Function at 0x404f20
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [0x457190]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24c]
push eax
push 0x445fbc
lea ecx, [esp + 0x148]
push 0x104
push ecx
call fcn.00429b9c
mov ecx, dword [0x455824]
mov eax, 0x51eb851f
imul dword [0x45581c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
mov ebp, eax
mov ebx, dword [0x455830]
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x38e38e39
imul dword [0x455834]
sar edx, 4
mov edi, ebx
imul edi, edi, 0x35
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455820]
add ebp, edi
add ecx, ebp
mov ebp, eax
mov eax, 0x78787879
imul edx
mov esi, dword [0x455838]
sar edx, 4
imul esi, esi, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
mov ebp, eax
mov eax, 0x5397829d
imul dword [0x455834]
sar edx, 4
add ebp, edx
mov eax, edx
mov edx, dword [0x455818]
imul edx, edx, 0x31
shr eax, 0x1f
add ecx, esi
add eax, ebp
add esp, 0x10
mov dword [str._r_____r____], ecx
add eax, edx
imul ebx, ebx, 0x32
sub eax, ebx
mov dword [0x455818], eax
mov eax, 0x4bda12f7
imul dword [0x455838]
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x4bda12f7
imul dword [0x45581c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
sub eax, ecx
push 0
lea ecx, [eax + edi + 0x28]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x45581c], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x455828]
mov edi, dword [0x455818]
mov ebx, eax
mov eax, 0x4bda12f7
imul esi
sar edx, 4
lea ecx, [esi + edi]
imul ecx, ecx, 0x36
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x51eb851f
imul esi
mov esi, dword [0x455834]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp ebx, 0xffffffff
mov dword [0x455834], ecx
jne 0x40514a
mov eax, 0x38e38e39
imul edi, edi, 0x31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455820]
mov esi, eax
mov eax, 0x78787879
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov ecx, edx
sub ebx, esi
add ebx, edx
mov edx, dword [0x455830]
imul edx, edx, 0x32
shr ecx, 0x1f
add ecx, ebx
add ecx, edi
sub ecx, edx
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x455818], ecx
call fcn.00429b36
add esp, 4
jmp 0x4056fb
mov esi, dword [0x45582c]
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455820]
mov esi, eax
mov eax, 0x99999999
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
lea edx, [edi + edi*8]
lea eax, [eax + edx*8]
mov edx, dword [str._r_____r____]
imul edx, edx, 0x38
add eax, edx
sub eax, ecx
sub eax, 0x31
mov dword [0x455820], eax
lea eax, [esp + 0x18]
push eax
push ebx
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x405205
mov ecx, dword [0x45582c]
mov edi, dword [0x455830]
mov eax, 0x4bda12f7
imul ecx
mov eax, dword [0x455828]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [eax + eax*8]
mov eax, dword [0x455818]
shl edx, 3
imul eax, eax, 0x35
sub edx, ecx
mov ecx, dword [str._r_____r____]
imul ecx, ecx, 0x36
add eax, edi
add eax, edx
lea edx, [ecx + eax - 0x31]
push ebx
mov dword [0x455824], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4056fb
mov ecx, dword [0x455838]
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45581c]
mov esi, ecx
imul edx, edx, 0x36
imul esi, esi, 0xffffffcf
sub esi, eax
add esi, edx
mov edx, dword [0x455824]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
mov dword [0x455828], ecx
jmp 0x405270
mov ecx, dword [0x455820]
mov esi, dword [0x45582c]
mov eax, 0x92492493
imul esi, esi, 0x31
imul ecx
add edx, ecx
imul ecx, ecx, 0x32
sar edx, 5
mov edi, edx
add esi, edx
mov eax, 0x38e38e39
imul dword [0x45581c]
shr edi, 0x1f
add edi, esi
add edi, ecx
mov ecx, dword [0x455830]
sar edx, 4
imul ecx, ecx, 0x22
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
add edi, ecx
push eax
mov dword [0x45582c], edi
call fcn.004338be
add esp, 8
test eax, eax
je 0x40563e
mov ecx, dword [0x45582c]
mov esi, dword [0x455828]
imul ecx, ecx, 0x31
imul esi, esi, 0x22
sub esi, ecx
mov ecx, dword [0x45581c]
mov eax, 0x66666667
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
imul ecx, ecx, 0x1b
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
push edx
sub esi, eax
push 0
add esi, ecx
push 0x1f0fff
