Function at 0x40e5e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x45e640]
mov dword [esp + 0x938], eax
mov ecx, dword [0x45cccc]
push ebx
push esi
mov esi, dword [0x45ccd4]
mov eax, 0x4f576647
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
mov edi, eax
mov eax, 0x4f576647
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x242
mov ebx, eax
sub ebx, edi
add ebx, edx
mov eax, 0x38e38e39
imul esi
mov eax, dword [0x45cce8]
sar edx, 7
imul eax, eax, 0x21e
mov esi, edx
add ebx, edx
mov edx, ecx
imul edx, edx, 0x203
shr esi, 0x1f
add esi, ebx
add esi, eax
add esi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov byte [esp + 0x140], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
push ecx
stosw word es:[edi], ax
lea edx, [esp + 0x144]
push 0x44cffc
push edx
mov dword [str._r_____r____], esi
stosb byte es:[edi], al
call fcn.0042fcd1
mov esi, dword [0x45ccd0]
mov eax, 0x71625345
imul dword [0x45cce4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xd8a5df
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x7f411e53
imul esi
add esp, 0xc
sub edi, ecx
sar edx, 8
mov ebx, edx
add edi, edx
mov eax, 0x91a2b3c5
imul esi
add edx, esi
sar edx, 7
mov ecx, edx
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45cce0]
add ebx, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0xe1
mov eax, edi
imul edi, edi, 0x203
imul eax, eax, 0x61
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
add ecx, eax
mov eax, 0x71625345
imul dword [0x45ccd4]
sar edx, 8
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [esp + 0xc], eax
mov eax, 0x38e38e39
imul dword [0x45ccd4]
mov eax, dword [esp + 0xc]
sar edx, 7
add eax, edx
mov edi, edx
mov edx, dword [0x45cce4]
imul edx, edx, 0xe1
mov ebx, dword [0x45cce8]
shr edi, 0x1f
imul ebx, ebx, 0x21e
add edi, eax
add edi, edx
mov edx, dword [0x45cccc]
mov eax, 0xd20d20d3
imul edx
add edx, dword [0x45cccc]
sar edx, 7
add edi, edx
mov eax, edx
mov edx, dword [0x45ccdc]
shr eax, 0x1f
add eax, edi
mov edi, dword [str._r_____r____]
sub eax, ebx
sub eax, edi
mov edi, dword [0x45ccd8]
add eax, 0x16f
imul edi, edi, 0x33a
mov dword [0x45cccc], eax
mov eax, 0x4f576647
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [0x45ccc8], ecx
imul ecx, ecx, 0x242
mov eax, 0x59493e15
imul esi
add edi, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45ccd8]
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
mov dword [esp + 0xc], 0
sar edx, 7
mov esi, dword [0x45cce4]
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, esi
push 0
lea ecx, [eax + ebx - 0xe1]
push 2
mov dword [0x45ccd0], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x40e8d3
mov ecx, dword [0x45ccdc]
mov esi, dword [str._r_____r____]
mov edx, dword [0x45ccd8]
lea edi, [edx + esi]
mov eax, 0x38e38e39
imul edi, edi, 0x242
imul ecx
sar edx, 7
mov eax, ecx
imul eax, eax, 0x203
mov ebx, edx
add edi, edx
shr ebx, 0x1f
add ebx, edi
add ebx, eax
lea edx, [esi + esi*8]
shl edx, 6
add ebx, edx
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
mov ecx, dword [0x45cce0]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
lea edx, [ebx + ecx - 0xe1]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45ccd4], edx
call fcn.004307d6
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042fb01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45ccc8]
mov ecx, dword [0x45ccd4]
lea eax, [eax + eax*8]
shl eax, 6
mov edi, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45cce8]
mov eax, 0xf1d48bd
imul ecx
sar edx, 5
add edi, edx
mov ebx, edx
mov eax, 0x7f411e53
imul ecx
imul ecx, ecx, 0xe1
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45cce0]
sub ebx, eax
mov eax, 0xd20d20d3
imul edi
add edx, edi
imul edi, edi, 0x9c
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, edi
sub eax, ecx
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [0x45ccd8], eax
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40ea04
mov ecx, dword [0x45cccc]
mov edx, dword [0x45ccd0]
mov edi, dword [0x45cce4]
lea ebx, [edx + ecx]
mov eax, 0x4f576647
imul ebx, ebx, 0x1bd
imul edi
sar edx, 8
add ebx, edx
mov eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x25d
shr eax, 0x1f
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x38e38e39
imul edi
sar edx, 7
mov edi, edx
add ebx, edx
mov eax, 0x71625345
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 8
imul ecx, ecx, 0xe1
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, ebx
add eax, edx
sub edi, eax
add edi, ecx
push esi
mov dword [0x45ccdc], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042fb01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccd8]
lea edi, [edx + ecx]
imul eax, eax, 0x25d
mov edx, dword [0x45ccd4]
imul edi, edi, 0x16f
imul edx, edx, 0x21e
add edi, eax
sub edi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sar edx, 8
mov ebx, edx
add edi, edx
mov eax, 0x59493e15
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 7
imul ecx, ecx, 0xe1
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add eax, edx
add ebx, edi
sub ebx, eax
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
sub ebx, ecx
push eax
mov dword [0x45cce0], ebx
call fcn.0043a56e
add esp, 8
test eax, eax
je 0x40ef0e
mov eax, dword [0x45ccd0]
mov ecx, dword [0x45ccd8]
lea esi, [ecx + eax]
mov ecx, dword [0x45ccc8]
imul esi, esi, 0x203
