
imul ebp, ebp, 0x224e
sub ebp, eax
add ebp, edx
mov edx, dword [0x45dbd0]
mov eax, 0x8e8c0a95
imul edx
add edx, dword [0x45dbd0]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x6931b881
imul esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add ebp, edi
add ebp, edx
add eax, ebp
sub eax, ecx
lea ecx, [esp + 0x18]
push ecx
sub eax, 0x4de
push ebx
mov dword [0x45dbd0], eax
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
mov eax, 0x771da23
jne 0x40699a
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45dbd8]
mov esi, dword [0x45dbdc]
lea edi, [edx + ecx]
imul esi
imul ecx, ecx, 0x2263
imul edi, edi, 0x147d
sar edx, 8
mov eax, esi
imul eax, eax, 0x2179
mov ebp, edx
shr ebp, 0x1f
add edi, edx
add ebp, edi
add ebp, ecx
add ebp, eax
mov eax, 0x49e7e4dd
imul esi
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe0]
sub ebp, ecx
lea eax, [edx + ebp - 0x4de]
push ebx
mov dword [0x45dbd4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4070a5
mov ecx, dword [0x45dbd4]
imul ecx
mov esi, dword [0x45dbe8]
mov edi, dword [0x45dbc8]
sar edx, 8
imul edi, edi, 0x2263
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x1e0c7127
imul esi
sar edx, 0xa
mov ebp, edx
sub edi, ecx
mov ecx, dword [0x45dbe0]
add edi, edx
mov eax, 0x3d2f2c3f
imul esi
imul esi, esi, 0x4de
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebp, 0x1f
add ebp, edi
sub ebp, eax
mov eax, 0x49e7e4dd
imul ecx
sar edx, 0xa
add ebp, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0xddb
shr eax, 0x1f
add eax, ebp
add eax, edx
sub eax, esi
mov dword [0x45dbd8], eax
jmp 0x406a20
mov esi, dword [0x45dbcc]
imul ecx, ecx, 0xdf5
mov eax, dword [0x45dbd0]
mov edi, dword [0x45dbe4]
lea ebp, [eax + esi]
mov eax, 0x771da23
imul ebp, ebp, 0x1ade
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov ebp, eax
mov eax, 0x77668d35
imul edi
sar edx, 0xc
mov edi, edx
add ebp, edx
mov eax, 0xc7eb4e25
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
add edi, ebp
sub edi, eax
add edi, ecx
mov ecx, dword [0x45dbdc]
imul ecx, ecx, 0x4de
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
add edi, ecx
push eax
mov dword [0x45dbdc], edi
call fcn.0043af6e
add esp, 8
test eax, eax
je 0x406d07
mov ecx, dword [0x45dbe8]
mov edx, dword [0x45dbd0]
mov eax, dword [0x45dbd4]
mov esi, dword [0x45dbcc]
imul eax, eax, 0x2214
lea edi, [edx + ecx]
imul edi, edi, 0x1cbc
sub edi, eax
mov eax, 0x8e8c0a95
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x98742075
imul ecx
mov eax, dword [0x45dbdc]
add edx, ecx
imul eax, eax, 0x4de
sar edx, 0xc
mov ecx, edx
add edi, edx
mov edx, dword [0x45dbd8]
imul edx, edx, 0xdf5
shr ecx, 0x1f
add ecx, edi
add ecx, edx
sub ecx, eax
mov dword [0x45dbe0], ecx
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45dbd4]
mov esi, eax
mov eax, 0x771da23
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x77668d35
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45dbcc]
mov eax, 0x77668d35
imul ecx
sar edx, 0xc
add edi, edx
mov ebp, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x2214
mov eax, ecx
imul eax, eax, 0x2179
shr ebp, 0x1f
add ebp, edi
add ebp, edx
add ebp, eax
mov eax, 0x98742075
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbdc]
imul edx, edx, 0x147d
sub ebp, ecx
add ebp, edx
test esi, esi
mov dword [str._r_____r____], ebp
jne 0x406bd3
push 0x44e030
call fcn.00431136
add esp, 4
jmp 0x406ce9
mov ecx, dword [0x45dbd0]
mov edi, dword [0x45dbe4]
mov eax, 0x3d2f2c3f
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0xc7eb4e25
imul edi
add edx, edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x92bc6f7d
imul ecx
add edx, ecx
sar edx, 0xb
mov edi, edx
add ebp, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x736
shr edi, 0x1f
add edi, ebp
add edi, edx
mov eax, 0x6931b881
imul ecx
mov ecx, dword [0x45dbc8]
imul ecx, ecx, 0x4de
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, ecx
push esi
mov dword [0x45dbc8], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406c68
push 0x44e01c
call fcn.00431136
add esp, 4
mov ecx, dword [0x45dbcc]
mov edx, dword [0x45dbd0]
mov edi, dword [0x45dbe4]
lea ebp, [edx + ecx]
mov eax, 0x771da23
imul ebp, ebp, 0x1ade
imul edi
sar edx, 8
mov eax, edx
add ebp, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x77668d35
imul edi
sar edx, 0xc
mov edi, edx
add ebp, edx
mov eax, 0xc7eb4e25
imul ecx
add edx, ecx
mov ecx, dword [0x45dbe0]
sar edx, 0xc
imul ecx, ecx, 0xdf5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbdc]
shr edi, 0x1f
