Function at 0x406500
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x45e540]
mov edx, dword [esp + 0x23c]
xor eax, esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x44d05c
stosb byte es:[edi], al
lea eax, [esp + 0x148]
push 0x104
push eax
call fcn.00430eac
mov ecx, dword [0x45cbd4]
mov eax, 0x680c7cd1
imul ecx
sar edx, 0x19
mov esi, edx
mov ebx, dword [0x45cbcc]
shr esi, 0x1f
add esi, edx
mov eax, 0x315a5211
imul ecx
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x315a5211
imul ebx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0x3575d9d
mov ebp, ecx
mov ecx, eax
mov eax, ebx
imul eax, eax, 0x4e899b9
sub ecx, ebp
add ecx, edx
add ecx, eax
mov ebp, dword [0x45cbe4]
mov eax, 0x83740ec5
imul ebx
add edx, ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edi, dword [0x45cbe8]
mov eax, 0x993c2c11
imul edi, edi, 0x5335ef4
imul ebp
add edx, ebp
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x3bfa58a9
imul dword [0x45cbd0]
sar edx, 0x17
mov eax, edx
add ecx, esi
shr eax, 0x1f
add ecx, edi
add eax, edx
mov edx, dword [0x45cbe0]
add esp, 0x10
mov dword [str._r_____r____], ecx
sub eax, ebp
imul edx, edx, 0x14e459e
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x342745e1
imul dword [0x45cbd0]
mov eax, dword [esp + 0x10]
sar edx, 0x18
add eax, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0x206151bf
imul dword [0x45cbd0]
sar edx, 0x15
add ebp, edx
mov eax, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0xfcfe96
shr eax, 0x1f
add eax, ebp
mov ebp, dword [0x45cbd4]
add eax, edx
mov dword [0x45cbc8], eax
mov eax, 0x993c2c11
imul ebp
mov eax, dword [0x45cbe0]
add edx, ebp
imul eax, eax, 0x4e899b9
sar edx, 0x19
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
add ebp, eax
mov eax, 0x74b32761
imul ebx
mov eax, dword [0x45cbe4]
imul eax, eax, 0xfcfe96
sar edx, 0x18
mov ebx, edx
shr ebx, 0x1f
add ebp, edx
add ebx, ebp
add ebx, eax
sub ebx, edi
sub ebx, ecx
push 0
lea eax, [ebx + esi + 0x456b154]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45cbcc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45cbd4]
mov ebx, dword [0x45cbc8]
mov ebp, eax
mov esi, dword [str._r_____r____]
lea edi, [ebx + ecx]
mov ecx, dword [0x45cbe4]
imul edi, edi, 0x23193db
mov eax, 0x315a5211
imul ecx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3b012ec7
imul esi
sar edx, 0x18
mov ecx, edx
add edi, edx
shr ecx, 0x1f
add ecx, edi
mov edi, dword [0x45cbd8]
mov eax, 0x680c7cd1
imul edi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
imul esi, esi, 0x4ebb783
mov eax, 0x83740ec5
imul edi
add edx, edi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add ecx, esi
add eax, edx
sub ecx, eax
cmp ebp, 0xffffffff
mov dword [0x45cbe4], ecx
jne 0x4067de
mov eax, 0x993c2c11
imul ebx, ebx, 0xfcfe96
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x45cbd0]
mov eax, 0x3bfa58a9
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x14e459e
mov edi, eax
sub edi, esi
add edi, edx
mov eax, 0x342745e1
imul ecx
sar edx, 0x18
mov esi, edx
add edi, edx
mov eax, 0x206151bf
imul ecx
sar edx, 0x15
shr esi, 0x1f
mov eax, edx
add esi, edi
shr eax, 0x1f
add esi, edx
add eax, esi
add eax, ebx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45cbc8], eax
call fcn.00430e46
add esp, 4
jmp 0x406fbd
mov edx, dword [0x45cbdc]
imul ebx, ebx, 0x3575d9d
mov eax, 0x315a5211
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe8]
mov esi, edi
imul edx, edx, 0x5335ef4
imul esi, esi, 0x52fe876
sub esi, eax
add esi, ebx
add esi, edx
mov edx, dword [0x45cbd0]
mov eax, 0x3b012ec7
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x206151bf
imul edi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
lea ecx, [esp + 0x18]
push ecx
sub eax, 0xfcfe96
push ebp
mov dword [0x45cbd0], eax
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4068d5
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45cbd8]
mov esi, dword [0x45cbdc]
lea edi, [edx + ecx]
imul ecx, ecx, 0x4ebb783
mov eax, 0x680c7cd1
imul edi, edi, 0x3575d9d
imul esi
sar edx, 0x19
mov eax, esi
imul eax, eax, 0x4e899b9
mov ebx, edx
shr ebx, 0x1f
