Function at 0x404d90
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe7c
mov eax, dword [0x458190]
mov dword [esp + 0xe78], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45682c]
mov eax, 0x61e35267
imul ecx
mov ecx, dword [str._r_____r____]
imul ecx, ecx, 0x14ec
mov esi, dword [0x456818]
imul esi, esi, 0x1ec0
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov ebx, dword [0x456834]
add esi, ecx
mov ecx, dword [0x456820]
mov eax, 0x776d83ad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ebx
push 0
sub esi, 0x11cf
push 2
mov dword [0x456820], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x456824]
mov ebp, eax
mov eax, 0xbdd265f5
imul esi
add edx, esi
sar edx, 0xc
mov ecx, edx
mov ebx, dword [0x456830]
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45681c]
mov eax, 0x5f7fac71
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, ebx
imul edx, edx, 0x1525
add ecx, edx
mov eax, 0x61e35267
imul esi
mov esi, dword [0x456828]
sar edx, 0xb
imul esi, esi, 0x1ec0
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456838]
imul edx, edx, 0x58f
sub ecx, eax
add ecx, edx
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x1594
add esi, ecx
mov ecx, dword [0x45682c]
mov eax, 0xc152500d
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
xor edi, edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0xe0], 0x128
add eax, edx
mov ecx, dword [0x456818]
imul ecx, ecx, 0x1525
sub esi, eax
lea eax, [esp + 0xe0]
add esi, ebx
push eax
lea edx, [ecx + esi - 0x11cf]
push ebp
mov dword [0x456824], edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x404f01
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe78]
call fcn.0042a321
add esp, 0xe7c
ret
mov ecx, dword [0x456834]
mov esi, dword [0x456830]
mov eax, 0x214d0215
imul esi, esi, 0xffffea8e
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xe6005641
imul ecx
add edx, ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0x11cf
sar edx, 0xc
mov ebx, edx
shr ebx, 0x1f
add esi, edx
add ebx, esi
add ebx, ecx
mov ecx, dword [0x456820]
mov eax, 0x4f950fb3
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x456818], eax
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x104]
mov byte [esp + eax + 0x208], cl
inc eax
test cl, cl
jne 0x404f70
mov ecx, dword [0x456824]
mov eax, 0xbdd265f5
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x456838]
mov eax, 0x9f248ed3
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45681c]
mov ebx, eax
imul edx, edx, 0x1530
mov eax, ecx
imul eax, eax, 0x11cf
sub ebx, esi
add ebx, edx
sub ebx, eax
mov eax, 0xb838211b
imul ecx
add edx, ecx
sar edx, 0xa
mov ecx, edx
add ebx, edx
mov edx, dword [esp + 0xe90]
shr ecx, 0x1f
push edx
lea eax, [esp + 0x20c]
add ecx, ebx
push eax
mov dword [0x456828], ecx
call fcn.00434d9e
mov ecx, dword [0x456830]
add esp, 8
test eax, eax
jne 0x405069
mov esi, dword [0x456838]
mov edi, dword [0x45681c]
mov eax, 0xbdd265f5
imul esi
add edx, esi
imul esi, esi, 0x58f
sar edx, 0xc
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0xc152500d
imul edi
add edx, edi
sar edx, 0xc
add ebx, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x1525
shr eax, 0x1f
add eax, ebx
add eax, edx
sub eax, esi
sub eax, dword [str._r_____r____]
add eax, 0x1126
mov dword [0x45681c], eax
mov edi, 1
mov esi, dword [0x456834]
imul ecx, ecx, 0xffffea8e
mov eax, 0x214d0215
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xe6005641
imul esi
add edx, esi
sar edx, 0xc
add ecx, edx
mov esi, edx
shr esi, 0x1f
add esi, ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0x11cf
add esi, ecx
mov ecx, dword [0x456820]
mov eax, 0x4f950fb3
imul ecx
sar edx, 0xa
mov eax, edx
lea ecx, [esp + 0xe0]
shr eax, 0x1f
add esi, edx
push ecx
add eax, esi
push ebp
mov dword [0x456818], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405221
mov eax, edi
shl eax, 6
lea edx, [esp + 0x104]
lea ebx, [esp + eax + 0x208]
sub eax, edx
lea edx, [esp + eax + 0x208]
mov dword [esp + 0x10], edx
jmp 0x405110
mov edx, dword [esp + 0x10]
jmp 0x405110
lea eax, [esp + 0x104]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x405117
mov ecx, dword [0x456838]
mov esi, dword [0x45681c]
mov eax, 0xbdd265f5
imul ecx
add edx, ecx
imul ecx, ecx, 0x58f
sar edx, 0xc
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0xc152500d
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
add ebp, edx
mov edx, dword [0x456830]
imul edx, edx, 0x1525
shr eax, 0x1f
add eax, ebp
add eax, edx
mov edx, dword [str._r_____r____]
sub eax, ecx
sub eax, edx
add eax, 0x1126
mov dword [0x45681c], eax
mov eax, dword [esp + 0xe90]
push eax
push ebx
call fcn.00434d9e
add esp, 8
test eax, eax
jne 0x405207
mov ecx, dword [0x45681c]
mov eax, 0x214d0215
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [0x456820]
mov esi, ecx
imul esi, esi, 0x1572
sub esi, edx
mov eax, 0x61e35267
imul ecx
mov ecx, dword [0x45682c]
sar edx, 0xb
imul ecx, ecx, 0x11cf
add esi, edx
mov eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0xcde
shr eax, 0x1f
add eax, esi
add eax, ecx
add eax, edx
mov dword [0x45682c], eax
mov eax, dword [esp + 0xe8]
mov dword [esp + edi*4 + 0x18], eax
mov eax, dword [esp + 0x10]
inc edi
add ebx, 0x40
add eax, 0x40
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0xe0]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405101
mov ecx, dword [0x45681c]
mov esi, dword [0x45682c]
mov eax, 0x88927c53
imul esi, esi, 0x11cf
imul ecx
mov ecx, dword [0x456828]
sar edx, 0xb
imul ecx, ecx, 0xcde
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456824]
imul edx, edx, 0xb97
sub eax, esi
add eax, ecx
add eax, edx
push ebp
mov dword [0x456830], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe88]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.0042a321
add esp, 0xe7c
ret