Function at 0x405080
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x442230]
push ebx
push esi
push edi
mov dword [esp + 0x240], eax
xor eax, eax
mov byte [esp + 0x13c], 0
mov ecx, 0x40
lea edi, [esp + 0x13d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x248]
push eax
push 0x4358a4
lea ecx, [esp + 0x144]
push 0x104
push ecx
call fcn.0041a050
mov ecx, dword [0x4410bc]
mov eax, 0x61f4f3e1
imul ecx
mov ecx, dword [0x4410b8]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xa0c15
cdq
idiv ecx
add esp, 0x10
push 0
push 2
mov dword [esp + 0x18], 0
mov edi, eax
mov eax, 0x1984ece9
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
sub edi, esi
mov esi, dword [0x4410b4]
add edi, edx
imul esi, esi, 0x53a0f
mov edx, dword [0x4410d0]
add eax, edi
mov dword [str._r_____r____], eax
mov eax, 0x3307af59
imul edx
sar edx, 0x11
mov eax, edx
add esi, edx
mov edx, ecx
imul ecx, ecx, 0xd454
imul edx, edx, 0xff4b
shr eax, 0x1f
add eax, esi
sub eax, edx
mov edx, dword [0x4410c8]
mov dword [0x4410b4], eax
mov eax, 0x61f4f3e1
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4410c0]
imul edx, edx, 0xa081a
sub ecx, eax
sub ecx, edx
mov dword [0x4410b8], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x4410c8]
mov ebx, eax
mov eax, 0x3307af59
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, dword [0x4410c4]
imul esi, esi, 0xff4b
mov ecx, eax
mov eax, 0x1984ece9
imul edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, esi
cmp ebx, 0xffffffff
mov dword [0x4410d0], ecx
jne 0x40522c
mov esi, dword [0x4410b4]
mov eax, 0x3307af59
imul esi, esi, 0x53a0f
imul ecx
sar edx, 0x11
mov ecx, edx
add esi, edx
mov edx, dword [0x4410b8]
imul edx, edx, 0xff4b
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x4410b4], ecx
call fcn.0041a21a
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.00419f5d
add esp, 0x238
ret
mov eax, 0xccf850a7
imul edi, edi, 0x3bf27
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x11
imul ecx, ecx, 0x181cd
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [esp + 0x14]
sub eax, edi
push edx
add eax, ecx
push ebx
mov dword [0x4410bc], eax
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4052df
mov ecx, dword [0x4410b4]
mov eax, 0x88a76c3f
imul ecx
add edx, ecx
mov ecx, dword [0x4410cc]
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x197ad0b7
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x10
mov edi, edx
add esi, edx
mov eax, 0x3307af59
imul ecx
sar edx, 0x11
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
add edi, esi
sub edi, eax
push ebx
mov dword [0x4410c0], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.00419f5d
add esp, 0x238
ret
mov ecx, dword [0x4410d0]
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x4410bc]
mov eax, 0x3307af59
imul edx
sar edx, 0x11
add esi, edx
mov edi, edx
mov eax, 0x1984ece9
imul ecx
shr edi, 0x1f
sar edx, 0x10
add edi, esi
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4410c4], ecx
nop
mov ecx, dword [0x4410b4]
mov eax, 0x88a76c3f
imul ecx
add edx, ecx
mov ecx, dword [0x4410c0]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x4410d4]
mov eax, 0x402d6015
imul ecx
sar edx, 0xe
mov eax, edx
sub edi, esi
add edi, edx
lea ecx, [esp + 0x140]
shr eax, 0x1f
push ecx
lea edx, [esp + 0x40]
add eax, edi
push edx
mov dword [0x4410c8], eax
call fcn.0042529e
add esp, 8
test eax, eax
je 0x405693
mov ecx, dword [str._r_____r____]
mov eax, 0x197ad0b7
imul ecx
mov ecx, dword [0x4410cc]
mov eax, ecx
imul eax, eax, 0xa0887
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, eax
mov eax, 0x40499437
imul ecx
sar edx, 0xe
mov ecx, edx
add esi, edx
mov edx, dword [esp + 0x20]
push edx
shr ecx, 0x1f
push 0
add ecx, esi
