Function at 0x405dd0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x23c
mov eax, dword [0x45b4b0]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x248], eax
xor eax, eax
mov byte [esp + 0x144], 0
mov ecx, 0x40
lea edi, [esp + 0x145]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x250]
push eax
push 0x449ffc
lea ecx, [esp + 0x14c]
push 0x104
push ecx
call fcn.0042dc6c
mov ebp, dword [0x459b44]
mov ebx, dword [0x459b3c]
mov esi, dword [0x459b58]
mov eax, 0x5e407cd
imul esi, esi, 0x171ed6e
imul ebp
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, ebx
imul edx, edx, 0x1a0fa8c
add edx, ecx
add edx, esi
shl edx, 1
mov edi, edx
mov eax, 0x702fe9a3
imul ebp
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x565ef47
imul ebx
mov ebx, dword [0x459b40]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x540f9495
imul ebx
sar edx, 0x17
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x186e8b3d
imul ebx
mov ebx, dword [0x459b50]
sar edx, 0x17
add ebp, edx
mov eax, edx
mov edx, dword [0x459b38]
imul edx, edx, 0x53d33c3
shr eax, 0x1f
add eax, ebp
add eax, edx
mov edx, ebx
imul edx, edx, 0xbdb188
sub eax, edx
mov edx, dword [0x459b54]
mov ebp, eax
mov eax, 0x2742b221
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add esp, 0x10
mov dword [str._r_____r____], edi
add eax, edx
imul ebx, ebx, 0x1a0fa8c
sub ebp, eax
mov eax, 0x545b9e19
imul dword [0x459b3c]
sar edx, 0x17
add ebp, ecx
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ecx + ebx*2 + 0x3409364]
push 0
sub edx, edi
add ebp, esi
push 2
mov dword [0x459b38], ebp
mov dword [esp + 0x20], 0
mov dword [0x459b3c], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x459b44]
mov ebp, dword [0x459b38]
mov dword [esp + 0x10], eax
mov eax, 0x5e407cd
imul ecx
mov eax, dword [str._r_____r____]
imul eax, eax, 0x2b75400
sar edx, 0x14
mov ecx, ebp
imul ecx, ecx, 0x18470b7
add ecx, eax
mov esi, edx
mov edi, dword [0x459b48]
shr esi, 0x1f
add esi, edx
mov edx, dword [0x459b54]
mov eax, 0x702fe9a3
imul edx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x5e407cd
imul edi
mov ebx, dword [0x459b58]
sar edx, 0x14
imul ebx, ebx, 0x171ed6e
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x565ef47
imul edi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [esp + 0x10]
add ecx, esi
add ecx, ebx
cmp eax, 0xffffffff
mov dword [0x459b54], ecx
jne 0x406043
mov edi, dword [0x459b40]
imul ebp, ebp, 0x53d33c3
mov eax, 0x540f9495
imul edi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x186e8b3d
imul edi
mov eax, dword [esp + 0x10]
sar edx, 0x17
add eax, edx
mov edi, edx
mov edx, dword [0x459b50]
imul edx, edx, 0xbdb188
shr edi, 0x1f
add edi, eax
add edi, ebp
sub edi, edx
mov eax, 0x2742b221
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, esi
add edi, ebx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x459b38], edi
call fcn.0042dc06
add esp, 4
jmp 0x40679c
mov edx, dword [0x459b4c]
imul edi, edi, 0x4905557
imul ebp, ebp, 0xd0a84b
mov eax, 0x702fe9a3
imul edx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b40]
sub edi, eax
mov eax, 0x4eb6fa85
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add edi, ebp
add eax, edx
sub edi, eax
sub edi, ecx
lea edx, [esp + 0x1c]
add edi, esi
mov esi, dword [esp + 0x10]
push edx
lea ecx, [edi + ebx - 0x53d33c3]
push esi
mov dword [0x459b40], ecx
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x406135
mov ecx, dword [0x459b4c]
mov edi, ecx
mov eax, 0x545b9e19
imul edi, edi, 0x341f518
imul ecx
mov ecx, dword [0x459b58]
imul ecx, ecx, 0x171ed6e
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov ebx, dword [0x459b50]
add edi, ecx
mov ecx, dword [0x459b44]
mov eax, 0x5e407cd
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x14
imul ecx, ecx, 0x2b75400
