Function at 0x40cdd0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x45b4b0]
mov ecx, dword [0x459b3c]
mov dword [esp + 0x938], eax
mov eax, dword [0x459b58]
imul eax, eax, 0x171ed6e
push ebx
push esi
mov esi, dword [0x459b44]
push edi
mov edi, ecx
imul edi, edi, 0x1a0fa8c
add edi, eax
mov eax, 0x5e407cd
imul esi
sar edx, 0x14
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
shl eax, 1
mov edi, eax
mov eax, 0x702fe9a3
imul esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x565ef47
imul ecx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp + 8]
sub edi, ecx
mov dword [str._r_____r____], edi
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x144]
push 0x449ffc
push eax
call fcn.0042d0e1
mov ecx, dword [0x459b44]
mov eax, 0x5e407cd
imul ecx
mov ecx, dword [0x459b58]
imul ecx, ecx, 0x171ed6e
sar edx, 0x14
mov esi, edx
shr esi, 0x1f
add esi, edx
lea ebx, [ecx + esi]
mov ecx, dword [0x459b40]
mov eax, 0x540f9495
imul ecx
sar edx, 0x17
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x186e8b3d
imul ecx
sar edx, 0x17
mov ecx, edx
add edi, edx
mov edx, dword [0x459b38]
shr ecx, 0x1f
imul edx, edx, 0x53d33c3
add ecx, edi
mov edi, dword [0x459b50]
mov eax, edi
imul eax, eax, 0xbdb188
add ecx, edx
add esp, 0xc
sub ecx, eax
mov eax, 0x2742b221
imul edi, edi, 0x1a0fa8c
imul dword [0x459b54]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b3c]
sub ecx, eax
mov eax, 0x545b9e19
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, esi
mov esi, dword [str._r_____r____]
lea edx, [eax + edi*2 + 0x3409364]
sub edx, esi
mov esi, dword [0x459b48]
mov dword [0x459b3c], edx
imul esi, esi, 0x4905557
mov edx, dword [0x459b4c]
mov eax, 0x702fe9a3
imul edx
sar edx, 0x19
mov edi, dword [0x459b54]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add ecx, ebx
mov dword [0x459b38], ecx
imul ecx, ecx, 0xd0a84b
mov eax, 0x4eb6fa85
imul dword [0x459b40]
add esi, ecx
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
sub esi, edi
push 0
lea edx, [esi + ebx - 0x53d33c3]
push 2
mov dword [esp + 0x1c], 0
mov dword [0x459b40], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x40d055
mov ecx, dword [0x459b4c]
mov esi, ecx
mov eax, 0x545b9e19
imul esi, esi, 0x341f518
imul ecx
mov ecx, dword [0x459b58]
imul ecx, ecx, 0x171ed6e
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov edi, dword [0x459b50]
add esi, ecx
mov ecx, dword [0x459b44]
mov eax, 0x5e407cd
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x14
imul ecx, ecx, 0x2b75400
mov eax, edx
add esi, edx
mov edx, dword [0x459b48]
imul edx, edx, 0xd0a84b
shr eax, 0x1f
add eax, esi
add ecx, edi
add ecx, eax
lea eax, [edx + ecx - 0x53d33c3]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x459b44], eax
call fcn.0042dc06
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042cf11
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x459b44]
mov edi, dword [0x459b50]
mov eax, 0x5e407cd
imul edi, edi, 0x18470b7
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [0x459b58]
mov eax, 0x9d2b2fed
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x58945bfd
imul ecx
imul ecx, ecx, 0x3cb4655
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [0x459b48], eax
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40d180
mov ecx, dword [0x459b44]
mov edi, dword [0x459b58]
imul edi, edi, 0x171ed6e
mov eax, 0x5e407cd
imul ecx
mov ecx, dword [0x459b54]
sar edx, 0x14
add edi, edx
mov ebx, edx
mov eax, 0x702fe9a3
imul ecx
mov eax, dword [0x459b4c]
mov ecx, dword [0x459b40]
imul eax, eax, 0x53d33c3
sar edx, 0x19
imul ecx, ecx, 0xbdb188
shr ebx, 0x1f
add ebx, edi
mov edi, edx
add ebx, edx
mov edx, dword [0x459b50]
imul edx, edx, 0x185d014
shr edi, 0x1f
add edi, ebx
add edi, edx
add edi, eax
add edi, ecx
mov ecx, dword [0x459b3c]
mov eax, 0x2742b221
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push esi
mov dword [0x459b4c], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042cf11
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x459b44]
mov eax, 0x5e407cd
imul ecx
mov eax, dword [0x459b4c]
mov edi, ecx
imul eax, eax, 0x53d33c3
sar edx, 0x14
imul edi, edi, 0x171ed6e
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x459b48]
imul edx, edx, 0x185d014
mov ebx, ecx
mov ecx, dword [0x459b3c]
sub ebx, edi
add ebx, edx
sub ebx, eax
mov eax, 0x4eb6fa85
imul ecx
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x459b58]
imul edx, edx, 0x4b280d2
sub ebx, ecx
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0x40]
add ebx, edx
push ecx
mov dword [0x459b50], ebx
call fcn.0043798e
add esp, 8
test eax, eax
je 0x40d60f
mov ecx, dword [0x459b38]
mov eax, 0x545b9e19
imul ecx
mov ecx, dword [0x459b44]
sar edx, 0x17
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x459b58]
imul edx, edx, 0x171ed6e
add esi, edx
mov eax, 0x5e407cd
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x14
mov edi, edx
add esi, edx
mov eax, 0x540f9495
imul ecx
