Function at 0x40b810
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x458190]
mov ecx, dword [0x45681c]
mov dword [esp + 0x938], eax
mov eax, 0x49f9945f
imul ecx
mov ecx, dword [0x456824]
push ebx
push esi
mov esi, dword [0x456838]
sar edx, 0xe
imul esi, esi, 0xe0dd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x302debc5
imul ecx
push edi
sar edx, 0xe
mov edi, edx
add esi, edx
mov edx, dword [0x456830]
imul edx, edx, 0xa8da
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [str._r_____r____], edi
mov byte [esp + 0x140], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
push ecx
stosw word es:[edi], ax
lea edx, [esp + 0x144]
push 0x446fbc
push edx
stosb byte es:[edi], al
call fcn.0042a311
mov edi, dword [0x456834]
mov esi, dword [0x456830]
mov eax, 0x2ff8513b
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
imul ecx, ecx, 0xdd7b
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x456818]
mov eax, 0x47298a5
imul ecx, ecx, 0x1558c
imul edi
sar edx, 8
mov eax, edx
add ebx, ecx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x395bd985
imul dword [0x456820]
sar edx, 0xd
mov ecx, edx
add ebx, edx
mov edx, dword [0x45681c]
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [0x456838]
add esp, 0xc
imul ebx, ebx, 0xe0dd
mov dword [0x456818], ecx
mov eax, 0x99b19d5b
imul esi, esi, 0xa8da
imul ecx, ecx, 0x398f
imul edx
add edx, dword [0x45681c]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov ebx, eax
mov eax, 0x302debc5
imul dword [0x456838]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
mov esi, dword [str._r_____r____]
sub eax, esi
imul esi, esi, 0x107f4
add eax, 0xaaa7
mov dword [0x45681c], eax
mov eax, 0x18008403
imul dword [0x456820]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub ecx, eax
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
sub ecx, edi
push 0
sub ecx, 0x1558c
push 2
mov dword [esp + 0x1c], 0
mov dword [0x456820], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40ba64
mov ecx, dword [0x45682c]
mov eax, 0x99b19d5b
imul ecx
mov eax, dword [0x456828]
add edx, ecx
imul eax, eax, 0x398f
sar edx, 0xf
mov edi, dword [0x456830]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x15410
sub edx, ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0xa8da
add eax, edi
add eax, edx
lea edx, [ecx + eax - 0x1558c]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x456824], edx
call fcn.0042ae36
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042a141
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x456838]
mov eax, 0x246e57b5
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, dword [0x45681c]
mov edx, ecx
imul eax, eax, 0xd534
imul edx, edx, 0x1558c
sub esi, edx
mov edx, dword [0x456824]
add esi, eax
mov eax, 0x302debc5
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61082f49
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x18]
push edx
sub esi, ecx
push ebx
mov dword [0x456828], esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40bb53
mov ecx, dword [0x456820]
mov eax, dword [0x45682c]
mov edx, dword [0x45681c]
imul eax, eax, 0x1558c
mov esi, ecx
imul esi, esi, 0xdd7b
add esi, eax
mov eax, 0x47298a5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub esi, eax
add esi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
push ebx
mov dword [0x45682c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042a141
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45682c]
mov esi, dword [0x456824]
imul ecx, ecx, 0x1558c
imul esi, esi, 0xffffc9ca
sub esi, ecx
mov ecx, dword [0x45681c]
mov eax, 0x18008403
imul ecx
mov ecx, dword [0x456828]
sar edx, 0xc
imul ecx, ecx, 0x8ed2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
add esi, ecx
push eax
mov dword [0x456830], esi
call fcn.00434bbe
add esp, 8
test eax, eax
je 0x40bf4b
mov ecx, dword [0x45682c]
mov esi, dword [0x456834]
mov eax, 0x99b19d5b
imul esi, esi, 0x1558c
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456820]
imul edx, edx, 0xab36
mov edi, ecx
mov ecx, dword [str._r_____r____]
sub edi, esi
sub edi, edx
mov eax, 0x395bd985
imul ecx
mov ecx, dword [esp + 0x20]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
push ecx
add eax, edx
push 0
sub edi, eax
push 0x1f0fff
mov dword [0x456838], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [0x456838]
mov ecx, dword [0x45681c]
imul eax, eax, 0xe0dd
mov dword [esp + 0x10], eax
mov edi, dword [0x456824]
mov eax, 0x49f9945f
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x302debc5
imul edi
sar edx, 0xe
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x456830]
mov edx, ecx
imul edx, edx, 0xa8da
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x3e12562b
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
test esi, esi
mov dword [str._r_____r____], edx
jne 0x40bcad
push 0x446f88
call fcn.0042ae36
add esp, 4
jmp 0x40bd35
mov edi, dword [0x456834]
imul ecx, ecx, 0xdd7b
mov eax, 0x2ff8513b
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0x1558c
add eax, ecx
mov ecx, eax
mov eax, 0x47298a5
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [0x456820]
mov eax, 0x395bd985
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
push esi
mov dword [0x456818], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40bd2e
push 0x446f74
call fcn.0042ae36
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x302debc5
imul esi
mov edi, esi
imul edi, edi, 0xe0dd
sar edx, 0xe
sub ecx, edi
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0xa8da
add eax, ecx
mov ecx, dword [str._r_____r____]
lea edx, [esp + 0x18]
sub eax, ecx
push edx
add eax, 0xaaa7
push ebx
mov dword [0x45681c], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40bb53
mov ecx, dword [0x456818]
mov esi, dword [0x456834]
mov edi, dword [esp + 0x14]
mov edx, dword [0x456820]
imul ecx, ecx, 0x398f
mov eax, 0x18008403
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub ecx, eax
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x107f4
sub ecx, eax
add ecx, edx
sub ecx, esi
sub ecx, 0x1558c
push ebx
mov dword [0x456820], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40ba4f
mov ecx, dword [0x45682c]
mov eax, 0x99b19d5b
imul ecx
mov ebx, dword [0x456830]
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xf
imul ecx, ecx, 0x15410
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
sub ecx, eax
imul edx, edx, 0x398f
mov eax, dword [0x456818]
imul eax, eax, 0xa8da
add edx, ebx
add edx, ecx
lea ecx, [eax + edx - 0x1558c]
mov edx, dword [esp + 0x20]
push edx
push 0
push 0x1f0fff
mov dword [0x456824], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, 0x302debc5
imul dword [0x456824]
mov edi, dword [0x456838]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x49f9945f
imul dword [0x45681c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
mov ebx, edi
imul edx, edx, 0xa8da
imul ebx, ebx, 0xe0dd
sub ebx, eax
add ebx, edx
mov eax, 0x3e12562b
imul dword [0x456824]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
test esi, esi
mov dword [str._r_____r____], ebx
je 0x40ba4f
mov eax, 0x246e57b5
imul edi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [0x45681c]
imul eax, eax, 0xd534
mov edx, edi
imul edx, edx, 0x1558c
sub ebx, edx
add ebx, eax
mov eax, 0x61082f49
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, ecx
mov ecx, dword [esp + 0x944]
mov dword [0x456828], ebx
mov eax, esi
call fcn.0042a141
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [0x456828]
mov ecx, dword [0x456818]
mov eax, 0x49f9945f
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, ecx
imul esi, esi, 0xd534
sub esi, eax
mov edx, edi
imul edx, edx, 0x15410
add esi, edx
mov eax, 0x302debc5
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456834]
mov edi, dword [esp + 0x20]
sub esi, eax
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x456834], esi
jmp 0x40bdb6