Function at 0x40f520
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x45e540]
xor eax, esp
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9cc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45cbcc]
mov edi, eax
mov eax, 0x5fa6246b
imul ecx
mov ebx, ecx
mov esi, dword [0x45cbd4]
imul ebx, ebx, 0xdc65
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe8]
sub ebx, eax
imul edx, edx, 0xd60e
mov eax, dword [0x45cbdc]
imul eax, eax, 0x100de
add ebx, edx
add ebx, eax
mov eax, 0x2aa871e5
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
mov ecx, edx
add ebx, edx
mov eax, 0x1006124d
imul esi
shr ecx, 0x1f
sar edx, 0xc
add ecx, ebx
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
lea ecx, [esp + 0x9c]
push ecx
push edi
mov dword [esp + 0x20], edi
mov dword [esp + 0xa4], 0x128
mov dword [str._r_____r____], eax
mov dword [esp + 0x1c], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40f606
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b8]
xor ecx, esp
call fcn.0042fa4d
add esp, 0x9bc
ret
mov edx, dword [0x45cbe8]
mov eax, dword [0x45cbe4]
imul edx, edx, 0xd60e
mov ecx, dword [0x45cbcc]
imul eax, eax, 0xa88a
push ebp
mov ebp, dword [0x45cbe0]
mov esi, ebp
imul esi, esi, 0xdc65
sub esi, edx
add esi, eax
mov eax, 0x3e77639f
imul ecx
mov ecx, dword [0x45cbd4]
sar edx, 0xe
add esi, edx
mov edi, edx
mov eax, 0x7f915fef
imul ecx
shr edi, 0x1f
add edi, esi
sar edx, 0xf
add edi, edx
mov esi, edx
mov eax, 0x1006124d
imul ecx
mov eax, dword [str._r_____r____]
shr esi, 0x1f
sar edx, 0xc
add esi, edi
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, eax
add ecx, 0xa8e3
mov dword [0x45cbcc], ecx
xor esi, esi
lea ebx, [ebx]
mov dl, byte [esp + esi + 0xc4]
mov byte [esp + esi + 0x1c8], dl
inc esi
test dl, dl
jne 0x40f690
mov edx, dword [0x45cbd8]
mov esi, dword [0x45cbdc]
lea ebx, [edx + eax]
mov edi, eax
imul ebx, ebx, 0x100de
mov eax, esi
imul edi, edi, 0xff9f
imul eax, eax, 0xdc65
add ebx, eax
mov eax, 0x3e77639f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1006124d
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, edi
add eax, ebx
lea edx, [eax + ebp - 0xa88a]
mov eax, dword [esp + 0x9d0]
mov dword [esp + 0x14], eax
mov dword [0x45cbd4], edx
lea eax, [esp + 0x1c8]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x40f741
test dl, dl
je 0x40f73d
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x40f741
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x40f711
xor eax, eax
jmp 0x40f746
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f7b3
mov eax, dword [0x45cbd0]
imul esi, esi, 0xa88a
imul ebp, ebp, 0x15433
lea ebx, [eax + ecx]
mov eax, 0x7f915fef
imul ebx, ebx, 0x15696
imul ecx
sar edx, 0xf
mov ecx, edx
add ebx, ebp
add ebx, esi
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45cbe4]
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
add ebx, edx
mov esi, edx
mov eax, 0x1006124d
imul ecx
shr esi, 0x1f
sar edx, 0xc
add esi, ebx
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x45cbdc], eax
mov ebx, 1
jmp 0x40f7bd
mov ecx, dword [0x45cbe4]
mov ebx, dword [esp + 0x18]
mov edx, dword [0x45cbc8]
mov eax, dword [0x45cbd4]
mov esi, dword [0x45cbd8]
lea ebp, [edx + eax]
mov eax, 0x5fa6246b
imul ebp, ebp, 0x10649
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x1840c0e3
imul dword [str._r_____r____]
sar edx, 0xc
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x1006124d
imul esi
sar edx, 0xc
mov eax, edx
sub ebp, ecx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xa0]
sub ebp, eax
push ecx
add ebp, edi
push edx
mov dword [0x45cbe4], ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40f9fd
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea edi, [esp + eax + 0x1c8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
jmp 0x40f880
mov edi, dword [esp + 0x18]
jmp 0x40f880
mov esi, dword [0x45cbd0]
mov eax, 0x94adc77f
imul esi
add edx, esi
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x6051edb
imul esi
sar edx, 0xb
add ecx, edx
mov ebp, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0xa88a
shr ebp, 0x1f
add ebp, ecx
add ebp, edx
mov eax, 0xc26c7c39
imul esi
add edx, esi
sar edx, 0xf
add ebp, edx
mov ecx, edx
mov eax, 0x7f915fef
imul dword [0x45cbe4]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x8088
shr ecx, 0x1f
add ecx, ebp
sub ecx, eax
sub ecx, edx
mov dword [0x45cbc8], ecx
lea eax, [esp + 0xc4]
mov dl, byte [eax]
mov byte [edi + eax], dl
inc eax
test dl, dl
jne 0x40f901
mov ebp, dword [esp + 0x9d0]
mov edi, dword [esp + 0x14]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40f93b
test al, al
je 0x40f937
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40f93b
add edi, 2
add ebp, 2
test al, al
jne 0x40f916
xor eax, eax
jmp 0x40f940
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f9e3
mov edi, dword [0x45cbe8]
imul ecx, ecx, 0x100de
mov eax, 0x1840c0e3
imul edi, edi, 0xd60e
imul esi
mov esi, dword [0x45cbd8]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xc26c7c39
imul esi
add edx, esi
imul esi, esi, 0x18014
sar edx, 0xf
mov ebp, edx
shr ebp, 0x1f
add edi, edx
add ebp, edi
add ebp, ecx
mov ecx, dword [0x45cbdc]
mov eax, 0x2aa871e5
imul ecx
mov eax, dword [0x45cbe4]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0xa8]
add ebp, esi
sub ebp, ecx
mov ecx, dword [esp + 0x18]
sub ebp, eax
mov dword [esp + ebx*4 + 0x20], edx
mov edx, dword [esp + 0x14]
sub ebp, 0xa88a
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [0x45cbd0], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xa0]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40f871
mov ecx, dword [0x45cbe8]
mov eax, 0x94adc77f
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x264545a3
imul ecx
imul ecx, ecx, 0xa88a
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
sub edi, ecx
mov ecx, dword [0x45cbe0]
mov eax, 0x3e77639f
imul ecx
imul ecx, ecx, 0x10649
sar edx, 0xe
mov esi, edx
shr esi, 0x1f
add edi, edx
add esi, edi
add esi, ecx
mov ecx, dword [0x45cbc8]
imul ecx, ecx, 0xff9f
add esi, ecx
mov ecx, dword [0x45cbd4]
mov eax, 0x1006124d
imul ecx
mov ecx, dword [esp + 0x1c]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push ecx
mov dword [0x45cbd8], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0042fa4d
add esp, 0x9bc
ret