Function at 0x406400
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x240
mov eax, dword [0x45f640]
mov edx, dword [esp + 0x244]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x24c], eax
xor eax, eax
mov byte [esp + 0x148], 0
mov ecx, 0x40
lea edi, [esp + 0x149]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44e064
stosb byte es:[edi], al
lea eax, [esp + 0x150]
push 0x104
push eax
call fcn.0043120c
mov edi, dword [0x45dbd8]
add esp, 0x10
push 2
mov eax, edi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebp, eax
mov eax, dword [0x45dbd4]
cdq
mov esi, eax
mov eax, dword [0x45dbcc]
push 2
mov ebx, edx
cdq
push 0xbeb5aaf
push edx
push eax
mov dword [esp + 0x2c], ebx
call fcn.004305f0
push 1
push 0xba7a7bcd
push ebx
push esi
mov dword [esp + 0x20], eax
call fcn.004305f0
mov ecx, dword [esp + 0x10]
push 2
push 0x1b912b5c
mov edx, ebx
push edx
sub ecx, eax
push esi
mov dword [esp + 0x20], ecx
call fcn.004305f0
mov ecx, dword [esp + 0x10]
mov ebx, dword [0x45dbe0]
add ecx, eax
mov eax, dword [0x45dbdc]
mov edx, eax
imul edx, edx, 0x6d4760f7
mov esi, ebx
imul esi, esi, 0x264da184
add edx, ebp
add edx, ecx
push 1
add esi, edx
cdq
push 0xc6fcd893
push edx
push eax
mov dword [0x45dbc4], esi
call fcn.004305f0
mov dword [esp + 0x10], eax
mov eax, 0x1f64bb9f
mul ebx
mov eax, dword [esp + 0x10]
shr edx, 0x1c
sub eax, edx
imul edi, edi, 0x7672ee00
mov ecx, eax
mov eax, 0x2d0ae8c5
mul dword [0x45dbd0]
mov eax, dword [0x45dbd0]
sub eax, edx
shr eax, 1
add eax, edx
mov edx, ebx
imul edx, edx, 0x3053d3f1
shr eax, 0x1f
add ecx, eax
add ecx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [0x45dbe4]
mov eax, 0x45291d0f
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0x1d
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
add eax, edi
push 2
mov dword [0x45dbc8], eax
cdq
push 0xbeb5aaf
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.004305f0
mov edi, eax
push 1
mov eax, ebx
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
imul esi, esi, 0x1531b042
add edi, eax
mov eax, 0x1f64bb9f
mul dword [0x45dbd0]
shr edx, 0x1c
sub edi, edx
mov eax, 0x9a168f41
mul dword [0x45dbdc]
shr edx, 0x1f
add edi, edx
mov eax, 0x45291d0f
imul dword [0x45dbd4]
sar edx, 0x1d
mov eax, edx
sub edi, esi
shr eax, 0x1f
add edi, edx
add eax, edi
push 0
sub eax, ebp
push 2
mov dword [0x45dbcc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x10], eax
mov eax, dword [0x45dbe4]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov edi, dword [0x45dbd0]
mov ebx, eax
push 0xfffffffffffffffe
mov eax, edi
cdq
push 0x45858433
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0x1b912b5c
push edx
push eax
sub esi, ebx
call fcn.004305f0
mov ebx, dword [0x45dbc4]
mov ebp, dword [0x45dbd8]
add esi, eax
mov eax, 0x9a168f41
mul ebx
mov eax, dword [esp + 0x10]
shr edx, 0x1f
add esi, edx
mov edx, dword [0x45dbd4]
mov ecx, ebp
imul edx, edx, 0x7114fe22
imul ecx, ecx, 0x1b912b5c
sub esi, ecx
add esi, edx
cmp eax, 0xffffffff
mov dword [0x45dbe4], esi
jne 0x4066da
mov eax, dword [0x45dbdc]
push 1
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
imul ebp, ebp, 0x7672ee00
mov ecx, dword [0x45dbe0]
mov ebx, eax
