Function at 0x40f930
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x45e640]
xor eax, esp
push ebx
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45cccc]
mov edi, eax
mov esi, dword [0x45ccd4]
mov eax, 0x4227fdad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xbb03c5cb
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x44fc3a35
imul ecx
imul ecx, ecx, 0x1865
sar edx, 0xb
sub ebp, ebx
mov ebx, edx
add ebp, edx
mov eax, 0x5c9900d1
imul esi
mov eax, dword [0x45cce8]
shr ebx, 0x1f
imul eax, eax, 0xa74
sar edx, 0xb
add ebx, ebp
add ebx, ecx
mov ecx, edx
add ebx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x1545
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
add ecx, eax
mov dword [str._r_____r____], ecx
lea ecx, [esp + 0xa4]
push ecx
push edi
mov dword [esp + 0x28], edi
mov dword [esp + 0xac], 0x128
mov dword [esp + 0x24], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40fa07
or eax, 0xffffffff
jmp 0x40fe91
mov ecx, dword [0x45ccd4]
mov ebp, dword [0x45cce0]
mov eax, 0x5c9900d1
imul ecx
mov esi, ebp
imul esi, esi, 0x1865
sar edx, 0xb
add esi, edx
mov edi, edx
mov eax, 0xc09370e3
imul ecx
mov eax, dword [0x45cce8]
add edx, ecx
imul eax, eax, 0xa74
mov ecx, dword [0x45cccc]
sar edx, 0xc
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov edx, dword [0x45cce4]
imul edx, edx, 0x1259
shr esi, 0x1f
add esi, edi
add esi, edx
sub esi, eax
mov eax, 0x6614bc37
imul ecx
mov eax, dword [str._r_____r____]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, eax
add ecx, 0xae6
mov dword [0x45cccc], ecx
xor esi, esi
lea esp, [esp]
mov dl, byte [esp + esi + 0xc8]
mov byte [esp + esi + 0x1cc], dl
inc esi
test dl, dl
jne 0x40fa90
mov edx, dword [0x45ccd8]
mov esi, dword [0x45ccdc]
lea ebx, [edx + eax]
mov edi, eax
imul ebx, ebx, 0x1545
mov eax, esi
imul edi, edi, 0x161e
imul eax, eax, 0x1865
add ebx, eax
mov eax, 0x5c9900d1
imul esi
sar edx, 0xb
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x6614bc37
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0x9d4]
add ebx, edi
lea edx, [ebx + ebp - 0x1259]
mov dword [esp + 0x14], eax
mov dword [0x45ccd4], edx
lea eax, [esp + 0x1cc]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x40fb43
test dl, dl
je 0x40fb3f
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x40fb43
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x40fb13
xor eax, eax
jmp 0x40fb48
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fbc3
mov eax, dword [0x45ccd0]
imul esi, esi, 0x1259
imul ebp, ebp, 0xade
lea ebx, [eax + ecx]
imul ebx, ebx, 0x1ef5
mov eax, 0x44fc3a35
imul dword [0x45cce4]
sar edx, 0xb
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, 0x5c9900d1
imul dword [0x45cce4]
mov eax, dword [esp + 0x18]
sar edx, 0xb
mov ebx, edx
add eax, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0xc09370e3
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
add ebx, esi
add ebx, ebp
mov dword [0x45ccdc], ebx
mov dword [esp + 0x1c], 1
mov edx, dword [0x45ccc8]
mov eax, dword [0x45ccd4]
mov ecx, dword [0x45ccd8]
lea esi, [edx + eax]
mov eax, 0x4227fdad
imul esi, esi, 0xa08
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x44fc3a35
imul dword [0x45cce4]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5c9900d1
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x5df55b35
imul dword [str._r_____r____]
sar edx, 0xa
mov eax, edx
sub esi, ecx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0xa4]
add esi, edi
push ecx
add eax, esi
push edx
mov dword [0x45cce4], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40fe01
mov eax, dword [esp + 0x1c]
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea esi, [esp + eax + 0x1cc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], esi
jmp 0x40fc80
mov esi, dword [esp + 0x18]
mov edi, edi
mov edi, dword [0x45ccd0]
mov ebx, dword [0x45cce4]
mov eax, 0x53f407b5
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xc09370e3
imul ebx
add edx, ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
sub ecx, eax
imul edx, edx, 0x1481
mov eax, dword [0x45ccc8]
imul eax, eax, 0x1259
sub ecx, edx
add ecx, eax
mov eax, 0x6f9f33f1
imul edi
sar edx, 0xb
add ecx, edx
mov ebp, edx
mov eax, 0x2f1d432d
imul edi
shr ebp, 0x1f
add ebp, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov dword [0x45ccc8], ecx
lea eax, [esp + 0xc8]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40fd02
mov ebp, dword [esp + 0x9d4]
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40fd3c
test al, al
je 0x40fd38
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40fd3c
add esi, 2
add ebp, 2
test al, al
jne 0x40fd17
xor eax, eax
jmp 0x40fd41
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fde7
mov edx, dword [0x45ccdc]
imul ecx, ecx, 0x1545
mov esi, dword [0x45ccd8]
mov eax, 0x44fc3a35
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, esi
imul ebp, ebp, 0x1db0
sub ebp, eax
mov eax, 0x6f9f33f1
imul esi
add ebp, ecx
sar edx, 0xb
add ebp, edx
mov ecx, edx
mov eax, 0x5df55b35
imul edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0xa74
shr ecx, 0x1f
add ecx, ebp
sub ecx, eax
mov eax, dword [esp + 0x1c]
add ecx, edx
mov edx, dword [esp + 0x14]
sub ecx, ebx
sub ecx, 0x1259
mov dword [0x45ccd0], ecx
mov ecx, dword [esp + 0xac]
mov dword [esp + eax*4 + 0x24], ecx
mov ecx, dword [esp + 0x18]
inc eax
mov dword [esp + 0x1c], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
lea edx, [esp + 0xa4]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40fc7a
mov ecx, dword [0x45cce8]
mov esi, dword [0x45ccc8]
mov eax, 0x53f407b5
imul esi, esi, 0x161e
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd4]
sub esi, eax
mov eax, 0x5c9900d1
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x1259
sub esi, eax
sub esi, edx
mov eax, 0x61f60d03
imul ecx
mov ecx, dword [0x45cce0]
sar edx, 0xa
mov edi, edx
add esi, edx
mov eax, 0x6614bc37
imul ecx
imul ecx, ecx, 0xa08
shr edi, 0x1f
sar edx, 0xa
add edi, esi
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, ecx
mov ecx, dword [esp + 0x20]
push ecx
mov dword [0x45ccd8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x9cc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042fe7d
add esp, 0x9c0
ret