Function at 0x406a30
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x254
mov eax, dword [0x460640]
mov edx, dword [esp + 0x258]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x260], eax
xor eax, eax
mov byte [esp + 0x15c], 0
mov ecx, 0x40
lea edi, [esp + 0x15d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44effc
stosb byte es:[edi], al
lea eax, [esp + 0x164]
push 0x104
push eax
call fcn.00432c3c
mov eax, dword [0x45ecd4]
mov esi, dword [0x45eccc]
add esp, 0x10
cdq
push 0x13
mov ebx, eax
mov ebp, edx
push 0x2c2da253
mov eax, esi
cdq
push ebp
push ebx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call fcn.00432020
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov edi, dword [0x45ece8]
push 0x14
imul edi, edi, 0x471ee414
push 0x76aab896
push ecx
push edx
mov dword [esp + 0x30], eax
call fcn.00432020
push 0x14
push 0x76aab896
push ebp
push ebx
mov dword [esp + 0x2c], eax
call fcn.00432020
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push 0xf
sub ecx, eax
mov eax, dword [esp + 0x1c]
push 0x3c2325f6
push eax
push edx
mov dword [esp + 0x2c], ecx
call fcn.00432020
imul esi, esi, 0x392bae29
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub ecx, eax
mov eax, dword [0x45ecdc]
imul eax, eax, 0x3dbf610d
add eax, edi
add eax, ecx
add esi, eax
mov eax, dword [0x45ecd0]
add esi, edx
cdq
mov dword [str._r_____r____], esi
mov esi, eax
mov eax, dword [0x45ece4]
mov ebp, edx
mov dword [esp + 0x28], ebp
cdq
push 0xd
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 3
push 0xce4a7dc6
push ebp
push esi
mov dword [esp + 0x2c], eax
call fcn.00432020
mov ecx, dword [esp + 0x28]
push 0x13
push 0x392bae29
mov ebp, eax
mov eax, dword [esp + 0x24]
push ecx
push esi
sub ebp, eax
call fcn.00432020
mov edx, dword [esp + 0x28]
push 8
push 0x42a7b17d
push edx
push esi
add ebp, eax
call fcn.00432020
mov esi, dword [0x45ece0]
mov ecx, dword [0x45ecc8]
mov edx, dword [esp + 0x30]
imul ecx, ecx, 0x31b5823a
add ebp, eax
mov eax, esi
imul eax, eax, 0xafbbe1e
push 0xd
push 0x3dbf610d
add ebp, eax
push edx
sub ebp, ecx
push ebx
mov dword [0x45ecc8], ebp
mov dword [esp + 0x2c], 0
call fcn.00432020
mov ecx, dword [esp + 0x14]
push 8
mov ebx, eax
mov eax, dword [esp + 0x1c]
push 0x974b287b
push eax
push ecx
call fcn.00432020
imul esi, esi, 0x392bae29
mov edx, dword [esp + 0x20]
add ebx, eax
mov eax, dword [0x45ece4]
imul eax, eax, 0x31b5823a
sub ebx, eax
add ebx, esi
sub ebx, edi
sub ebx, dword [str._r_____r____]
push 0
lea eax, [ebx + edx - 0x1bcdabbc]
push 2
mov dword [0x45eccc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x20], eax
mov eax, dword [0x45ecd8]
cdq
mov ebx, eax
mov eax, dword [0x45ece4]
push 0xffffffffffffffeb
mov ebp, edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecd4]
mov edx, dword [0x45ecc8]
mov esi, eax
mov edi, dword [str._r_____r____]
add edx, ecx
imul edx, edx, 0x68b4d785
push 0x10
sub esi, edx
mov eax, edi
cdq
push 0xe4325444
push edx
push eax
call fcn.00432020
push 0xf
push 0x3c2325f6
push ebp
push ebx
add esi, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push ebp
push ebx
sub esi, eax
call fcn.00432020
imul edi, edi, 0x2c2da253
sub esi, eax
mov eax, dword [esp + 0x20]
add esi, edi
cmp eax, 0xffffffff
mov dword [0x45ece4], esi
jne 0x406d34
mov eax, dword [0x45ecd0]
cdq
mov edi, eax
push 0xd
mov ebx, edx
mov eax, esi
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 3
push 0xce4a7dc6
push ebx
push edi
mov esi, eax
call fcn.00432020
push 0x13
push 0x392bae29
push ebx
mov ebp, eax
push edi
sub ebp, esi
call fcn.00432020
push 8
push 0x42a7b17d
push ebx