imul edx, edx, 0x4de
add edi, ebp
sub edi, eax
add edi, ecx
add edi, edx
push esi
mov dword [0x45dbdc], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x18]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406da3
mov ecx, dword [0x45dbe0]
jmp 0x406a20
mov edi, dword [0x45dbd4]
mov ecx, dword [0x45dbc8]
mov esi, dword [0x45dbe8]
imul ecx, ecx, 0x2263
mov eax, 0x771da23
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x1e0c7127
imul esi
sar edx, 0xa
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov dword [esp + 0x10], eax
mov ebp, dword [0x45dbe0]
mov eax, 0x3d2f2c3f
imul esi
mov eax, dword [esp + 0x10]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov dword [esp + 0x10], eax
mov eax, 0x49e7e4dd
imul ebp
imul ebp, ebp, 0xddb
mov eax, dword [esp + 0x10]
sar edx, 0xa
add eax, edx
mov ecx, edx
mov edx, esi
imul edx, edx, 0x4de
shr ecx, 0x1f
add ecx, eax
mov eax, dword [esp + 0x20]
add ecx, ebp
sub ecx, edx
mov dword [0x45dbd8], ecx
mov dword [esp + 0x14], eax
jmp 0x406db5
mov edi, dword [0x45dbd4]
mov esi, dword [0x45dbe8]
mov ecx, dword [0x45dbd8]
mov edx, dword [0x45dbd0]
imul edi, edi, 0x2214
imul ecx, ecx, 0xdf5
lea ebp, [edx + esi]
imul ebp, ebp, 0x1cbc
sub ebp, edi
mov edi, dword [0x45dbcc]
mov eax, 0x8e8c0a95
imul edi
add edx, edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x98742075
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
add eax, ecx
mov ecx, dword [0x45dbdc]
imul ecx, ecx, 0x4de
sub eax, ecx
push ebx
mov dword [0x45dbe0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x45dbd4]
mov eax, 0x771da23
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
mov esi, eax
imul edx, edx, 0x2214
mov eax, dword [0x45dbe0]
imul eax, eax, 0x2179
sub esi, edx
add esi, eax
mov eax, 0xc7eb4e25
imul ecx
add edx, ecx
sar edx, 0xc
add esi, edx
mov edi, edx
mov edx, dword [0x45dbcc]
mov eax, 0x49e7e4dd
imul edx
sar edx, 0xa
shr edi, 0x1f
add edi, esi
mov esi, dword [str._r_____r____]
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, dword [0x45dbe4]
mov edx, edi
imul edx, edx, 0x4de
add eax, edx
sub eax, esi
add eax, 0x1cbc
mov dword [0x45dbcc], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x407030
mov eax, dword [esp + 0x20]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45dbdc]
mov ebx, dword [0x45dbd8]
mov edi, eax
mov eax, 0x77668d35
imul esi
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x2214
mov ebp, ebx
imul ebp, ebp, 0x224e
sub ebp, ecx
mov ecx, dword [0x45dbd0]
add ebp, edx
mov eax, 0x8e8c0a95
imul ecx
add edx, ecx
mov ecx, dword [0x45dbc8]
sar edx, 0xc
imul ecx, ecx, 0x147d
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x6931b881
imul ebx
sar edx, 9
add ebp, ecx
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [0x45dbe4]
add eax, ebp
sub eax, edx
sub eax, 0x4de
test edi, edi
mov dword [0x45dbd0], eax
je 0x4070a5
mov ecx, dword [str._r_____r____]
add ebx, ecx
imul ecx, ecx, 0x2263
mov eax, 0x771da23
imul ebx, ebx, 0x147d
imul esi
sar edx, 8
mov ebp, edx
add ebx, edx
shr ebp, 0x1f
mov eax, 0x49e7e4dd
imul esi
add ebp, ebx
add ebp, ecx
mov ecx, esi
imul ecx, ecx, 0x2179
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add ebp, ecx
mov ecx, dword [0x45dbe0]
add eax, edx
sub ebp, eax
push 0
lea edx, [ecx + ebp - 0x4de]
push edi
mov dword [0x45dbd4], edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45dbe8]
mov eax, dword [0x45dbd0]
mov edx, dword [0x45dbd4]
mov esi, dword [0x45dbcc]
imul edx, edx, 0x2214
lea ebx, [eax + ecx]
imul ebx, ebx, 0x1cbc
sub ebx, edx
mov eax, 0x8e8c0a95
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x98742075
imul ecx
mov eax, dword [0x45dbdc]
add edx, ecx
imul eax, eax, 0x4de
sar edx, 0xc
mov ecx, edx
add ebx, edx
mov edx, dword [0x45dbd8]
imul edx, edx, 0xdf5
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
sub ecx, eax
push edi
mov dword [0x45dbe0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4070a7
mov edx, dword [0x45dbc8]
lea ebx, [edx + ecx]
mov ecx, dword [0x45dbd8]
imul ebx, ebx, 0xddb
mov eax, 0x771da23
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x77668d35
imul edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x2263
sub ebx, eax
add ebx, edx
mov eax, 0x8e8c0a95
imul esi
add edx, esi
sar edx, 0xc
add ebx, edx
mov esi, edx
mov eax, 0x98742075
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add esi, ebx
add eax, edx
sub esi, eax
mov dword [0x45dbe4], esi
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043045d
add esp, 0x238
ret