Function at 0x410870
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9cc
mov eax, dword [0x460640]
xor eax, esp
push ebx
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x9e0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x45eccc]
mov dword [esp + 0x20], eax
mov eax, dword [0x45ecd4]
cdq
mov edi, eax
push 0xf
mov ebx, edx
mov eax, esi
cdq
push 0x3c2325f6
push edx
push eax
mov dword [esp + 0xc0], 0x128
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
call fcn.00432020
push 0x13
push 0x2c2da253
push ebx
push edi
mov ebp, eax
call fcn.00432020
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0x14
push 0x76aab896
push ecx
sub eax, ebp
push edx
mov ebp, eax
call fcn.00432020
push 0x14
push 0x76aab896
push ebx
push edi
add ebp, eax
call fcn.00432020
imul esi, esi, 0x392bae29
mov ecx, dword [0x45ece8]
sub ebp, eax
imul ecx, ecx, 0x471ee414
mov eax, dword [0x45ecdc]
imul eax, eax, 0x3dbf610d
add ebp, eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0xb0]
add ebp, ecx
push edx
add ebp, esi
push eax
mov dword [str._r_____r____], ebp
mov dword [esp + 0x24], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x410954
or eax, 0xffffffff
jmp 0x410e10
mov eax, dword [0x45ecd4]
cdq
mov edi, eax
mov eax, dword [0x45eccc]
push 8
mov ebx, edx
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
push 0x13
push 0x2c2da253
push ebx
push edi
mov esi, eax
call fcn.00432020
push 0xd
push 0x3dbf610d
push ebx
push edi
add esi, eax
call fcn.00432020
mov ecx, dword [0x45ece4]
mov edx, dword [0x45ece8]
imul ecx, ecx, 0x31b5823a
add esi, eax
imul edx, edx, 0x471ee414
mov eax, dword [0x45ece0]
imul eax, eax, 0x392bae29
sub esi, ecx
mov ecx, dword [str._r_____r____]
sub esi, edx
add esi, eax
sub esi, ecx
sub esi, 0x1bcdabbc
mov dword [0x45eccc], esi
xor eax, eax
jmp 0x4109e0
mov dl, byte [esp + eax + 0xd4]
mov byte [esp + eax + 0x1d8], dl
inc eax
test dl, dl
jne 0x4109e0
mov edi, dword [0x45ecdc]
mov ebp, dword [0x45ecd8]
push 0x13
mov eax, edi
cdq
push 0x2c2da253
push edx
mov ebx, ecx
add ebp, ecx
imul ebx, ebx, 0x2c2da253
push eax
imul ebp, ebp, 0x3dbf610d
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
call fcn.00432020
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 8
push 0x974b287b
push ecx
push edx
add ebp, eax
call fcn.00432020
mov ecx, dword [0x45ece0]
sub ebp, eax
mov eax, edi
imul eax, eax, 0x392bae29
add ebp, ebx
add eax, ebp
lea edx, [eax + ecx + 0x31b5823a]
mov eax, dword [esp + 0x9e0]
mov dword [0x45ecd4], edx
lea ebp, [esp + 0x1d8]
nop
mov dl, byte [ebp]
mov cl, dl
cmp dl, byte [eax]
jne 0x410a95
test cl, cl
je 0x410a91
mov dl, byte [ebp + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x410a95
add ebp, 2
add eax, 2
test cl, cl
jne 0x410a70
xor eax, eax
jmp 0x410a9a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410b19
mov eax, dword [0x45ece4]
cdq
mov ebp, eax
push 0xd
mov dword [esp + 0x18], edx
mov eax, esi
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecd0]
mov edx, dword [esp + 0x14]
add esi, ecx
imul esi, esi, 0x3c2325f6
push 0x13
push 0x2c2da253
push edx
push ebp
sub esi, eax
call fcn.00432020
push 0x14
add esi, eax
mov eax, dword [esp + 0x18]
push 0x76aab896
push eax
push ebp
call fcn.00432020
imul edi, edi, 0x31b5823a
add esi, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0x42a7b17d
add esi, eax
sub esi, edi
mov ebp, 1
mov dword [0x45ecdc], esi
mov dword [esp + 0x1c], ebp
jmp 0x410b1d
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x45ecd8]
cdq
mov esi, eax
mov eax, dword [0x45ece4]
push 0xffffffffffffffeb
mov dword [esp + 0x18], edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov edx, dword [0x45ecd4]
mov ecx, dword [0x45ecc8]
