Function at 0x40c7b0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x459190]
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x457824]
mov esi, eax
mov eax, 0x77c150d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x457838]
imul edx, edx, 0x1685
sub edi, ecx
mov ecx, dword [0x45781c]
add edi, edx
mov eax, 0xb7fe3405
imul ecx
add edx, ecx
mov ecx, dword [0x457830]
sar edx, 0xc
imul ecx, ecx, 0x10e6
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [esp + 0x98]
sub edi, eax
push edx
add edi, ecx
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0xa0], 0x128
mov dword [str._r_____r____], edi
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40c87b
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x9b8]
call fcn.0042a6e1
add esp, 0x9bc
ret
mov ecx, dword [0x457838]
mov eax, 0x77c150d
imul ecx
imul ecx, ecx, 0x1685
mov edi, dword [0x457830]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x45781c]
mov eax, 0x17eb125
imul ecx
sar edx, 5
add esi, edx
mov ecx, edx
mov edx, edi
imul edx, edx, 0x10e6
shr ecx, 0x1f
add ecx, esi
mov esi, dword [str._r_____r____]
add ecx, edx
sub ecx, esi
add ecx, 0x1123
mov dword [0x45781c], ecx
xor eax, eax
jmp 0x40c8e0
mov dl, byte [esp + eax + 0xbc]
mov byte [esp + eax + 0x1c0], dl
inc eax
test dl, dl
jne 0x40c8e0
push ebx
imul esi, esi, 0x2234
mov ebx, dword [0x457828]
push ebp
mov ebp, dword [0x45782c]
mov eax, 0x17eb125
imul ebp
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x457818]
sub esi, eax
imul edx, edx, 0x10e6
mov eax, ebx
imul eax, eax, 0x59b
add edx, edi
mov edi, dword [esp + 0x9d0]
add edx, esi
lea edx, [eax + edx - 0x2220]
mov dword [0x457824], edx
lea esi, [esp + 0x1c8]
lea ecx, [ecx]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40c974
test al, al
je 0x40c970
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40c974
add esi, 2
add edi, 2
test al, al
jne 0x40c950
xor eax, eax
jmp 0x40c979
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c9d6
mov esi, dword [0x457820]
imul ebp, ebp, 0x2220
mov eax, 0x9ad70599
imul esi
mov eax, dword [0x457830]
add edx, esi
imul eax, eax, 0xe4e
imul esi, esi, 0x1643
sar edx, 0xc
mov edi, edx
add ebp, edx
shr edi, 0x1f
add edi, ebp
add edi, esi
add edi, eax
mov eax, 0xb6adc247
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [0x45782c], edi
mov dword [esp + 0x10], 1
mov eax, 0x77c150d
imul ebx
sar edx, 8
mov ecx, edx
mov esi, ebx
imul esi, esi, 0x2234
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x457834]
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xb7fe3405
imul ebx
mov eax, dword [0x457818]
add edx, ebx
imul eax, eax, 0x1568
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
add esi, eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xa0]
push edx
push eax
mov dword [0x457834], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40cbcf
mov eax, dword [esp + 0x10]
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea esi, [esp + eax + 0x1c8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], esi
jmp 0x40ca80
mov esi, dword [esp + 0x18]
lea ebx, [ebx]
mov edi, dword [0x457834]
mov ebx, dword [0x457820]
mov ecx, dword [0x457830]
mov eax, 0xf00f00f1
imul ecx, ecx, 0x1643
imul edi
mov eax, dword [0x457818]
imul eax, eax, 0x2220
add edx, edi
sar edx, 0xd
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
add ebp, eax
mov eax, 0x8f2b7b75
imul ebx
add edx, ebx
sar edx, 0xb
sub ebp, ecx
add ebp, edx
mov ecx, edx
mov eax, 0xb6adc247
imul edi
add edx, edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
shr ecx, 0x1f
add eax, edx
add ecx, ebp
sub ecx, eax
mov dword [0x457818], ecx
lea eax, [esp + 0xc4]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40caf1
mov ebp, dword [esp + 0x9d0]
mov esi, dword [esp + 0x1c]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40cb2b
test al, al
je 0x40cb27
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40cb2b
add esi, 2
add ebp, 2
test al, al
jne 0x40cb06
xor eax, eax
jmp 0x40cb30
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40cbb5
mov esi, dword [0x45782c]
imul ecx, ecx, 0x59b
mov eax, 0x9ad70599
imul esi
add edx, esi
mov esi, dword [str._r_____r____]
imul esi, esi, 0x1a74
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x77826bf5
imul ebx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x1c]
sub esi, eax
mov eax, dword [esp + 0x10]
add esi, ecx
mov ecx, dword [esp + 0xa8]
sub esi, edi
mov dword [esp + eax*4 + 0x20], ecx
mov ecx, dword [esp + 0x18]
sub esi, 0x2220
inc eax
mov dword [esp + 0x10], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [0x457820], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xa0]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40ca76
mov edx, dword [0x457824]
mov ecx, dword [0x457838]
mov eax, 0xf883eaf3
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov esi, ecx
imul esi, esi, 0x2220
mov eax, 0x2d78bd59
imul ecx
sar edx, 0xa
sub edi, esi
mov esi, edx
add edi, edx
mov edx, dword [0x45781c]
imul edx, edx, 0x1568
shr esi, 0x1f
add esi, edi
add esi, edx
mov eax, 0x7931d3bd
imul ecx
mov ecx, dword [esp + 0x14]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push ecx
mov dword [0x457828], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
call fcn.0042a6e1
add esp, 0x9bc
ret