lea edx, [eax + eax*8]
shl edx, 6
sub esi, edx
mov eax, 0x38e38e39
imul ecx
sar edx, 7
mov edi, edx
add esi, edx
mov edx, dword [str._r_____r____]
mov eax, 0xd8a5df
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce4]
imul edx, edx, 0xe1
shr edi, 0x1f
add edi, esi
sub edi, eax
sub edi, edx
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
mov ecx, dword [esp + 0x20]
sar edx, 7
mov eax, edx
push ecx
shr eax, 0x1f
add edi, edx
push 0
add eax, edi
push 0x1f0fff
mov dword [0x45cce8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x45ccd4]
mov esi, eax
mov ecx, dword [0x45cccc]
mov eax, 0x4f576647
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4f576647
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x242
sub eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x38e38e39
imul edi
mov eax, dword [0x45cce8]
sar edx, 7
imul eax, eax, 0x21e
add ebx, edx
mov edi, edx
mov edx, ecx
imul edx, edx, 0x203
shr edi, 0x1f
add edi, ebx
add edi, eax
add edi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
test esi, esi
mov dword [str._r_____r____], edi
jne 0x40ebb9
push 0x44cfc8
call fcn.004307d6
add esp, 4
jmp 0x40ec51
mov ecx, dword [0x45cce4]
mov eax, 0x71625345
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x45ccd0]
mov eax, 0xd8a5df
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x7f411e53
imul ecx
sar edx, 8
sub ebx, edi
mov edi, edx
add ebx, edx
mov eax, 0x91a2b3c5
imul ecx
mov eax, dword [0x45cce0]
add edx, ecx
imul eax, eax, 0x61
sar edx, 7
shr edi, 0x1f
mov ecx, edx
add edi, ebx
add edi, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0xe1
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add ecx, eax
push esi
mov dword [0x45ccc8], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40ec4a
push 0x44cfb4
call fcn.004307d6
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x45ccd4]
mov esi, dword [0x45cce0]
imul esi, esi, 0x203
mov eax, 0x71625345
imul ecx
sar edx, 8
add esi, edx
mov edi, edx
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x45cce8]
sar edx, 7
imul ecx, ecx, 0x21e
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
mov edx, dword [0x45cce4]
imul edx, edx, 0xe1
mov ebx, dword [str._r_____r____]
shr esi, 0x1f
add esi, edi
sub esi, ecx
mov ecx, dword [0x45cccc]
add esi, edx
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
sub eax, ebx
push ecx
add eax, 0x16f
push esi
mov dword [0x45cccc], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40ea04
mov edi, dword [0x45cce4]
mov ecx, dword [0x45ccd8]
mov edx, dword [0x45ccdc]
mov eax, 0x4f576647
imul edx
mov ebx, ecx
sar edx, 8
imul ebx, ebx, 0x33a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce8]
sub ebx, eax
imul edx, edx, 0x21e
mov eax, dword [0x45ccc8]
imul eax, eax, 0x242
add ebx, eax
add ebx, edx
mov edx, dword [0x45ccd0]
mov eax, 0x59493e15
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
sub ecx, edi
sub ecx, 0xe1
push esi
mov dword [0x45ccd0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40e8be
mov ecx, dword [0x45ccdc]
mov esi, dword [str._r_____r____]
mov edx, dword [0x45ccd8]
lea edi, [edx + esi]
mov eax, 0x38e38e39
imul edi, edi, 0x242
imul ecx
sar edx, 7
mov eax, ecx
imul eax, eax, 0x203
mov ebx, edx
add edi, edx
shr ebx, 0x1f
add ebx, edi
add ebx, eax
lea edx, [esi + esi*8]
shl edx, 6
add ebx, edx
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
mov ecx, dword [0x45cce0]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0x20]
push eax
push 0
lea edx, [ebx + ecx - 0xe1]
push 0x1f0fff
mov dword [0x45ccd4], edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45ccd4]
mov dword [esp + 0xc], eax
mov eax, 0x38e38e39
imul esi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x4f576647
imul esi
mov esi, dword [0x45cccc]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x4f576647
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x242
mov ebx, eax
sub ebx, edi
mov edi, dword [0x45cce8]
add ebx, edx
mov eax, edi
imul eax, eax, 0x21e
mov edx, esi
imul edx, edx, 0x203
add ebx, eax
add ebx, edx
mov eax, 0x93459be7
imul esi
add edx, esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0xc]
add ebx, ecx
test eax, eax
mov dword [str._r_____r____], ebx
je 0x40e8be
mov eax, dword [0x45ccc8]
lea esi, [eax + eax*8]
mov eax, 0xf1d48bd
imul edi
sar edx, 5
shl esi, 6
add esi, edx
mov ebx, edx
mov eax, 0x7f411e53
imul edi
imul edi, edi, 0xe1
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45cce0]
sub ebx, eax
mov eax, 0xd20d20d3
imul esi
add edx, esi
imul esi, esi, 0x9c
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
sub eax, edi
sub eax, ecx
mov ecx, dword [esp + 0x944]
mov dword [0x45ccd8], eax
mov eax, dword [esp + 0xc]
call fcn.0042fb01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45ccd4]
mov eax, dword [0x45ccc8]
mov ecx, dword [0x45cce4]
lea ebx, [eax + edx]
mov eax, 0x4f576647
imul ebx, ebx, 0x9c
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45ccd8]
mov eax, 0x38e38e39
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x93459be7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub ebx, eax
lea eax, [edx + edx*8]
shl eax, 6
add ebx, eax
mov eax, 0x59493e15
imul edx
sar edx, 7
mov edi, edx
add ebx, edx
mov edx, dword [esp + 0x20]
shr edi, 0x1f
add edi, ebx
mov dword [0x45cce4], edi
mov dword [esp + 0xc], edx
jmp 0x40ecf5