push edi
add ebp, eax
call fcn.00432020
add ebp, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0xafbbe1e
add ebp, eax
mov eax, dword [0x45ecc8]
imul eax, eax, 0x31b5823a
sub ebp, eax
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45ecc8], ebp
call fcn.00432bd6
add esp, 4
jmp 0x407574
mov eax, dword [0x45ecdc]
push 0x14
cdq
push 0x76aab896
push edx
push eax
call fcn.00432020
mov edi, eax
mov eax, dword [0x45ecd0]
push 0xffffffffffffffef
cdq
push 0x1bcdabbc
push edx
push eax
call fcn.00432020
push 3
push 0xce4a7dc6
push ebp
sub eax, edi
push ebx
mov edi, eax
call fcn.00432020
mov ecx, dword [0x45ece8]
add edi, eax
imul ecx, ecx, 0x471ee414
mov eax, dword [0x45ecc8]
imul eax, eax, 0x3dbf610d
add edi, eax
mov eax, dword [0x45ecd8]
imul eax, eax, 0x76aab896
add edi, eax
mov eax, dword [esp + 0x20]
add edi, ecx
lea edx, [esp + 0x34]
sub edi, esi
push edx
add edi, 0x31b5823a
push eax
mov dword [0x45ecd0], edi
mov dword [esp + 0x3c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
push 8
push 0x974b287b
jne 0x406e3d
mov esi, dword [0x45ecdc]
mov ecx, dword [0x45ecd8]
mov edi, dword [str._r_____r____]
mov eax, esi
cdq
mov ebx, eax
push edx
lea ebp, [ecx + edi]
push ebx
imul ebp, ebp, 0x3dbf610d
mov dword [esp + 0x28], edx
call fcn.00432020
mov edx, dword [esp + 0x18]
push 0x13
push 0x2c2da253
push edx
push ebx
sub ebp, eax
call fcn.00432020
imul esi, esi, 0x392bae29
imul edi, edi, 0x2c2da253
mov edx, dword [0x45ece0]
mov ecx, dword [esp + 0x20]
add ebp, eax
add esi, edx
add esi, ebp
lea eax, [edi + esi + 0x31b5823a]
push ecx
mov dword [0x45ecd4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407574
mov edi, dword [0x45ece8]
mov esi, dword [0x45ece0]
mov eax, edi
cdq
mov ebx, eax
mov dword [esp + 0x30], edx
mov eax, esi
cdq
push edx
push eax
call fcn.00432020
mov ebp, eax
mov eax, dword [0x45ecd4]
push 0x13
cdq
push 0x2c2da253
push edx
push eax
call fcn.00432020
mov edx, dword [esp + 0x28]
push 0x14
push 0x471ee414
push edx
push ebx
sub ebp, eax
call fcn.00432020
push 0x13
add ebp, eax
mov eax, dword [esp + 0x2c]
push 0x392bae29
push eax
push ebx
call fcn.00432020
imul edi, edi, 0x31b5823a
mov edx, dword [0x45ecc8]
mov ecx, esi
imul edx, edx, 0x2c2da253
imul ecx, ecx, 0x68b4d785
sub ebp, eax
sub ebp, ecx
add ebp, edi
add ebp, edx
mov dword [0x45ecd8], ebp
mov eax, dword [0x45ece4]
mov ebp, dword [0x45eccc]
cdq
mov edi, eax
push 0xd
mov ebx, edx
mov eax, ebp
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecd0]
add ebp, ecx
imul ebp, ebp, 0x3c2325f6
push 0x14
push 0x76aab896
push ebx
push edi
sub ebp, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push ebx
push edi
add ebp, eax
call fcn.00432020
imul esi, esi, 0x42a7b17d
mov edx, dword [0x45ecdc]
imul edx, edx, 0x31b5823a
add ebp, eax
lea eax, [esp + 0x15c]
add ebp, esi
push eax
lea ecx, [esp + 0x5c]
sub ebp, edx
push ecx
mov dword [0x45ecdc], ebp
call fcn.0043c95e
add esp, 8
test eax, eax
je 0x4071b3
mov edx, dword [0x45ecd0]
mov esi, dword [0x45ece8]
mov eax, dword [0x45eccc]
push 0xffffffffffffffef
lea edi, [edx + esi]
cdq
imul edi, edi, 0x1bcdabbc
push 0x1bcdabbc
push edx
push eax
call fcn.00432020
mov ebx, eax
push 0xf
mov eax, esi
cdq
push 0x3c2325f6
push edx
push eax
sub ebx, edi
call fcn.00432020
mov ecx, dword [0x45ecdc]
mov edx, dword [0x45ecd4]
imul ecx, ecx, 0x31b5823a
add ebx, eax
imul edx, edx, 0x471ee414
mov eax, dword [0x45ecd8]
imul eax, eax, 0x42a7b17d
add ebx, eax
mov eax, dword [esp + 0x3c]
push eax
add ebx, ecx
push 0
sub ebx, edx
push 0x1f0fff
mov dword [0x45ece0], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45eccc]
