Function at 0x404eb0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe7c
mov eax, dword [0x458190]
mov dword [esp + 0xe78], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45682c]
mov eax, 0x30c30c31
imul ecx
mov ecx, dword [0x456820]
mov esi, dword [str._r_____r____]
sar edx, 7
imul esi, esi, 0x2a0
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x43491159
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x87
sub esi, ecx
add esi, edx
sub esi, dword [0x456834]
push 0
sub esi, 0x344
push 2
mov dword [0x456820], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x456824]
mov ebp, eax
mov eax, 0x4c8f8d29
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x30c30c31
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45681c]
sub ecx, eax
mov ebx, dword [0x456830]
mov eax, 0x36b45a9b
imul edx
mov esi, dword [0x45682c]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456838]
sub ecx, eax
imul edx, edx, 0x235
mov eax, ebx
imul eax, eax, 0x1aa
add ecx, edx
add ecx, eax
mov eax, 0xe1fc780f
imul esi
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x358
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
xor edi, edi
sub ecx, eax
imul edx, edx, 0x1aa
mov dword [esp + 0x14], ebp
mov dword [esp + 0xe0], 0x128
mov eax, dword [0x456828]
imul eax, eax, 0x87
add edx, ebx
add edx, ecx
lea ecx, [eax + edx - 0x344]
lea edx, [esp + 0xe0]
push edx
push ebp
mov dword [0x456824], ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40501e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe78]
call fcn.0042a301
add esp, 0xe7c
ret
mov ecx, dword [0x456834]
mov eax, 0x9cc8e161
imul ecx
mov eax, dword [0x456818]
add edx, ecx
imul eax, eax, 0x344
sar edx, 9
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x456830]
imul edx, edx, 0x257
add esi, eax
sub esi, edx
mov edx, dword [0x456820]
mov eax, 0x2d4279a3
imul edx
sar edx, 6
add esi, edx
mov ebx, edx
mov eax, 0xf2b9d649
imul ecx
add edx, ecx
sar edx, 7
shr ebx, 0x1f
mov eax, edx
shr eax, 0x1f
add ebx, esi
add eax, edx
sub ebx, eax
mov dword [0x456818], ebx
xor eax, eax
jmp 0x405090
mov cl, byte [esp + eax + 0x104]
mov byte [esp + eax + 0x208], cl
inc eax
test cl, cl
jne 0x405090
mov edx, dword [0x456824]
mov ecx, dword [0x456838]
mov eax, 0xb37072d7
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov esi, ecx
imul esi, esi, 0x344
mov eax, 0xe7fc601
imul ecx
sar edx, 5
sub ebx, esi
mov esi, edx
add ebx, edx
mov edx, dword [0x45681c]
imul edx, edx, 0x244
shr esi, 0x1f
add esi, ebx
add esi, edx
mov eax, 0x99d722db
imul ecx
add edx, ecx
mov ecx, dword [esp + 0xe90]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
push ecx
lea edx, [esp + 0x20c]
sub esi, eax
push edx
mov dword [0x456828], esi
call fcn.00434d7e
mov esi, dword [0x456830]
add esp, 8
test eax, eax
jne 0x405185
mov ecx, dword [0x456838]
mov edi, dword [0x45681c]
mov eax, 0x4c8f8d29
imul ecx
imul ecx, ecx, 0x235
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0xe1fc780f
imul edi
add edx, edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [str._r_____r____]
add eax, ebx
sub eax, ecx
mov ecx, esi
imul ecx, ecx, 0x1aa
add eax, ecx
sub eax, edx
add eax, 0x1e7
mov dword [0x45681c], eax
mov edi, 1
mov ecx, dword [0x456834]
imul esi, esi, 0x257
mov eax, 0x9cc8e161
imul ecx
add edx, ecx
sar edx, 9
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x344
add ebx, edx
mov edx, dword [0x456820]
mov eax, 0x2d4279a3
imul edx
sar edx, 6
sub ebx, esi
mov esi, edx
add ebx, edx
mov eax, 0xf2b9d649
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
lea ecx, [esp + 0xe0]
add eax, edx
add esi, ebx
push ecx
sub esi, eax
push ebp
mov dword [0x456818], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405338
mov eax, edi
shl eax, 6
lea edx, [esp + 0x104]
lea ebx, [esp + eax + 0x208]
sub eax, edx
lea edx, [esp + eax + 0x208]
mov dword [esp + 0x10], edx
jmp 0x405224
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x104]
jmp 0x405230
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x405230
mov ecx, dword [0x456838]
mov esi, dword [0x45681c]
mov eax, 0x4c8f8d29
imul ecx
imul ecx, ecx, 0x235
sar edx, 8
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0xe1fc780f
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [str._r_____r____]
add eax, ebp
sub eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x1aa
add eax, ecx
sub eax, edx
mov edx, dword [esp + 0xe90]
push edx
add eax, 0x1e7
push ebx
mov dword [0x45681c], eax
call fcn.00434d7e
add esp, 8
test eax, eax
jne 0x40531e
mov ecx, dword [0x456820]
mov esi, dword [0x45682c]
mov eax, 0x30c30c31
imul esi, esi, 0x344
imul ecx
imul ecx, ecx, 0x257
mov eax, dword [0x456830]
sar edx, 7
imul eax, eax, 0x16a
mov ebp, edx
add esi, edx
shr ebp, 0x1f
add ebp, esi
add ebp, ecx
mov ecx, dword [0x45681c]
add ebp, eax
mov eax, 0xf2b9d649
imul ecx
mov eax, dword [esp + 0x10]
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0xe8]
sub ebp, ecx
mov dword [esp + edi*4 + 0x18], edx
inc edi
add ebx, 0x40
add eax, 0x40
mov dword [0x45682c], ebp
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0xe0]
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405220
mov ecx, dword [0x45681c]
mov esi, dword [0x45682c]
mov eax, 0xbcb6eea7
imul esi, esi, 0x344
imul ecx
mov eax, dword [0x456824]
sar edx, 7
imul eax, eax, 0x4e
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456828]
imul edx, edx, 0x16a
sub ecx, esi
add ecx, edx
sub ecx, eax
push ebp
mov dword [0x456830], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe88]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.0042a301
add esp, 0xe7c
ret