mov ecx, dword [0x459b54]
sar edx, 0x17
imul ecx, ecx, 0x53d33c3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b40]
shr edi, 0x1f
imul edx, edx, 0x8aa118
add edi, esi
sub edi, eax
mov eax, dword [esp + 0x20]
push eax
sub edi, ecx
push 0
add edi, edx
push 0x1f0fff
mov dword [0x459b58], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x459b44]
mov edi, eax
mov esi, dword [0x459b58]
mov eax, 0x5e407cd
imul esi, esi, 0x171ed6e
imul ebx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x459b3c]
imul edx, edx, 0x1a0fa8c
add edx, ecx
add edx, esi
shl edx, 1
mov eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x702fe9a3
imul ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, 0x565ef47
imul dword [0x459b3c]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
test edi, edi
mov dword [str._r_____r____], edx
jne 0x40d322
push 0x449fc8
call fcn.0042dc06
add esp, 4
jmp 0x40d3b1
mov ebx, dword [0x459b40]
mov eax, 0x540f9495
imul ebx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x186e8b3d
imul ebx
mov eax, dword [esp + 0xc]
sar edx, 0x17
add eax, edx
mov ebx, edx
mov edx, dword [0x459b38]
shr ebx, 0x1f
imul edx, edx, 0x53d33c3
add ebx, eax
mov eax, dword [0x459b50]
imul eax, eax, 0xbdb188
add ebx, edx
mov edx, dword [0x459b54]
sub ebx, eax
mov eax, 0x2742b221
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
add ebx, esi
push edi
mov dword [0x459b38], ebx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40d3aa
push 0x449fb4
call fcn.0042dc06
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x459b44]
mov esi, dword [0x459b50]
mov eax, 0x5e407cd
imul esi, esi, 0x1a0fa8c
imul ecx
mov ecx, dword [0x459b3c]
sar edx, 0x14
add esi, edx
mov edi, edx
mov eax, 0x545b9e19
imul ecx
sar edx, 0x17
mov ecx, edx
shr edi, 0x1f
shr ecx, 0x1f
add edi, esi
mov esi, dword [esp + 0x10]
add ecx, edx
lea edx, [ecx + edi*2 + 0x3409364]
mov edi, dword [str._r_____r____]
lea eax, [esp + 0x18]
push eax
sub edx, edi
push esi
mov dword [0x459b3c], edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40d180
mov edi, dword [0x459b58]
mov ecx, dword [0x459b54]
mov ebx, dword [0x459b48]
mov eax, 0x5e407cd
imul edi, edi, 0x171ed6e
imul ebx, ebx, 0x4905557
imul dword [0x459b44]
sar edx, 0x14
mov eax, edx
add edi, edx
mov edx, dword [0x459b4c]
shr eax, 0x1f
add eax, edi
mov dword [esp + 0x10], eax
mov eax, 0x702fe9a3
imul edx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
mov eax, dword [0x459b38]
imul eax, eax, 0xd0a84b
add edx, ebx
add edx, eax
mov dword [esp + 0x10], edx
mov edx, dword [0x459b40]
mov eax, 0x4eb6fa85
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
sub edx, ecx
sub edx, 0x53d33c3
push esi
mov dword [0x459b40], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d040
mov ecx, dword [0x459b4c]
mov eax, 0x545b9e19
imul ecx
mov esi, ecx
sar edx, 0x17
imul esi, esi, 0x341f518
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x459b58]
imul edx, edx, 0x171ed6e
mov ebx, dword [0x459b50]
sub esi, ecx
mov ecx, dword [0x459b44]
add esi, edx
mov eax, 0x5e407cd
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x14
imul ecx, ecx, 0x2b75400
mov eax, edx
add esi, edx
mov edx, dword [0x459b48]
imul edx, edx, 0xd0a84b
shr eax, 0x1f
add eax, esi
add ecx, ebx
add ecx, eax
lea eax, [edx + ecx - 0x53d33c3]
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
mov dword [0x459b44], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x459b44]
mov esi, eax
mov ecx, dword [0x459b58]
mov eax, 0x5e407cd
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b3c]
imul edx, edx, 0x1a0fa8c
add edx, eax
mov ebx, ecx
imul ebx, ebx, 0x171ed6e
add ebx, edx
mov eax, 0x702fe9a3
imul edi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
shl ebx, 1
sub ebx, eax
mov eax, 0x565ef47
imul dword [0x459b3c]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
test esi, esi
mov dword [str._r_____r____], ebx
je 0x40d040
mov edi, dword [0x459b50]
mov eax, 0x9d2b2fed
imul edi, edi, 0x18470b7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x58945bfd
imul ecx
imul ecx, ecx, 0x3cb4655
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
mov ecx, dword [esp + 0x944]
mov dword [0x459b48], eax
mov eax, esi
call fcn.0042cf11
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [0x459b58]
mov ebx, dword [0x459b38]
imul ebx, ebx, 0x18470b7
mov ecx, edi
imul ecx, ecx, 0x171ed6e
mov eax, 0x5e407cd
imul dword [0x459b44]
sar edx, 0x14
add ebx, ecx
add ebx, edx
mov ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x2b75400
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
mov edx, dword [0x459b54]
mov ebx, dword [0x459b48]
mov eax, 0x702fe9a3
imul edx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x5e407cd
imul ebx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x565ef47
imul ebx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
sub ecx, eax
mov dword [0x459b54], ecx
mov dword [esp + 0x14], edx
jmp 0x40d42b