mov eax, 0x1f64bb9f
mul ecx
imul ecx, ecx, 0x3053d3f1
shr edx, 0x1c
sub ebx, edx
mov eax, 0x2d0ae8c5
mul edi
sub edi, edx
shr edi, 1
add edi, edx
mov eax, 0x45291d0f
imul esi
shr edi, 0x1f
sar edx, 0x1d
add ebx, edi
add ebx, ecx
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ebp
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45dbc8], eax
call fcn.004311a6
add esp, 4
jmp 0x406e81
mov eax, dword [0x45dbe8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
imul ebx, ebx, 0xf414a551
imul esi, esi, 0x7d86eec7
sub ebx, eax
mov eax, 0x9a168f41
mul edi
mov eax, dword [0x45dbe8]
imul eax, eax, 0x1531b042
shr edx, 0x1f
sub ebx, edx
sub ebx, eax
mov eax, 0x45291d0f
imul ebp
sar edx, 0x1d
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
mov edx, dword [0x45dbe0]
add ecx, ebx
mov ebx, dword [esp + 0x10]
sub ecx, esi
lea eax, [ecx + edx - 0x7672ee00]
lea ecx, [esp + 0x20]
push ecx
push ebx
mov dword [0x45dbd0], eax
mov dword [esp + 0x28], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
push 1
push 0x388a7f11
jne 0x4067c9
mov eax, dword [0x45dbdc]
cdq
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004305f0
push 2
push 0x1b912b5c
push edi
push esi
mov ebp, eax
call fcn.004305f0
mov edx, dword [0x45dbe8]
mov ecx, dword [0x45dbc4]
imul edx, edx, 0x1b912b5c
mov edi, dword [0x45dbe4]
imul ecx, ecx, 0x4f22272
sub eax, ebp
add eax, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x264da184
add ecx, edi
add ecx, eax
lea eax, [edx + ecx + 0x7672ee00]
push ebx
mov dword [0x45dbd4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406e81
mov eax, dword [0x45dbe0]
cdq
push edx
push eax
call fcn.004305f0
mov edi, dword [0x45dbc8]
mov ebp, eax
push 2
mov eax, edi
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
mov ebx, dword [0x45dbc4]
sub ebp, eax
push 1
mov eax, ebx
cdq
push 0xeace4fbe
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbe8]
add ebp, eax
mov esi, dword [0x45dbcc]
mov eax, 0x2d0ae8c5
mul ecx
mov eax, ecx
imul ecx, ecx, 0x7672ee00
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
add ebp, eax
mov edx, esi
imul edx, edx, 0x388a7f11
mov eax, edi
imul eax, eax, 0x1b912b5c
sub ebp, edx
add ebp, eax
sub ebp, ecx
mov dword [0x45dbd8], ebp
lea esp, [esp]
mov eax, dword [0x45dbd0]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebp, eax
mov eax, dword [0x45dbe4]
push 2
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
imul edi, edi, 0x3903276d
imul ebx, ebx, 0x7672ee00
add ebp, eax
mov eax, 0x1f64bb9f
mul esi
imul esi, esi, 0x74f4f79a
shr edx, 0x1c
sub ebp, edx
sub ebp, edi
lea ecx, [esp + 0x148]
add ebp, ebx
push ecx
lea edx, [esp + 0x48]
add ebp, esi
push edx
mov dword [0x45dbdc], ebp
call fcn.0043af2e
add esp, 8
test eax, eax
push 1
je 0x406af2
mov eax, dword [0x45dbe8]
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbd0]
mov esi, eax
mov eax, dword [0x45dbd4]
sub eax, ecx
imul eax, eax, 0x2b57abfe
add esi, eax
mov eax, 0x9a168f41
mul ecx
mov ecx, dword [0x45dbc8]
mov eax, dword [0x45dbcc]
imul ecx, ecx, 0x1531b042
shr edx, 0x1f
imul eax, eax, 0x7672ee00
sub esi, edx
mov edx, dword [0x45dbd8]
imul edx, edx, 0x3903276d
sub esi, ecx
mov ecx, dword [esp + 0x28]