mov dword [0x455830], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45581c]
mov esi, eax
mov eax, 0x51eb851f
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
mov edi, eax
mov eax, 0x4bda12f7
imul ecx
mov ecx, dword [0x455838]
imul ecx, ecx, 0xd
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, ecx
mov ecx, dword [0x455830]
mov edx, ecx
imul edx, edx, 0x35
add eax, edx
test esi, esi
mov dword [str._r_____r____], eax
jne 0x4053ac
push 0x445f88
call fcn.00429b36
add esp, 4
jmp 0x40547c
mov edi, dword [0x455834]
imul ecx, ecx, 0x32
mov eax, 0x38e38e39
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455820]
mov ebp, eax
mov eax, 0x78787879
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
mov ebp, eax
mov eax, 0x5397829d
imul edi
sar edx, 4
mov eax, edx
add ebp, edx
mov edx, dword [0x455818]
imul edx, edx, 0x31
shr eax, 0x1f
add eax, ebp
add eax, edx
sub eax, ecx
push esi
mov dword [0x455818], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x405420
push 0x445f74
call fcn.00429b36
add esp, 4
mov ecx, dword [0x455820]
mov edi, dword [0x45582c]
mov eax, 0x92492493
imul edi, edi, 0x31
imul ecx
add edx, ecx
imul ecx, ecx, 0x32
sar edx, 5
mov ebp, edx
shr ebp, 0x1f
add edi, edx
add ebp, edi
add ebp, ecx
mov ecx, dword [0x45581c]
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x455830]
sar edx, 4
imul ecx, ecx, 0x22
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov dword [0x45582c], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
lea edx, [esp + 0x18]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405270
mov esi, dword [0x455824]
mov ecx, dword [0x455828]
mov edi, dword [esp + 0x14]
mov edx, dword [0x45582c]
imul ecx, ecx, 0x22
imul esi, esi, 0x1b
imul edx, edx, 0x31
sub ecx, edx
mov eax, 0x66666667
imul dword [0x45581c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
push ebx
mov dword [0x455830], ecx
call ebp
mov ecx, dword [0x455838]
mov eax, 0x4bda12f7
imul ecx
imul ecx, ecx, 0xd
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45581c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, ecx
mov ecx, dword [0x455830]
imul ecx, ecx, 0x35
add eax, ecx
sub eax, edx
add eax, 0x28
test edi, edi
mov dword [0x45581c], eax
je 0x4056a2
mov edx, dword [esp + 0x20]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x45582c]
mov esi, eax
mov ecx, dword [0x455820]
mov eax, 0x92492493
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x99999999
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [0x455818]
sub edx, edi
mov edi, dword [str._r_____r____]
lea eax, [ecx + ecx*8]
lea edx, [edx + eax*8]
mov eax, edi
imul eax, eax, 0x38
add edx, eax
sub edx, dword [0x455834]
sub edx, 0x31
test esi, esi
mov dword [0x455820], edx
je 0x4056fb
mov eax, 0x4bda12f7
imul ecx, ecx, 0x35
imul edi, edi, 0x36
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [0x455828]
lea eax, [eax + eax*8]
shl eax, 3
sub eax, edx
add ecx, dword [0x455830]
add ecx, eax
push 0
lea ecx, [edi + ecx - 0x31]
push esi
mov dword [0x455824], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [0x45582c]
mov edi, dword [0x455828]
imul edx, edx, 0x31
mov ecx, dword [0x45581c]
imul edi, edi, 0x22
sub edi, edx
mov eax, 0x66666667
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
imul ecx, ecx, 0x1b
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push esi
mov dword [0x455830], edi
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.00428e41
add esp, 0x238
ret
mov ecx, dword [0x455838]
mov eax, 0x4d4873ed
imul ecx
mov esi, dword [0x455824]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45581c]
mov edi, ecx
imul edx, edx, 0x36
imul edi, edi, 0xffffffcf
sub edi, eax
add edi, edx
mov eax, 0x4bda12f7
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov ecx, edx
add edi, edx
shr ecx, 0x1f
add ecx, edi
mov edi, dword [esp + 0x20]
mov dword [0x455828], ecx
jmp 0x40549f
mov ecx, dword [0x455828]
mov edx, dword [0x455818]
lea esi, [ecx + edx]
mov eax, 0x4bda12f7
imul esi, esi, 0x36
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x455834]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x455834], esi
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.00428e41
add esp, 0x238
ret