Function at 0x405820
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe7c
mov eax, dword [0x45d320]
mov dword [esp + 0xe78], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45b9bc]
mov eax, 0x92ea28a3
imul ecx
add edx, ecx
mov ecx, dword [0x45b9c8]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, dword [str._r_____r____]
mov edx, ecx
imul esi, esi, 0x6f854
imul edx, edx, 0x6f3fe
sub esi, eax
add esi, edx
mov edx, dword [0x45b9b0]
mov eax, 0x10779897
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x6352a551
imul ecx
sar edx, 0x12
add esi, edx
mov ecx, edx
mov edx, dword [0x45b9a8]
imul edx, edx, 0xc0c12
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45b9c4]
add ecx, edx
sub ecx, esi
push 0
sub ecx, 0x53d95
push 2
mov dword [0x45b9b0], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45b9b4]
mov esi, dword [0x45b9c8]
mov dword [esp + 0x14], eax
mov edi, dword [0x45b9ac]
mov eax, 0x92ea28a3
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
mov ebx, esi
imul ebx, ebx, 0xde7fc
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x6352a551
imul edi
sar edx, 0x12
mov ebp, edx
add ebx, edx
mov eax, 0x6352a551
imul ecx
sar edx, 0x12
shr ebp, 0x1f
mov ecx, edx
add ebp, ebx
add ebp, edx
shr ecx, 0x1f
add ecx, ebp
mov ebp, dword [0x45b9c0]
mov edx, ebp
imul edx, edx, 0x6a5ba
add ecx, edx
mov eax, 0x9dbc161
imul edi
sar edx, 0xe
mov edi, dword [0x45b9bc]
imul esi, esi, 0x6f3fe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x93a3ffdd
imul edi
add edx, edi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45b9c4]
sub esi, eax
mov eax, 0x6352a551
imul edx
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0xa4f50
sar edx, 0x12
mov eax, edx
add esi, edx
mov edx, dword [0x45b9b8]
shr eax, 0x1f
imul edx, edx, 0xc0c12
add eax, esi
add eax, ecx
mov ecx, dword [0x45b9a8]
imul ecx, ecx, 0x6a5ba
add ecx, ebp
add ecx, eax
lea eax, [edx + ecx - 0x53d95]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xe0]
push ecx
push edx
mov dword [esp + 0xe8], 0x128
xor ebx, ebx
mov dword [0x45b9b4], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4059ed
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe78]
call fcn.0042ec21
add esp, 0xe7c
ret
mov ecx, dword [0x45b9b0]
mov esi, dword [0x45b9c8]
mov eax, 0xf5f5c9f5
imul ecx
add edx, ecx
mov ecx, dword [0x45b9a8]
mov edi, esi
imul edi, edi, 0x6f3fe
sar edx, 0x13
add edi, edx
mov ebp, edx
mov eax, 0x6352a551
imul ecx
imul ecx, ecx, 0x53d95
shr ebp, 0x1f
add ebp, edi
mov edi, dword [0x45b9c4]
sar edx, 0x12
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov dword [esp + 0x10], eax
mov eax, 0x61b317a1
imul edi
mov eax, dword [esp + 0x10]
sar edx, 0x11
add eax, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0x2a7feb
imul edi
mov edi, dword [0x45b9c0]
add ebp, ecx
mov ecx, edi
sar edx, 9
imul ecx, ecx, 0x67dee
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
sub ebp, ecx
mov dword [0x45b9a8], ebp
xor eax, eax
jmp 0x405a90
mov cl, byte [esp + eax + 0x104]
mov byte [esp + eax + 0x208], cl
inc eax
test cl, cl
jne 0x405a90
mov eax, 0x24d17191
imul esi
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45b9ac]
imul edx, edx, 0x6ef8e
add ecx, edx
mov eax, 0x6352a551
imul edi
sar edx, 0x12
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x45b9b4]
mov eax, 0x6352a551
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x2682f007
imul esi
mov ecx, esi
imul ecx, ecx, 0x1b669
sar edx, 0x10
mov eax, edx
add edi, ecx
mov ecx, dword [esp + 0xe90]
shr eax, 0x1f