push ecx
sub esi, edx
push 0
sub esi, eax
push 0x1f0fff
mov dword [0x45dbe0], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x45dbd8]
mov ebx, eax
mov eax, dword [0x45dbd4]
cdq
mov esi, eax
push 2
mov dword [esp + 0x20], edx
mov eax, edi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebp, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov edx, dword [esp + 0x1c]
push 1
push 0xba7a7bcd
push edx
push esi
add ebp, eax
call fcn.004305f0
push 2
sub ebp, eax
mov eax, dword [esp + 0x20]
push 0x1b912b5c
push eax
push esi
call fcn.004305f0
mov esi, dword [0x45dbe0]
add ebp, eax
mov eax, dword [0x45dbdc]
mov ecx, eax
imul ecx, ecx, 0x6d4760f7
mov edx, esi
imul edx, edx, 0x264da184
add ebp, ecx
add ebp, edx
test ebx, ebx
mov dword [0x45dbc4], ebp
jne 0x4069db
push 0x44e030
call fcn.004311a6
add esp, 4
jmp 0x406ac4
push 1
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
imul edi, edi, 0x7672ee00
mov ecx, dword [0x45dbd0]
mov ebp, eax
mov eax, 0x1f64bb9f
mul esi
imul esi, esi, 0x3053d3f1
shr edx, 0x1c
sub ebp, edx
mov eax, 0x2d0ae8c5
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
add ebp, ecx
mov ecx, dword [0x45dbe4]
mov eax, 0x45291d0f
imul ecx
sar edx, 0x1d
mov eax, edx
add ebp, esi
shr eax, 0x1f
add ebp, edx
add eax, ebp
add eax, edi
push ebx
mov dword [0x45dbc8], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406a56
push 0x44e01c
call fcn.004311a6
add esp, 4
mov eax, dword [0x45dbd0]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbe4]
push 2
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbcc]
add esi, eax
mov eax, 0x1f64bb9f
mul ecx
imul ecx, ecx, 0x74f4f79a
mov eax, dword [0x45dbc4]
shr edx, 0x1c
imul eax, eax, 0x7672ee00
sub esi, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3903276d
sub esi, edx
add esi, eax
add esi, ecx
push ebx
mov dword [0x45dbdc], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
mov edi, dword [0x45dbc8]
je 0x406b7f
mov ebx, dword [0x45dbc4]
mov esi, dword [0x45dbcc]
jmp 0x406850
mov eax, dword [0x45dbe0]
cdq
push 0x388a7f11
push edx
push eax
call fcn.004305f0
mov edi, dword [0x45dbc8]
mov esi, eax
push 2
mov eax, edi
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
sub esi, eax
mov eax, dword [0x45dbc4]
push 1
cdq
push 0xeace4fbe
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbe8]
mov ebx, dword [0x45dbcc]
add esi, eax
mov eax, 0x2d0ae8c5
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
mov ebp, dword [esp + 0x28]
mov edx, ebx
imul edx, edx, 0x388a7f11
shr eax, 0x1f
add esi, eax
sub esi, edx
mov eax, edi
imul eax, eax, 0x1b912b5c
mov edx, ecx
imul edx, edx, 0x7672ee00
add esi, eax
sub esi, edx
mov dword [0x45dbd8], esi
jmp 0x406b95
mov ebx, dword [0x45dbcc]
mov esi, dword [0x45dbd8]
mov ecx, dword [0x45dbe8]
mov ebp, dword [esp + 0x14]
push 1
mov eax, ecx
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
imul edi, edi, 0x1531b042
imul esi, esi, 0x3903276d
mov ecx, dword [0x45dbd0]
imul ebx, ebx, 0x7672ee00
mov edx, dword [0x45dbd4]
sub edx, ecx
imul edx, edx, 0x2b57abfe
add eax, edx
mov dword [esp + 0x14], eax
mov eax, 0x9a168f41
mul ecx
mov eax, dword [esp + 0x14]
shr edx, 0x1f
sub eax, edx
sub eax, edi
