Function at 0x406500
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x45f540]
mov edx, dword [esp + 0x23c]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44e064
stosb byte es:[edi], al
lea eax, [esp + 0x148]
push 0x104
push eax
call fcn.00430f0c
mov ebx, dword [0x45dbd4]
mov edi, dword [0x45dbcc]
mov eax, 0x830d168d
imul ebx
add edx, ebx
sar edx, 0x19
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x61b9fbc5
imul edi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, edi
imul ebp, ebp, 0x35f16dd
sub ebp, eax
mov ecx, dword [0x45dbe8]
mov eax, 0x56f92285
imul ecx, ecx, 0x3409f8e
imul ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x56f92285
imul edi
mov edi, dword [0x45dbd0]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [0x45dbdc]
add eax, ebp
imul ecx, ecx, 0x3e67c56
add ecx, eax
mov eax, 0x6386b3b9
imul edi
mov eax, dword [0x45dbe0]
sar edx, 0x18
imul eax, eax, 0x1fc96d8
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x2927ae2
add ebp, edx
sub ebp, eax
mov eax, 0x4bee9027
imul edi
sar edx, 0x18
add ecx, esi
mov eax, edx
add esp, 0x10
mov dword [str._r_____r____], ecx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov dword [esp + 0x14], eax
mov eax, 0x187fbc47
imul edi
mov eax, dword [esp + 0x14]
mov edi, dword [0x45dbe4]
sar edx, 0x17
add eax, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0x8345522b
imul edi
add edx, edi
imul edi, edi, 0x2927ae2
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x3f96a7f5
imul dword [0x45dbcc]
mov eax, dword [0x45dbe0]
imul eax, eax, 0x35f16dd
sar edx, 0x18
mov dword [0x45dbc8], ebp
mov ebp, edx
add edi, edx
shr ebp, 0x1f
add ebp, edi
add ebp, eax
mov eax, 0x8345522b
imul ebx
add edx, ebx
mov ebx, dword [esp + 0x10]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
sub eax, ebx
sub eax, ecx
push 0
lea ecx, [eax + esi + 0x293659b]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45dbcc], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edx, dword [0x45dbd4]
mov ebx, dword [0x45dbc8]
mov edi, dword [str._r_____r____]
mov ebp, eax
lea esi, [ebx + edx]
mov eax, 0x31b1a317
imul esi, esi, 0x406a069
imul edi
imul edi, edi, 0x3e828c7
sar edx, 0x17
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45dbd8]
mov eax, 0x61b9fbc5
imul esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x830d168d
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe4]
sub ecx, eax
add ecx, edi
mov eax, 0x56f92285
imul edx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp ebp, 0xffffffff
mov dword [0x45dbe4], ecx
mov eax, 0x6386b3b9
jne 0x4067cd
mov esi, dword [0x45dbd0]
imul ebx, ebx, 0x2927ae2
imul esi
sar edx, 0x18
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x1fc96d8
add edi, ebx
sub edi, edx
mov eax, 0x4bee9027
imul esi
sar edx, 0x18
mov ebx, edx
add edi, edx
mov eax, 0x187fbc47
imul esi
sar edx, 0x17
shr ebx, 0x1f
mov esi, edx
add ebx, edi
add ebx, edx
mov eax, 0x8345522b
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add eax, edx
add esi, ebx
sub esi, eax
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45dbc8], esi
call fcn.00430ea6
add esp, 4
jmp 0x406fb9
imul esi
imul esi, esi, 0x5e30a0c
imul ebx, ebx, 0x3e67c56
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbd0]
mov edi, eax
mov eax, 0x31b1a317
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x3409f8e
sub edi, eax
add edi, edx
mov edx, dword [0x45dbdc]
mov eax, 0x56f92285
imul edx
sar edx, 0x19
mov eax, edx
add edi, esi
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ebx
sub edi, ecx
lea ecx, [esp + 0x18]
push ecx
sub edi, 0x2927ae2
push ebp
mov dword [0x45dbd0], edi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
mov eax, 0x830d168d
jne 0x4068c2
mov ecx, dword [0x45dbdc]
mov esi, dword [str._r_____r____]
mov edx, dword [0x45dbd8]
lea edi, [edx + esi]
imul ecx
imul esi, esi, 0x3e828c7
imul edi, edi, 0x3e67c56
add edx, ecx
sar edx, 0x19
mov ebx, edx
add edi, edx
mov eax, 0x3f96a7f5
imul ecx
imul ecx, ecx, 0x35f16dd
sar edx, 0x18
shr ebx, 0x1f
mov eax, edx
add ebx, edi
shr eax, 0x1f