add edi, edx
add ebx, edi
add ebx, ecx
add ebx, eax
mov eax, 0x74b32761
imul esi
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cbe0]
sub ebx, ecx
lea eax, [ebx + edx - 0xfcfe96]
push ebp
mov dword [0x45cbd4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406fbd
mov esi, dword [0x45cbe8]
mov ecx, dword [0x45cbc8]
mov eax, 0xc4e5d61
imul ecx, ecx, 0x4ebb783
imul esi
sar edx, 0x16
mov edi, edx
shr edi, 0x1f
add edi, edx
add edi, ecx
mov ecx, dword [0x45cbd4]
mov eax, 0x680c7cd1
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x342745e1
imul esi
imul esi, esi, 0xfcfe96
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45cbe0]
mov eax, 0x74b32761
imul ecx
sar edx, 0x18
add edi, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x23193db
shr eax, 0x1f
add eax, edi
add eax, edx
sub eax, esi
mov dword [0x45cbd8], eax
jmp 0x406960
mov esi, dword [0x45cbcc]
imul ecx, ecx, 0x222559d
mov eax, dword [0x45cbd0]
mov edi, dword [0x45cbe4]
lea ebx, [eax + esi]
mov eax, 0x315a5211
imul ebx, ebx, 0x3e51956
imul edi
sar edx, 0x18
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x993c2c11
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x680c7cd1
imul edi
add ebx, ecx
sar edx, 0x19
mov ecx, edx
add ebx, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0xfcfe96
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
lea eax, [esp + 0x140]
mov dword [0x45cbdc], ecx
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.0043ac7e
mov ecx, dword [0x45cbe8]
add esp, 8
test eax, eax
je 0x406c47
mov edx, dword [0x45cbd0]
mov eax, dword [0x45cbd4]
lea esi, [edx + ecx]
imul eax, eax, 0x5335ef4
mov edx, dword [0x45cbd8]
imul esi, esi, 0x456b154
imul edx, edx, 0x222559d
sub esi, eax
add esi, edx
mov edx, dword [0x45cbcc]
mov eax, 0x3b012ec7
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x83740ec5
imul ecx
mov eax, dword [esp + 0x20]
add edx, ecx
sar edx, 0x19
mov ecx, edx
add esi, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0xfcfe96
shr ecx, 0x1f
push eax
add ecx, esi
push 0
sub ecx, edx
push 0x1f0fff
mov dword [0x45cbe0], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x45cbd4]
mov esi, eax
mov eax, 0x315a5211
imul edi
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x45cbcc]
mov eax, 0x315a5211
imul ecx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0x3575d9d
sub eax, ebx
add eax, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x5335ef4
add eax, edx
mov ebx, eax
mov eax, 0x680c7cd1
imul edi
mov eax, ecx
imul eax, eax, 0x4e899b9
sar edx, 0x19
mov edi, edx
add ebx, edx
shr edi, 0x1f
add edi, ebx
add edi, eax
mov eax, 0x83740ec5
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
test esi, esi
mov dword [str._r_____r____], edi
jne 0x406b14
push 0x44d028
call fcn.00430e46
add esp, 4
jmp 0x406c29
mov ecx, dword [0x45cbe4]
mov eax, 0x993c2c11
imul ecx
add edx, ecx
mov ecx, dword [0x45cbd0]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x3bfa58a9
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x14e459e
mov ebx, eax
sub ebx, edi
add ebx, edx
mov eax, 0x342745e1
imul ecx
sar edx, 0x18
mov edi, edx
add ebx, edx
mov eax, 0x206151bf
imul ecx
mov ecx, dword [0x45cbc8]
imul ecx, ecx, 0xfcfe96
sar edx, 0x15
shr edi, 0x1f
mov eax, edx
add edi, ebx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, ecx
push esi
mov dword [0x45cbc8], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x406ba9
push 0x44d014
call fcn.00430e46
add esp, 4
mov ecx, dword [0x45cbcc]
mov edx, dword [0x45cbd0]
mov edi, dword [0x45cbe4]
lea ebx, [edx + ecx]
mov eax, 0x315a5211
imul ebx, ebx, 0x3e51956
imul edi
sar edx, 0x18
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x993c2c11
imul ecx
add edx, ecx
mov ecx, dword [0x45cbe0]
sar edx, 0x19
imul ecx, ecx, 0x222559d
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x680c7cd1
imul edi
add ebx, ecx
mov ecx, dword [0x45cbdc]
imul ecx, ecx, 0xfcfe96
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
push esi
mov dword [0x45cbdc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x18]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406cc7
