Function at 0x404a80
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe78
mov eax, dword [0x457190]
mov dword [esp + 0xe74], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45582c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x455818]
lea edx, [eax + eax*8]
mov eax, dword [str._r_____r____]
imul eax, eax, 0x38
shl edx, 3
mov esi, edx
sub esi, ecx
mov ecx, dword [0x455820]
add esi, eax
mov eax, 0x66666667
imul ecx
mov eax, dword [0x455834]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
sub esi, eax
push 0
sub esi, 0x31
push 2
mov dword [0x455820], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45581c]
mov ebp, eax
mov eax, 0x51eb851f
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
sub edi, esi
mov esi, dword [0x455830]
add edi, edx
mov ecx, edx
mov edx, dword [0x455838]
imul edx, edx, 0xd
mov eax, esi
imul eax, eax, 0x35
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add ecx, eax
mov eax, dword [0x455828]
lea edx, [eax + eax*8]
xor edi, edi
shl edx, 3
mov ebx, edx
mov edx, dword [0x45582c]
mov dword [esp + 0x10], ebp
mov dword [str._r_____r____], ecx
mov dword [esp + 0xdc], 0x128
mov eax, 0x4bda12f7
imul edx
imul ecx, ecx, 0x36
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455818]
imul edx, edx, 0x35
sub ebx, eax
add edx, esi
add edx, ebx
lea eax, [ecx + edx - 0x31]
lea ecx, [esp + 0xdc]
push ecx
push ebp
mov dword [0x455824], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x404be1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe74]
call fcn.00428e41
add esp, 0xe78
ret
mov ecx, dword [0x455834]
mov esi, dword [0x455830]
mov eax, 0xc71c71c7
imul esi, esi, 0x32
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x5397829d
imul ecx
mov ecx, dword [0x455818]
sub ebx, esi
imul ecx, ecx, 0x31
sar edx, 4
mov esi, edx
shr esi, 0x1f
add ebx, edx
add esi, ebx
add esi, ecx
mov ecx, dword [0x455820]
mov eax, 0x78787879
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x455818], eax
xor eax, eax
jmp 0x404c50
mov cl, byte [esp + eax + 0x100]
mov byte [esp + eax + 0x204], cl
inc eax
test cl, cl
jne 0x404c50
mov ecx, dword [0x455838]
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45581c]
mov esi, ecx
imul edx, edx, 0x36
imul esi, esi, 0xffffffcf
sub esi, eax
add esi, edx
mov edx, dword [0x455824]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov ecx, edx
add esi, edx
mov edx, dword [esp + 0xe8c]
shr ecx, 0x1f
push edx
lea eax, [esp + 0x208]
add ecx, esi
push eax
mov dword [0x455828], ecx
call fcn.004338be
mov ecx, dword [0x455830]
add esp, 8
test eax, eax
jne 0x404d31
mov esi, dword [0x455838]
mov eax, 0x4bda12f7
imul esi
imul esi, esi, 0xd
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45581c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
add edi, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x35
shr eax, 0x1f
add eax, edi
sub eax, esi
mov esi, dword [str._r_____r____]
add eax, edx
sub eax, esi
add eax, 0x28
mov dword [0x45581c], eax
mov edi, 1
mov esi, dword [0x455834]
imul ecx, ecx, 0x32
mov eax, 0xc71c71c7
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x5397829d
imul esi
sub ebx, ecx
mov ecx, dword [0x455818]
imul ecx, ecx, 0x31
sar edx, 4
mov esi, edx
add ebx, edx
shr esi, 0x1f
add esi, ebx
add esi, ecx
mov ecx, dword [0x455820]
mov eax, 0x78787879
imul ecx
sar edx, 4
mov eax, edx
lea ecx, [esp + 0xdc]
shr eax, 0x1f
add esi, edx
push ecx
add eax, esi
push ebp
mov dword [0x455818], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x404eb4
mov eax, edi
shl eax, 6
lea edx, [esp + 0x100]
lea esi, [esp + eax + 0x204]
sub eax, edx
lea ebx, [esp + eax + 0x204]
lea ecx, [ecx]
lea eax, [esp + 0x100]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x404dc7
mov ecx, dword [0x455838]
mov eax, 0x4bda12f7
imul ecx
imul ecx, ecx, 0xd
sar edx, 4
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x45581c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [str._r_____r____]
add eax, ebp
sub eax, ecx
mov ecx, dword [0x455830]
imul ecx, ecx, 0x35
add eax, ecx
sub eax, edx
mov edx, dword [esp + 0xe8c]
push edx
add eax, 0x28
push esi
mov dword [0x45581c], eax
call fcn.004338be
add esp, 8
test eax, eax
jne 0x404e9a
mov ecx, dword [0x45581c]
mov ebp, dword [0x455830]
mov eax, 0x38e38e39
imul ebp, ebp, 0x22
imul ecx
mov ecx, dword [0x45582c]
sar edx, 4
imul ecx, ecx, 0x31
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov ecx, dword [0x455820]
mov eax, 0x92492493
imul ecx
add edx, ecx
imul ecx, ecx, 0x32
sar edx, 5
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
add eax, ecx
mov ecx, dword [esp + 0xe4]
mov dword [esp + edi*4 + 0x14], ecx
inc edi
add esi, 0x40
mov dword [0x45582c], eax
add ebx, 0x40
mov ebp, dword [esp + 0x10]
lea edx, [esp + 0xdc]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404dc0
mov ecx, dword [0x45581c]
mov esi, dword [0x455828]
mov eax, 0x66666667
imul esi, esi, 0x22
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
imul ecx, ecx, 0x1b
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45582c]
imul edx, edx, 0x31
sub esi, eax
add esi, ecx
sub esi, edx
push ebp
mov dword [0x455830], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe84]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.00428e41
add esp, 0xe78
ret