mov edi, eax
mov eax, dword [0x45ecd4]
cdq
mov ebx, eax
push 0x14
mov ebp, edx
mov eax, esi
cdq
push 0x76aab896
push edx
push eax
mov dword [esp + 0x40], ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call fcn.00432020
push 0x14
push 0x76aab896
push ebp
push ebx
mov dword [esp + 0x20], eax
call fcn.00432020
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push 0xf
push 0x3c2325f6
sub ecx, eax
mov eax, dword [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x20], ecx
call fcn.00432020
mov ecx, dword [esp + 0x10]
push 0x13
push 0x2c2da253
mov edx, ebp
push edx
sub ecx, eax
push ebx
mov dword [esp + 0x20], ecx
call fcn.00432020
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [0x45ecdc]
imul eax, eax, 0x3dbf610d
mov edx, dword [0x45ece8]
imul esi, esi, 0x392bae29
imul edx, edx, 0x471ee414
add ecx, eax
add ecx, edx
add ecx, esi
test edi, edi
mov dword [str._r_____r____], ecx
jne 0x40708d
push 0x44efc8
call fcn.00432bd6
add esp, 4
jmp 0x407191
mov eax, dword [0x45ecd0]
cdq
mov esi, eax
mov eax, dword [0x45ece4]
push 0xd
mov ebx, edx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 3
push 0xce4a7dc6
push ebx
push esi
mov ebp, eax
call fcn.00432020
push 0x13
push 0x392bae29
push ebx
sub eax, ebp
push esi
mov ebp, eax
call fcn.00432020
push 8
push 0x42a7b17d
push ebx
push esi
add ebp, eax
call fcn.00432020
mov ecx, dword [0x45ecc8]
add ebp, eax
imul ecx, ecx, 0x31b5823a
mov eax, dword [0x45ece0]
imul eax, eax, 0xafbbe1e
add ebp, eax
sub ebp, ecx
push edi
mov dword [0x45ecc8], ebp
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x407118
push 0x44efb4
call fcn.00432bd6
add esp, 4
mov eax, dword [0x45ece4]
mov ebp, dword [0x45eccc]
cdq
mov esi, eax
push 0xd
mov ebx, edx
mov eax, ebp
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
mov edx, dword [0x45ecd0]
add ebp, edx
imul ebp, ebp, 0x3c2325f6
push 0x14
push 0x76aab896
push ebx
push esi
sub ebp, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push ebx
push esi
add ebp, eax
call fcn.00432020
mov ecx, dword [0x45ecdc]
add ebp, eax
imul ecx, ecx, 0x31b5823a
mov eax, dword [0x45ece0]
imul eax, eax, 0x42a7b17d
add ebp, eax
sub ebp, ecx
push edi
mov dword [0x45ecdc], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x34]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x407255
mov esi, dword [0x45ece0]
jmp 0x406ec2
mov ebx, dword [0x45ece8]
mov ebp, dword [0x45ece0]
mov eax, ebx
cdq
mov dword [esp + 0x24], eax
push 8
mov dword [esp + 0x2c], edx
mov eax, ebp
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
mov edi, dword [0x45ecd4]
mov esi, eax
push 0x13
mov eax, edi
cdq
push 0x2c2da253
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 0x14
push 0x471ee414
push ecx
push edx
sub esi, eax
call fcn.00432020
mov ecx, dword [esp + 0x24]
push 0x13
add esi, eax
mov eax, dword [esp + 0x2c]
push 0x392bae29
push eax
push ecx
call fcn.00432020
imul ebp, ebp, 0x68b4d785
mov ecx, dword [esp + 0x3c]
sub esi, eax
mov eax, dword [0x45ecc8]
mov edx, ebx
imul eax, eax, 0x2c2da253
imul edx, edx, 0x31b5823a
sub esi, ebp
add esi, edx
add esi, eax
mov dword [0x45ecd8], esi
mov dword [esp + 0x1c], ecx
jmp 0x407267
mov edi, dword [0x45ecd4]
mov ebx, dword [0x45ece8]
mov esi, dword [0x45ecd8]
mov edx, dword [0x45ecd0]
mov eax, dword [0x45eccc]
push 0xffffffffffffffef
lea ebp, [edx + ebx]
cdq
imul ebp, ebp, 0x1bcdabbc
push 0x1bcdabbc
push edx
push eax
call fcn.00432020
sub eax, ebp
mov ebp, eax
push 0xf
mov eax, ebx
cdq
push 0x3c2325f6
push edx
push eax
call fcn.00432020
imul esi, esi, 0x42a7b17d
imul edi, edi, 0x471ee414