mov eax, edx
add edi, edx
mov edx, dword [0x459b48]
imul edx, edx, 0xd0a84b
shr eax, 0x1f
add eax, edi
add ecx, ebx
add ecx, eax
lea eax, [edx + ecx - 0x53d33c3]
push esi
mov dword [0x459b44], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40679c
mov esi, dword [0x459b50]
mov eax, 0x5e407cd
imul dword [0x459b44]
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [0x459b58]
mov eax, 0x9d2b2fed
imul ecx
add edx, ecx
sar edx, 0x19
mov edi, esi
imul edi, edi, 0x18470b7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x58945bfd
imul ecx
sar edx, 0x17
add edi, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x3cb4655
shr eax, 0x1f
add eax, edi
sub eax, edx
mov dword [0x459b48], eax
lea esp, [esp]
imul ecx, ecx, 0x171ed6e
imul esi, esi, 0x185d014
mov eax, 0x5e407cd
imul dword [0x459b44]
sar edx, 0x14
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x459b54]
mov eax, 0x702fe9a3
imul ecx
mov eax, dword [0x459b4c]
mov ecx, dword [0x459b40]
imul eax, eax, 0x53d33c3
sar edx, 0x19
imul ecx, ecx, 0xbdb188
mov ebx, edx
shr ebx, 0x1f
add edi, edx
add ebx, edi
add ebx, esi
add ebx, eax
add ebx, ecx
mov ecx, dword [0x459b3c]
mov eax, 0x2742b221
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [esp + 0x144]
push ecx
lea edx, [esp + 0x44]
sub ebx, eax
push edx
mov dword [0x459b4c], ebx
call fcn.0043798e
add esp, 8
test eax, eax
mov eax, 0x5e407cd
je 0x40646f
mov ecx, dword [0x459b44]
imul ecx
sar edx, 0x14
mov eax, edx
mov esi, ecx
mov ecx, dword [0x459b48]
imul esi, esi, 0x171ed6e
shr eax, 0x1f
imul ecx, ecx, 0x185d014
add eax, edx
mov edx, dword [0x459b4c]
imul edx, edx, 0x53d33c3
mov edi, eax
sub edi, esi
add edi, ecx
mov ecx, dword [0x459b3c]
sub edi, edx
mov eax, 0x4eb6fa85
imul ecx
mov ecx, dword [0x459b58]
sar edx, 0x18
imul ecx, ecx, 0x4b280d2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x24]
push edx
sub edi, eax
push 0
add edi, ecx
push 0x1f0fff
mov dword [0x459b50], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x459b44]
mov ebp, dword [0x459b3c]
mov esi, dword [0x459b58]
mov edi, eax
imul esi, esi, 0x171ed6e
mov eax, 0x5e407cd
imul ebx
sar edx, 0x14
mov ecx, edx
mov eax, ebp
imul eax, eax, 0x1a0fa8c
shr ecx, 0x1f
add ecx, edx
add eax, ecx
add eax, esi
shl eax, 1
mov dword [esp + 0x14], eax
mov eax, 0x702fe9a3
imul ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
sub edx, eax
mov dword [esp + 0x14], edx
mov eax, 0x565ef47
imul ebp
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
sub edx, eax
test edi, edi
mov dword [str._r_____r____], edx
jne 0x40633e
push 0x449fc8
call fcn.0042dc06
add esp, 4
jmp 0x40644b
mov ebx, dword [0x459b40]
mov eax, 0x540f9495
imul ebx
sar edx, 0x17
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x186e8b3d
imul ebx
mov eax, dword [0x459b50]
sar edx, 0x17
imul eax, eax, 0xbdb188
mov ebx, edx
add ebp, edx
mov edx, dword [0x459b38]
imul edx, edx, 0x53d33c3
shr ebx, 0x1f
add ebx, ebp
add ebx, edx
mov edx, dword [0x459b54]
sub ebx, eax
mov eax, 0x2742b221
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
add ebx, esi
push edi
mov dword [0x459b38], ebx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x4063be
push 0x449fb4
call fcn.0042dc06
add esp, 4
mov ecx, dword [0x459b44]
mov esi, dword [0x459b58]
imul esi, esi, 0x171ed6e
mov eax, 0x5e407cd
imul ecx
mov ecx, dword [0x459b54]
sar edx, 0x14
add esi, edx
mov ebx, edx
mov eax, 0x702fe9a3
imul ecx
mov ecx, dword [0x459b50]
mov eax, dword [0x459b40]
imul ecx, ecx, 0x185d014
sar edx, 0x19
imul eax, eax, 0xbdb188
shr ebx, 0x1f
add ebx, esi
mov esi, edx
add ebx, edx
mov edx, dword [0x459b4c]
imul edx, edx, 0x53d33c3
shr esi, 0x1f
add esi, ebx
add esi, ecx
mov ecx, dword [0x459b3c]
add esi, edx
add esi, eax
mov eax, 0x2742b221