mov ecx, dword [0x45cbe0]
jmp 0x406960
mov esi, dword [0x45cbd4]
mov eax, 0xc4e5d61
imul ecx
mov eax, dword [0x45cbc8]
imul eax, eax, 0x4ebb783
sar edx, 0x16
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, eax
mov eax, 0x680c7cd1
imul esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edi, dword [0x45cbe0]
mov eax, 0x342745e1
imul ecx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x74b32761
imul edi
imul edi, edi, 0x23193db
sar edx, 0x18
add ebx, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0xfcfe96
shr eax, 0x1f
add eax, ebx
add eax, edi
mov edi, dword [esp + 0x20]
sub eax, edx
mov dword [0x45cbd8], eax
jmp 0x406cdc
mov esi, dword [0x45cbd4]
mov ecx, dword [0x45cbe8]
mov eax, dword [0x45cbd8]
mov edi, dword [esp + 0x14]
mov edx, dword [0x45cbd0]
imul eax, eax, 0x222559d
imul esi, esi, 0x5335ef4
lea ebx, [edx + ecx]
mov edx, dword [0x45cbcc]
imul ebx, ebx, 0x456b154
sub ebx, esi
add ebx, eax
mov eax, 0x3b012ec7
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x83740ec5
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
add ebx, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0xfcfe96
shr ecx, 0x1f
add ecx, ebx
sub ecx, edx
push ebp
mov dword [0x45cbe0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x45cbd4]
mov eax, 0x993c2c11
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x5335ef4
mov esi, eax
sub esi, edx
mov eax, 0x680c7cd1
imul ecx
mov eax, dword [0x45cbe0]
imul eax, eax, 0x4e899b9
sar edx, 0x19
add esi, edx
mov ebx, edx
mov edx, dword [0x45cbcc]
shr ebx, 0x1f
add ebx, esi
add ebx, eax
mov eax, 0x74b32761
imul edx
sar edx, 0x18
add ebx, edx
mov eax, edx
mov edx, dword [0x45cbe4]
mov esi, edx
imul esi, esi, 0xfcfe96
shr eax, 0x1f
add eax, ebx
add eax, esi
mov esi, dword [str._r_____r____]
sub eax, esi
add eax, 0x456b154
test edi, edi
mov dword [0x45cbcc], eax
je 0x406f4e
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45cbdc]
mov ebx, dword [0x45cbd8]
mov ecx, dword [0x45cbc8]
mov edi, eax
imul ecx, ecx, 0x3575d9d
mov eax, 0x315a5211
imul esi
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe8]
mov ebp, ebx
imul edx, edx, 0x5335ef4
imul ebp, ebp, 0x52fe876
sub ebp, eax
add ebp, ecx
mov ecx, dword [0x45cbd0]
add ebp, edx
mov eax, 0x3b012ec7
imul ecx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x206151bf
imul ebx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
sub ecx, dword [0x45cbe4]
sub ecx, 0xfcfe96
test edi, edi
mov dword [0x45cbd0], ecx
je 0x406fbd
mov ecx, dword [str._r_____r____]
add ebx, ecx
imul ecx, ecx, 0x4ebb783
mov eax, 0x680c7cd1
imul ebx, ebx, 0x3575d9d
imul esi
sar edx, 0x19
mov ebp, edx
add ebx, edx
mov edx, esi
imul edx, edx, 0x4e899b9
shr ebp, 0x1f
add ebp, ebx
add ebp, ecx
mov ecx, dword [0x45cbe0]
add ebp, edx
mov eax, 0x74b32761
imul esi
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
push 0
lea edx, [ecx + ebp - 0xfcfe96]
push edi
mov dword [0x45cbd4], edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x45cbe8]
mov eax, dword [0x45cbd0]
mov edx, dword [0x45cbd4]
lea esi, [eax + ecx]
imul edx, edx, 0x5335ef4
mov eax, dword [0x45cbd8]
imul esi, esi, 0x456b154
imul eax, eax, 0x222559d
sub esi, edx
mov edx, dword [0x45cbcc]
add esi, eax
mov eax, 0x3b012ec7
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x83740ec5
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
add esi, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0xfcfe96
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
push edi
mov dword [0x45cbe0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x406fbf
mov eax, dword [0x45cbc8]
add ecx, eax
mov eax, 0x315a5211
imul ecx, ecx, 0x23193db
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x3b012ec7
imul esi
imul esi, esi, 0x4ebb783
sar edx, 0x18
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x45cbd8]
mov eax, 0x680c7cd1
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x83740ec5
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add edi, esi
add ecx, edx
sub edi, ecx
mov dword [0x45cbe4], edi
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043016d
add esp, 0x238
ret