Function at 0x404f70
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe80
mov eax, dword [0x456fc0]
mov dword [esp + 0xe7c], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45569c]
mov eax, 0x6342662b
imul ecx
mov ecx, dword [0x455688]
imul ecx, ecx, 0x12b9
mov esi, dword [0x4556a8]
imul esi, esi, 0x14a2
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov ebx, dword [0x4556a0]
add esi, ecx
mov ecx, dword [0x455690]
mov eax, 0x1cb32649
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ebx
push 0
sub esi, 0x5cc
push 2
mov dword [0x455690], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [0x45569c]
mov dword [esp + 0x14], eax
mov eax, 0x59da2e6b
imul edi
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x455690]
mov eax, 0x9cbd99d5
imul ecx
mov ecx, dword [0x455694]
mov esi, dword [0x45568c]
sar edx, 0xb
imul esi, esi, 0x140f
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x4700d503
imul ecx
sub ebp, ebx
mov ebx, dword [0x4556a8]
sar edx, 9
imul ebx, ebx, 0xaef
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x903bb8bb
imul edi
add ebx, esi
add ebx, ebp
mov ebp, dword [0x455698]
imul ebp, ebp, 0x12b9
add edx, edi
sar edx, 0xb
mov eax, edx
add ecx, ebx
shr eax, 0x1f
add eax, edx
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x736
sub ebp, eax
xor ebx, ebx
mov dword [esp + 0xe4], 0x128
add ebp, esi
mov edx, dword [0x4556a4]
add ecx, ebp
mov ebp, dword [esp + 0x14]
lea eax, [ecx + edx - 0x5cc]
lea ecx, [esp + 0xe4]
push ecx
push ebp
mov dword [0x455694], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4050dc
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe7c]
call fcn.0042904d
add esp, 0xe80
ret
mov edx, dword [0x45569c]
mov eax, 0x5e17e411
imul edx
mov ecx, dword [0x4556a0]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov edi, eax
mov eax, 0x6d62dd3b
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455690]
mov esi, ecx
imul edx, edx, 0x5cc
imul esi, esi, 0x16cb
sub edi, esi
sub edi, eax
mov eax, dword [0x455688]
sub edi, edx
add edi, dword [str._r_____r____]
add eax, edi
mov dword [0x455688], eax
xor esi, esi
mov al, byte [esp + esi + 0x108]
mov byte [esp + esi + 0x20c], al
inc esi
test al, al
jne 0x405140
mov esi, dword [0x4556a8]
imul ecx, ecx, 0xe33
mov eax, 0xcc33a611
imul esi
add edx, esi
imul esi, esi, 0x5cc
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
sub ecx, eax
mov eax, 0x5da803a9
imul edx
sar edx, 0xa
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x455694]
mov eax, 0x4700d503
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0xe94]
sub edi, ecx
push edx
lea eax, [esp + 0x210]
sub edi, esi
push eax
mov dword [0x455698], edi
call fcn.00433ade
mov ecx, dword [0x455690]
mov esi, dword [0x4556a0]
add esp, 8
test eax, eax
jne 0x405235
mov edi, dword [0x45568c]
mov eax, 0x903bb8bb
imul edi
add edx, edi
mov ebx, esi
imul ebx, ebx, 0x140f
sar edx, 0xb
add ebx, edx
mov edi, edx
mov edx, dword [0x4556a8]
imul edx, edx, 0xaef
shr edi, 0x1f
add edi, ebx
sub edi, edx
mov eax, 0x4700d503
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, dword [0x455694]
add eax, 0x11d7
mov dword [0x45568c], eax
mov ebx, 1
mov edx, dword [0x45569c]
imul esi, esi, 0x16cb
imul ecx, ecx, 0x5cc
mov eax, 0x5e17e411
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov edi, eax
mov eax, 0x6d62dd3b
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, esi
sub edi, eax
mov eax, dword [0x455688]
sub edi, ecx
add edi, dword [str._r_____r____]
lea ecx, [esp + 0xe4]
push ecx
add eax, edi
push ebp
mov dword [0x455688], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4053d4
mov eax, ebx
shl eax, 6
lea edx, [esp + 0x108]
lea edi, [esp + eax + 0x20c]
sub eax, edx
lea esi, [esp + eax + 0x20c]
mov dword [esp + 0x18], esi
nop
lea eax, [esp + 0x108]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x4052c7
mov ecx, dword [0x45568c]
mov ebp, dword [0x4556a0]
mov eax, 0x903bb8bb
imul ebp, ebp, 0x140f
imul ecx
add edx, ecx
mov ecx, dword [0x4556a8]
imul ecx, ecx, 0xaef
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
sub eax, ecx
mov ecx, dword [0x455690]
mov ebp, eax
mov eax, 0x4700d503
imul ecx
mov ecx, dword [esp + 0xe94]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [0x455694]
add eax, ebp
sub eax, edx
push ecx
add eax, 0x11d7
push edi
mov dword [0x45568c], eax
call fcn.00433ade
add esp, 8
test eax, eax
jne 0x4053ba
mov esi, dword [0x45568c]
mov ebp, dword [0x455690]
mov ecx, dword [0x455694]
imul ebp, ebp, 0x16cb
mov edx, esi
imul edx, edx, 0x15c4
add ebp, edx
mov eax, 0x6342662b
imul ecx
imul ecx, ecx, 0x5cc
sar edx, 0xb
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x6d62dd3b
imul esi
mov esi, dword [esp + 0x18]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov ecx, dword [esp + 0xec]
mov dword [esp + ebx*4 + 0x1c], ecx
inc ebx
add edi, 0x40
add esi, 0x40
mov dword [0x45569c], ebp
mov dword [esp + 0x18], esi
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0xe4]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4052c0
mov ecx, dword [0x45568c]
mov eax, 0x1cb32649
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 9
imul ecx, ecx, 0x11d7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
imul edx, edx, 0x509
sub ecx, eax
add ecx, edx
push ebp
mov dword [0x4556a0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe8c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
call fcn.0042904d
add esp, 0xe80
ret