add ebx, esi
add eax, edx
mov edx, dword [0x45dbe0]
sub ebx, eax
add ebx, edx
lea ecx, [ecx + ebx - 0x2927ae2]
push ebp
mov dword [0x45dbd4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406fb9
mov esi, dword [0x45dbe8]
mov edi, dword [0x45dbc8]
mov ecx, dword [0x45dbd4]
imul edi, edi, 0x3e828c7
mov edx, esi
imul edx, edx, 0x2927ae2
sub edi, edx
imul ecx
add edx, ecx
mov ecx, dword [0x45dbe0]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3f96a7f5
imul ecx
sar edx, 0x18
add edi, edx
mov ebx, edx
mov edx, ecx
imul edx, edx, 0x406a069
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0x9d6ba841
imul esi
add edx, esi
sar edx, 0x19
add ebx, edx
mov edi, edx
mov eax, 0x4bee9027
imul esi
sar edx, 0x18
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, ebx
add eax, edx
sub edi, eax
mov dword [0x45dbd8], edi
jmp 0x406950
mov esi, dword [0x45dbcc]
imul ecx, ecx, 0x539869b
mov edx, dword [0x45dbd0]
mov eax, dword [0x45dbdc]
mov edi, dword [0x45dbe4]
imul eax, eax, 0x2927ae2
lea ebx, [edx + esi]
imul ebx, ebx, 0x53d3666
add ebx, eax
mov eax, 0x830d168d
imul edi
add edx, edi
sar edx, 0x19
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x56f92285
imul edi
sar edx, 0x19
mov edi, edx
add ebx, edx
mov eax, 0x8345522b
imul esi
shr edi, 0x1f
add edx, esi
sar edx, 0x19
add edi, ebx
add edi, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
sub edi, ecx
push eax
mov dword [0x45dbdc], edi
call fcn.0043acde
add esp, 8
test eax, eax
je 0x406c34
mov ecx, dword [0x45dbe8]
mov edx, dword [0x45dbd0]
mov eax, dword [0x45dbdc]
lea esi, [edx + ecx]
imul eax, eax, 0x2927ae2
mov edx, dword [0x45dbcc]
imul esi, esi, 0x293659b
sub esi, eax
mov eax, 0x31b1a317
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61b9fbc5
imul ecx
mov eax, dword [0x45dbd8]
sar edx, 0x19
imul eax, eax, 0x539869b
mov ecx, edx
add esi, edx
mov edx, dword [0x45dbd4]
imul edx, edx, 0x3409f8e
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
add ecx, eax
mov dword [0x45dbe0], ecx
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45dbcc]
mov esi, eax
mov edi, dword [0x45dbd4]
mov eax, 0x61b9fbc5
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x830d168d
imul edi
add edx, edi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x3409f8e
sub eax, ebx
add eax, edx
mov edx, ecx
imul edx, edx, 0x35f16dd
add eax, edx
mov ebx, eax
mov eax, 0x56f92285
imul edi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x56f92285
imul ecx
sar edx, 0x19
add ebx, edx
mov ecx, edx
mov edx, dword [0x45dbdc]
imul edx, edx, 0x3e67c56
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
test esi, esi
mov dword [str._r_____r____], ecx
jne 0x406b03
push 0x44e030
call fcn.00430ea6
add esp, 4
jmp 0x406c16
mov ecx, dword [0x45dbd0]
mov eax, 0x6386b3b9
imul ecx
mov eax, dword [0x45dbc8]
sar edx, 0x18
imul eax, eax, 0x2927ae2
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x1fc96d8
add edi, eax
sub edi, edx
mov eax, 0x4bee9027
imul ecx
sar edx, 0x18
add edi, edx
mov ebx, edx
mov eax, 0x187fbc47
imul ecx
mov ecx, dword [0x45dbe4]
sar edx, 0x17
shr ebx, 0x1f
add ebx, edi
mov edi, edx
add ebx, edx
mov eax, 0x8345522b
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
add edi, ebx
sub edi, eax
push esi
mov dword [0x45dbc8], edi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406b94
push 0x44e01c
call fcn.00430ea6
add esp, 4
mov ecx, dword [0x45dbcc]
mov edx, dword [0x45dbd0]
mov eax, dword [0x45dbdc]
mov edi, dword [0x45dbe4]
imul eax, eax, 0x2927ae2
lea ebx, [edx + ecx]
imul ebx, ebx, 0x53d3666
add ebx, eax
mov eax, 0x830d168d
imul edi
add edx, edi
sar edx, 0x19
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x56f92285
imul edi
sar edx, 0x19
mov edi, edx
add ebx, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x539869b
shr edi, 0x1f
add edi, ebx
add edi, edx
mov eax, 0x8345522b
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push esi
mov dword [0x45dbdc], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406cc6
mov ecx, dword [0x45dbe0]
jmp 0x406950
mov esi, dword [0x45dbe8]