add ecx, edx
mov edi, eax
imul ecx, ecx, 0x68b4d785
mov eax, dword [str._r_____r____]
push 0x10
cdq
push 0xe4325444
push edx
push eax
sub edi, ecx
call fcn.00432020
push 0xf
add edi, eax
mov eax, dword [esp + 0x18]
push 0x3c2325f6
push eax
push esi
call fcn.00432020
mov ecx, dword [esp + 0x14]
push 0x13
push 0x2c2da253
push ecx
push esi
sub edi, eax
call fcn.00432020
sub edi, eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0xb0]
push edx
add edi, ebx
push eax
mov dword [0x45ece4], edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x410d6f
mov eax, ebp
shl eax, 6
lea ecx, [esp + eax + 0x1d8]
lea edx, [esp + 0xd4]
sub eax, edx
lea eax, [esp + eax + 0x1d8]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
lea esp, [esp]
mov eax, dword [0x45ecd0]
cdq
mov ebx, eax
mov eax, dword [0x45ece4]
push 0xd
mov edi, edx
cdq
push 0x3dbf610d
push edx
push eax
mov dword [esp + 0x3c], edi
call fcn.00432020
push 0x13
push 0x392bae29
push edi
push ebx
mov dword [esp + 0x20], eax
call fcn.00432020
push 8
push 0x42a7b17d
mov esi, eax
mov eax, dword [esp + 0x18]
push edi
push ebx
sub esi, eax
call fcn.00432020
push 3
push 0xce4a7dc6
push edi
push ebx
add esi, eax
call fcn.00432020
mov ecx, dword [0x45ece0]
mov edx, dword [0x45ecc8]
imul ecx, ecx, 0xafbbe1e
imul edx, edx, 0x31b5823a
add esi, eax
add esi, ecx
sub esi, edx
mov dword [0x45ecc8], esi
lea eax, [esp + 0xd4]
mov cl, byte [eax]
mov edx, dword [esp + 0x18]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x410c65
mov eax, dword [esp + 0x9e0]
mov edi, dword [esp + 0x24]
mov edi, edi
mov dl, byte [edi]
mov cl, dl
cmp dl, byte [eax]
jne 0x410ca4
test cl, cl
je 0x410ca0
mov dl, byte [edi + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x410ca4
add edi, 2
add eax, 2
test cl, cl
jne 0x410c80
xor eax, eax
jmp 0x410ca9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410d55
mov eax, dword [0x45ecdc]
push 0x14
cdq
push 0x76aab896
push edx
push eax
call fcn.00432020
mov edi, dword [0x45ecd8]
mov ebp, eax
push 3
mov eax, edi
cdq
push 0xce4a7dc6
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x2c]
push 0x10
push 0xe4325444
push ecx
sub eax, ebp
push ebx
mov ebp, eax
call fcn.00432020
imul esi, esi, 0x3dbf610d
imul edi, edi, 0x76aab896
mov edx, dword [0x45ece8]
imul edx, edx, 0x471ee414
mov ebx, dword [0x45ece4]
mov ecx, dword [esp + 0x18]
sub ebp, eax
mov eax, dword [esp + 0xb8]
add ebp, esi
add ebp, edi
add ebp, edx
mov edx, dword [esp + 0x24]
sub ebp, ebx
add ebp, 0x31b5823a
mov dword [0x45ecd0], ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp + ebp*4 + 0x30], eax
mov eax, 0x40
inc ebp
add edx, eax
add ecx, eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0xb0]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x410be0
mov esi, dword [0x45ece8]
mov edi, dword [0x45ece0]
mov eax, esi
cdq
mov dword [esp + 0x10], eax
push 8
mov dword [esp + 0x18], edx
mov eax, edi
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
mov ebx, eax
mov eax, dword [0x45ecd4]
push 0x13
cdq
push 0x2c2da253
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x10]
push 0x14
sub ebx, eax
mov eax, dword [esp + 0x18]
push 0x471ee414
push eax
push ecx
call fcn.00432020
mov edx, dword [esp + 0x14]
push 0x13
push 0x392bae29
add ebx, eax
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.00432020
imul edi, edi, 0x68b4d785
imul esi, esi, 0x31b5823a
mov ecx, dword [0x45ecc8]
mov edx, dword [esp + 0x20]
imul ecx, ecx, 0x2c2da253
sub ebx, eax
sub ebx, edi
add ebx, esi
add ebx, ecx
push edx
mov dword [0x45ecd8], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov ecx, dword [esp + 0x9d8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00431e3d
add esp, 0x9cc
ret