sub eax, esi
sub eax, ebx
mov dword [0x45dbe0], eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x45dbc8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov edi, dword [0x45dbd8]
mov dword [esp + 0x14], eax
push 2
mov eax, edi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov eax, dword [0x45dbe0]
push 1
cdq
push 0xba7a7bcd
push edx
push eax
mov dword [esp + 0x24], ecx
call fcn.004305f0
mov ecx, dword [esp + 0x14]
add ecx, eax
mov eax, 0x1f64bb9f
mul dword [0x45dbd0]
shr edx, 0x1c
sub ecx, edx
mov ebx, dword [0x45dbd4]
mov eax, 0x9a168f41
mul dword [0x45dbdc]
shr edx, 0x1f
add ecx, edx
mov edx, dword [0x45dbc4]
imul edx, edx, 0x1531b042
sub ecx, edx
mov eax, 0x45291d0f
imul ebx
sar edx, 0x1d
mov esi, edx
shr esi, 0x1f
add ecx, edx
add esi, ecx
test ebp, ebp
mov dword [0x45dbcc], esi
je 0x406e1a
mov eax, dword [esp + 0x28]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x45dbe8]
mov ebx, eax
push 2
mov eax, edi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov esi, dword [0x45dbc4]
mov ebp, esi
imul ebp, ebp, 0xf414a551
sub ebp, eax
mov eax, 0x9a168f41
mul dword [0x45dbd0]
mov ecx, edi
imul ecx, ecx, 0x1531b042
shr edx, 0x1f
sub ebp, edx
sub ebp, ecx
mov ecx, dword [0x45dbd8]
mov eax, 0x45291d0f
imul ecx
mov ecx, dword [0x45dbe4]
imul ecx, ecx, 0x7d86eec7
sar edx, 0x1d
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [0x45dbe0]
add eax, ebp
sub eax, ecx
test ebx, ebx
lea eax, [eax + edx - 0x7672ee00]
mov dword [0x45dbd0], eax
je 0x406e81
mov eax, dword [0x45dbdc]
push 1
cdq
push 0x388a7f11
mov ebp, eax
push edx
push ebp
mov dword [esp + 0x2c], edx
call fcn.004305f0
mov ecx, dword [esp + 0x1c]
push 2
push 0x1b912b5c
push ecx
push ebp
mov dword [esp + 0x24], eax
call fcn.004305f0
imul esi, esi, 0x4f22272
imul edi, edi, 0x1b912b5c
mov edx, dword [0x45dbc8]
mov ecx, dword [esp + 0x14]
imul edx, edx, 0x264da184
mov ebp, dword [0x45dbe4]
sub eax, ecx
add eax, edi
add esi, ebp
add esi, eax
push 0
lea eax, [edx + esi + 0x7672ee00]
push ebx
mov dword [0x45dbd4], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x45dbe8]
push 1
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbd0]
mov edx, dword [0x45dbd4]
sub edx, ecx
imul edx, edx, 0x2b57abfe
mov esi, eax
add esi, edx
mov eax, 0x9a168f41
mul ecx
mov eax, dword [0x45dbc8]
mov ecx, dword [0x45dbd8]
imul eax, eax, 0x1531b042
shr edx, 0x1f
imul ecx, ecx, 0x3903276d
sub esi, edx
mov edx, dword [0x45dbcc]
imul edx, edx, 0x7672ee00
sub esi, eax
sub esi, ecx
sub esi, edx
push ebx
mov dword [0x45dbe0], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x406e83
mov eax, dword [0x45dbe4]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebp, eax
mov eax, dword [0x45dbd0]
push 0xfffffffffffffffe
cdq
push 0x45858433
push edx
push eax
call fcn.004305f0
sub eax, ebp
mov ebp, eax
push 2
mov eax, esi
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
imul edi, edi, 0x1b912b5c
imul ebx, ebx, 0x7114fe22
add ebp, eax
mov eax, 0x9a168f41
mul dword [0x45dbc4]
shr edx, 0x1f
add ebp, edx
sub ebp, edi
add ebp, ebx
mov dword [0x45dbe4], ebp
xor eax, eax
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043040d
add esp, 0x240
ret