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
push edi
mov dword [0x459b4c], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4064d5
mov ecx, dword [0x459b58]
mov esi, dword [0x459b50]
jmp 0x4061a0
mov edi, dword [0x459b44]
mov esi, dword [0x459b58]
imul edi
mov ebx, dword [0x459b50]
sar edx, 0x14
imul ebx, ebx, 0x18470b7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x9d2b2fed
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x58945bfd
imul esi
sar edx, 0x17
mov dword [esp + 0x14], ecx
add ebx, edx
mov ecx, edx
mov edx, esi
imul edx, edx, 0x3cb4655
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [esp + 0x24]
sub ecx, edx
mov dword [0x459b48], ecx
jmp 0x4064eb
mov edi, dword [0x459b44]
mov esi, dword [0x459b58]
mov ecx, dword [0x459b48]
mov ebx, dword [esp + 0x18]
mov eax, 0x5e407cd
imul ecx, ecx, 0x185d014
imul esi, esi, 0x4b280d2
imul edi
mov ebp, edi
sar edx, 0x14
imul ebp, ebp, 0x171ed6e
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, ebp
add edi, ecx
mov ecx, dword [0x459b4c]
imul ecx, ecx, 0x53d33c3
sub edi, ecx
mov ecx, dword [0x459b3c]
mov eax, 0x4eb6fa85
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, esi
push ecx
mov dword [0x459b50], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x459b44]
mov esi, dword [0x459b50]
mov eax, 0x5e407cd
imul esi, esi, 0x1a0fa8c
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x459b3c]
mov eax, 0x545b9e19
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, ecx
lea edx, [eax + esi*2 + 0x3409364]
mov eax, dword [str._r_____r____]
sub edx, eax
test ebx, ebx
mov dword [0x459b3c], edx
je 0x40672d
mov eax, dword [esp + 0x24]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x459b44]
mov ebx, eax
mov eax, 0x5e407cd
imul ecx
mov esi, dword [0x459b48]
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x702fe9a3
imul dword [0x459b4c]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b38]
mov edi, dword [0x459b58]
imul edx, edx, 0xd0a84b
mov ebp, esi
imul edi, edi, 0x171ed6e
imul ebp, ebp, 0x4905557
sub ebp, eax
add ebp, edx
mov edx, dword [0x459b40]
mov eax, 0x4eb6fa85
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
sub ebp, dword [0x459b54]
add ebp, ecx
test ebx, ebx
lea edx, [edi + ebp - 0x53d33c3]
mov dword [0x459b40], edx
je 0x40679c
mov edx, dword [0x459b4c]
imul esi, esi, 0xd0a84b
mov ebp, edx
mov eax, 0x545b9e19
imul ebp, ebp, 0x341f518
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x2b75400
sub ebp, eax
mov eax, dword [0x459b50]
add edx, ecx
add edx, ebp
add esi, edx
add esi, edi
push 0
lea ecx, [esi + eax - 0x53d33c3]
push ebx
mov dword [0x459b44], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x459b44]
mov eax, 0x5e407cd
imul ecx
sar edx, 0x14
mov esi, ecx
mov ecx, dword [0x459b48]
imul esi, esi, 0x171ed6e
mov eax, edx
imul ecx, ecx, 0x185d014
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b4c]
imul edx, edx, 0x53d33c3
mov edi, eax
sub edi, esi
add edi, ecx
mov ecx, dword [0x459b3c]
sub edi, edx
mov eax, 0x4eb6fa85
imul ecx
mov ecx, dword [0x459b58]
sar edx, 0x18
imul ecx, ecx, 0x4b280d2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push ebx
mov dword [0x459b50], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x238]
call fcn.0042cf11
add esp, 0x23c
ret
mov edi, dword [0x459b38]
imul eax, eax, 0x2b75400
mov edx, dword [0x459b58]
imul edi, edi, 0x18470b7
imul edx, edx, 0x171ed6e
add edi, edx
mov edx, dword [0x459b54]
add edi, eax
mov esi, dword [0x459b48]
mov eax, 0x702fe9a3
imul edx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x5e407cd
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x565ef47
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov dword [0x459b54], edi
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.0042cf11
add esp, 0x23c
ret