mov ebx, dword [0x45dbc8]
mov edi, dword [0x45dbd4]
imul ebx, ebx, 0x3e828c7
mov edx, esi
imul edx, edx, 0x2927ae2
sub ebx, edx
mov ecx, dword [0x45dbe0]
mov eax, 0x830d168d
imul edi
add edx, edi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3f96a7f5
imul ecx
imul ecx, ecx, 0x406a069
sar edx, 0x18
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, ecx
mov ebx, eax
mov eax, 0x9d6ba841
imul esi
add edx, esi
sar edx, 0x19
add ebx, edx
mov ecx, edx
mov eax, 0x4bee9027
imul esi
sar edx, 0x18
mov eax, edx
shr ecx, 0x1f
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
add ecx, ebx
sub ecx, eax
mov dword [0x45dbd8], ecx
mov dword [esp + 0x14], edx
jmp 0x406cd8
mov edi, dword [0x45dbd4]
mov esi, dword [0x45dbe8]
mov ecx, dword [0x45dbd8]
mov eax, dword [0x45dbd0]
imul edi, edi, 0x3409f8e
imul ecx, ecx, 0x539869b
mov edx, dword [0x45dbdc]
lea ebx, [eax + esi]
imul edx, edx, 0x2927ae2
imul ebx, ebx, 0x293659b
sub ebx, edx
mov edx, dword [0x45dbcc]
mov eax, 0x31b1a317
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x61b9fbc5
imul esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, edi
add eax, ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x45dbe0], eax
call ebp
mov ecx, dword [0x45dbd4]
mov edi, dword [0x45dbe4]
mov eax, 0x830d168d
imul ecx
mov esi, edi
imul esi, esi, 0x2927ae2
add edx, ecx
sar edx, 0x19
add esi, edx
mov ebx, edx
mov edx, dword [0x45dbcc]
mov eax, 0x3f96a7f5
imul edx
mov eax, dword [0x45dbe0]
sar edx, 0x18
imul eax, eax, 0x35f16dd
shr ebx, 0x1f
add ebx, esi
add ebx, edx
mov esi, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x3409f8e
shr esi, 0x1f
add esi, ebx
sub esi, edx
add esi, eax
mov eax, 0x8345522b
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, dword [str._r_____r____]
sub eax, esi
add eax, 0x293659b
mov dword [0x45dbcc], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x406f49
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x45dbd8]
mov edi, eax
mov ecx, dword [0x45dbd0]
mov eax, 0x6386b3b9
imul ebx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x31b1a317
imul ecx
sar edx, 0x17
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x3409f8e
mov eax, ebx
imul eax, eax, 0x5e30a0c
sub esi, ecx
mov ecx, dword [0x45dbdc]
add esi, edx
add esi, eax
mov eax, 0x56f92285
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3e67c56
sub esi, eax
mov eax, dword [0x45dbe4]
add esi, edx
sub esi, eax
sub esi, 0x2927ae2
test edi, edi
mov dword [0x45dbd0], esi
je 0x406fb9
mov esi, dword [str._r_____r____]
mov eax, 0x830d168d
imul ecx
add ebx, esi
imul esi, esi, 0x3e828c7
imul ebx, ebx, 0x3e67c56
add edx, ecx
sar edx, 0x19
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, esi
mov ebx, eax
mov eax, 0x3f96a7f5
imul ecx
imul ecx, ecx, 0x35f16dd
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, dword [0x45dbe0]
push 0
lea ecx, [ecx + ebx - 0x2927ae2]
push edi
mov dword [0x45dbd4], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45dbe8]
mov edx, dword [0x45dbd0]
mov eax, dword [0x45dbdc]
lea esi, [edx + ecx]
imul eax, eax, 0x2927ae2
mov edx, dword [0x45dbcc]
imul esi, esi, 0x293659b
sub esi, eax
mov eax, 0x31b1a317
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61b9fbc5
imul ecx
mov eax, dword [0x45dbd8]
sar edx, 0x19
imul eax, eax, 0x539869b
mov ecx, edx
add esi, edx
mov edx, dword [0x45dbd4]
imul edx, edx, 0x3409f8e
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
add ecx, eax
push edi
mov dword [0x45dbe0], ecx
call ebp
mov eax, 1
jmp 0x406fbb
mov edx, dword [0x45dbc8]
add ecx, edx
mov eax, 0x31b1a317
imul ecx, ecx, 0x406a069
imul esi
imul esi, esi, 0x3e828c7
sar edx, 0x17
add ecx, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x45dbd8]
mov eax, 0x61b9fbc5
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x830d168d
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x56f92285
imul edi
sar edx, 0x19
mov eax, edx
sub ebx, ecx
shr eax, 0x1f
add ebx, esi
add eax, edx
sub ebx, eax
mov dword [0x45dbe4], ebx
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004301cd
add esp, 0x238
ret