add eax, edx
push ecx
lea edx, [esp + 0x20c]
sub edi, eax
push edx
mov dword [0x45b9b8], edi
call fcn.0043969e
mov ecx, dword [0x45b9c8]
mov esi, dword [0x45b9c0]
add esp, 8
test eax, eax
jne 0x405b99
mov edi, dword [0x45b9ac]
mov eax, 0x93a3ffdd
imul edi
add edx, edi
sar edx, 0x12
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x6352a551
imul ecx
sar edx, 0x12
mov ebx, edx
add edi, edx
shr ebx, 0x1f
add ebx, edi
mov edi, dword [str._r_____r____]
mov eax, 0x6352a551
imul edi
sar edx, 0x12
add ebx, edx
mov eax, edx
mov edx, esi
imul edx, edx, 0x6a5ba
shr eax, 0x1f
add eax, ebx
add eax, edx
sub eax, edi
add eax, 0x3e2f3
mov dword [0x45b9ac], eax
mov ebx, 1
mov edi, dword [0x45b9b0]
imul ecx, ecx, 0x6f3fe
imul esi, esi, 0x67dee
mov eax, 0xf5f5c9f5
imul edi
add edx, edi
sar edx, 0x13
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x45b9a8]
mov eax, 0x6352a551
imul ecx
imul ecx, ecx, 0x53d95
sar edx, 0x12
mov ebp, edx
add edi, edx
shr ebp, 0x1f
add ebp, edi
mov edi, dword [0x45b9c4]
mov eax, 0x61b317a1
imul edi
sar edx, 0x11
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
add eax, ecx
mov ebp, eax
mov eax, 0x2a7feb
imul edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
sub ebp, esi
lea ecx, [esp + 0xe0]
mov dword [0x45b9a8], ebp
mov ebp, dword [esp + 0x14]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405d91
mov eax, ebx
shl eax, 6
lea edx, [esp + 0x104]
lea esi, [esp + eax + 0x208]
sub eax, edx
lea edi, [esp + eax + 0x208]
lea ecx, [ecx]
lea eax, [esp + 0x104]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x405c57
mov ecx, dword [0x45b9ac]
mov eax, 0x93a3ffdd
imul ecx
add edx, ecx
mov ecx, dword [0x45b9c8]
sar edx, 0x12
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x6352a551
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov ebp, eax
mov eax, 0x6352a551
imul ecx
sar edx, 0x12
mov eax, edx
add ebp, edx
mov edx, dword [0x45b9c0]
imul edx, edx, 0x6a5ba
shr eax, 0x1f
add eax, ebp
add eax, edx
sub eax, ecx
add eax, 0x3e2f3
mov dword [0x45b9ac], eax
mov eax, dword [esp + 0xe90]
push eax
push esi
call fcn.0043969e
add esp, 8
test eax, eax
jne 0x405d77
mov ecx, dword [0x45b9b0]
mov eax, 0x92ea28a3
imul ecx
mov eax, dword [0x45b9c0]
add edx, ecx
imul eax, eax, 0x85399
imul ecx, ecx, 0x67dee
sar edx, 0x12
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x45b9c8]
imul edx, edx, 0x6f3fe
add ebp, edx
mov edx, dword [0x45b9b8]
add ebp, eax
mov eax, 0x6352a551
imul edx
sar edx, 0x12
add ebp, edx
mov eax, edx
mov edx, dword [0x45b9bc]
imul edx, edx, 0x53d95
shr eax, 0x1f
add eax, ebp
add eax, edx
mov edx, dword [0x45b9ac]
mov ebp, eax
mov eax, 0x2a7feb
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov ecx, dword [esp + 0xe8]
mov dword [esp + ebx*4 + 0x18], ecx
inc ebx
add esi, 0x40
mov dword [0x45b9bc], ebp
add edi, 0x40
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0xe0]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405c50
mov ecx, dword [0x45b9ac]
mov esi, dword [0x45b9c8]
mov eax, 0x10779897
imul esi, esi, 0x6f3fe
imul ecx
mov ecx, dword [0x45b9b8]
imul ecx, ecx, 0x85399
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x45b9bc]
mov eax, 0x6352a551
imul ecx
imul ecx, ecx, 0x53d95
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
mov ecx, dword [0x45b9b4]
imul ecx, ecx, 0x3110b
sub eax, ecx
push ebp
mov dword [0x45b9c0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe88]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
call fcn.0042ec21
add esp, 0xe7c
ret