mov ecx, dword [esp + 0x20]
add ebp, eax
mov eax, dword [0x45ecdc]
imul eax, eax, 0x31b5823a
add ebp, esi
add ebp, eax
sub ebp, edi
push ecx
mov dword [0x45ece0], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [0x45ecd4]
mov eax, ebp
cdq
mov esi, eax
mov eax, dword [0x45eccc]
push 8
mov edi, edx
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
push 0xd
push 0x3dbf610d
push edi
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push edi
push esi
add ebx, eax
call fcn.00432020
mov ecx, dword [0x45ece4]
mov esi, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x31b5823a
add ebx, eax
mov eax, dword [0x45ece8]
sub ebx, edx
imul eax, eax, 0x471ee414
mov edx, dword [0x45ece0]
imul edx, edx, 0x392bae29
sub ebx, eax
mov eax, dword [esp + 0x1c]
add ebx, edx
sub ebx, esi
sub ebx, 0x1bcdabbc
test eax, eax
mov dword [0x45eccc], ebx
je 0x4074f0
mov eax, dword [esp + 0x3c]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45ecdc]
mov ebp, dword [0x45ecd8]
mov ebx, eax
mov eax, esi
cdq
mov dword [esp + 0x14], eax
push 3
mov dword [esp + 0x1c], edx
mov eax, ebp
cdq
push 0xce4a7dc6
push edx
push eax
call fcn.00432020
mov edi, eax
mov eax, dword [0x45ecd0]
push 0x10
cdq
push 0xe4325444
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0x14
push 0x76aab896
push ecx
push edx
sub edi, eax
call fcn.00432020
mov edx, dword [0x45ece8]
sub edi, eax
imul edx, edx, 0x471ee414
mov eax, dword [0x45ecc8]
imul eax, eax, 0x3dbf610d
mov ecx, ebp
imul ecx, ecx, 0x76aab896
add edi, eax
add edi, ecx
add edi, edx
sub edi, dword [0x45ece4]
add edi, 0x31b5823a
test ebx, ebx
mov dword [0x45ecd0], edi
je 0x407574
mov eax, dword [esp + 0x18]
mov edi, dword [str._r_____r____]
mov ecx, dword [esp + 0x14]
push 8
push 0x974b287b
push eax
add ebp, edi
push ecx
imul ebp, ebp, 0x3dbf610d
call fcn.00432020
mov edx, dword [esp + 0x18]
push 0x13
push 0x2c2da253
sub ebp, eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call fcn.00432020
imul esi, esi, 0x392bae29
imul edi, edi, 0x2c2da253
add esi, dword [0x45ece0]
add ebp, eax
add esi, ebp
push 0
lea ecx, [edi + esi + 0x31b5823a]
push ebx
mov dword [0x45ecd4], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [0x45ecd0]
mov esi, dword [0x45ece8]
mov eax, dword [0x45eccc]
push 0xffffffffffffffef
lea edi, [edx + esi]
cdq
imul edi, edi, 0x1bcdabbc
push 0x1bcdabbc
push edx
push eax
call fcn.00432020
mov ebp, eax
push 0xf
mov eax, esi
cdq
push 0x3c2325f6
push edx
push eax
sub ebp, edi
call fcn.00432020
mov ecx, dword [0x45ecdc]
mov edx, dword [0x45ecd4]
imul ecx, ecx, 0x31b5823a
add ebp, eax
imul edx, edx, 0x471ee414
mov eax, dword [0x45ecd8]
imul eax, eax, 0x42a7b17d
add ebp, eax
add ebp, ecx
sub ebp, edx
push ebx
mov dword [0x45ece0], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x407576
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
push 0xffffffffffffffeb
mov eax, ecx
mov ebx, edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecc8]
add ecx, ebp
imul ecx, ecx, 0x68b4d785
sub eax, ecx
mov dword [esp + 0x10], eax
push 0x10
mov eax, esi
cdq
push 0xe4325444
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x10]
push 0xf
push 0x3c2325f6
push ebx
add ecx, eax
push edi
mov dword [esp + 0x20], ecx
call fcn.00432020
mov ecx, dword [esp + 0x10]
push 0x13
push 0x2c2da253
push ebx
sub ecx, eax
push edi
mov dword [esp + 0x20], ecx
call fcn.00432020
imul esi, esi, 0x2c2da253
mov ecx, dword [esp + 0x10]
sub ecx, eax
add ecx, esi
mov dword [0x45ece4], ecx
xor eax, eax
mov ecx, dword [esp + 0x260]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00431e3d
add esp, 0x254
ret