push 0x1f0fff
mov dword [0x4410cc], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x4410bc]
mov esi, eax
mov eax, 0x61f4f3e1
imul ecx
mov ecx, dword [0x4410b8]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xa0c15
cdq
idiv ecx
sub eax, edi
mov edi, eax
mov eax, 0x1984ece9
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
test esi, esi
mov dword [str._r_____r____], eax
jne 0x40544e
push 0x435870
call fcn.0041a21a
add esp, 4
jmp 0x4054f0
mov edx, dword [0x4410d0]
imul ecx, ecx, 0xff4b
mov edi, dword [0x4410b4]
mov eax, 0x3307af59
imul edi, edi, 0x53a0f
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
push esi
mov dword [0x4410b4], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x405498
push 0x43585c
call fcn.0041a21a
add esp, 4
mov ecx, dword [0x4410b4]
mov eax, 0x88a76c3f
imul ecx
add edx, ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x4410c0]
mov eax, 0x61f4f3e1
imul ecx
mov ecx, dword [0x4410d4]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
mov edi, eax
mov eax, 0x402d6015
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
push esi
mov dword [0x4410c8], ecx
call ebp
lea edx, [esp + 0x18]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405330
mov esi, dword [esp + 0x14]
mov ecx, dword [str._r_____r____]
mov eax, 0x197ad0b7
imul ecx
mov ecx, dword [0x4410cc]
sar edx, 0x10
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, ecx
imul edx, edx, 0xa0887
add edi, edx
mov eax, 0x40499437
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
push ebx
mov dword [0x4410cc], eax
call ebp
mov ecx, dword [0x4410c8]
mov edi, dword [0x4410b8]
mov eax, 0x61f4f3e1
imul edi, edi, 0xd454
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4410c0]
imul edx, edx, 0xa081a
sub edi, eax
sub edi, edx
test esi, esi
mov dword [0x4410b8], edi
je 0x4056e4
mov eax, dword [esp + 0x20]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x4410d0]
mov edi, dword [0x4410c4]
mov esi, eax
imul edi, edi, 0x3bf27
mov eax, 0xccf850a7
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ecx, edi
mov edi, dword [str._r_____r____]
mov edx, edi
imul edx, edx, 0x181cd
add ecx, edx
test esi, esi
mov dword [0x4410bc], ecx
je 0x40571e
mov ecx, dword [0x4410b4]
mov eax, 0x88a76c3f
imul ecx
add edx, ecx
mov ecx, dword [0x4410cc]
sar edx, 0x11
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x197ad0b7
imul ecx
sar edx, 0x10
mov ecx, edx
add ebx, edx
mov eax, 0x3307af59
imul edi
sar edx, 0x11
mov eax, edx
shr ecx, 0x1f
shr eax, 0x1f
add ecx, ebx
add eax, edx
push 0
sub ecx, eax
push esi
mov dword [0x4410c0], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [str._r_____r____]
mov eax, 0x197ad0b7
imul ecx
mov ecx, dword [0x4410cc]
sar edx, 0x10
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, ecx
imul edx, edx, 0xa0887
add edi, edx
mov eax, 0x40499437
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
push esi
mov dword [0x4410cc], eax
call ebp
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.00419f5d
add esp, 0x238
ret
mov ecx, dword [0x4410d0]
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x4410bc]
mov eax, 0x3307af59
imul edx
sar edx, 0x11
add esi, edx
mov edi, edx
mov eax, 0x1984ece9
imul ecx
shr edi, 0x1f
sar edx, 0x10
add edi, esi
mov esi, dword [esp + 0x20]
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [0x4410c4], eax
jmp 0x405507
mov eax, 0x3307af59
imul ecx
imul ecx, ecx, 0xff4b
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4410c4]
mov esi, eax
mov eax, 0x1984ece9
imul edx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov dword [0x4410d0], esi
mov ecx, dword [esp + 0x244]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.00419f5d
add esp, 0x238
ret