Function at 0x406330
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe8c
mov eax, dword [0x460640]
xor eax, esp
push ebx
push ebp
push esi
mov dword [esp + 0xe94], eax
mov eax, dword [esp + 0xe9c]
push edi
mov dword [esp + 0x24], eax
mov eax, dword [0x45ecdc]
push 2
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov esi, eax
mov eax, dword [0x45ecd0]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ece8]
imul ecx, ecx, 0x6b66a94
mov edi, eax
sub edi, esi
add edi, ecx
mov ecx, dword [0x45ecd8]
mov edx, ecx
imul edx, edx, 0xb57eb16
mov ebp, dword [0x45ece4]
add edi, edx
mov eax, 0x2a01e433
imul ecx
mov ecx, dword [0x45ecc8]
imul ecx, ecx, 0x5295f78d
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, ecx
sub eax, ebp
push 0
sub eax, 0x6181b446
push 2
mov dword [0x45ecd0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [0x45eccc]
mov dword [esp + 0x1c], eax
mov eax, dword [0x45ecd4]
cdq
push 1
mov ebx, eax
mov ebp, edx
push 0xeae0c6d3
mov eax, edi
cdq
push ebp
push ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call fcn.004319f0
mov edx, dword [esp + 0x18]
push 1
push 0x86050f76
mov esi, eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call fcn.004319f0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 2
push 0xb57eb16
push ecx
push edx
sub esi, eax
call fcn.004319f0
push 2
push 0xb57eb16
push ebp
push ebx
add esi, eax
call fcn.004319f0
imul edi, edi, 0x140cef57
sub esi, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x6b66a94
sub esi, edi
mov edi, dword [0x45ecdc]
mov ecx, edi
imul ecx, ecx, 0x5295f78d
add esi, eax
push 1
mov eax, edi
cdq
push 0xeae0c6d3
push edx
add esi, ecx
push eax
mov dword [str._r_____r____], esi
mov dword [esp + 0x100], 0x128
xor ebx, ebx
call fcn.004319f0
imul esi, esi, 0x3d76be60
mov ecx, eax
mov eax, 0x2a215c6f
mul edi
mov eax, edi
imul edi, edi, 0x140cef57
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [0x45ecd8]
imul edx, edx, 0x5295f78d
shr eax, 0x1f
sub ecx, eax
add edx, dword [0x45ece0]
sub ecx, edi
add edx, ecx
lea eax, [esi + edx - 0x6181b446]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xf0]
push ecx
push edx
mov dword [0x45ecd4], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4064f5
or eax, 0xffffffff
jmp 0x406961
mov esi, dword [0x45ecd0]
push 1
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov ebp, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
mov edi, dword [0x45ece0]
mov ecx, dword [0x45ecc8]
sub ebp, eax
imul ecx, ecx, 0x6181b446
mov eax, 0x4d7937c3
mul esi
mov eax, edi
imul eax, eax, 0x7f4ea4e2
shr edx, 0x1e
add ebp, edx
sub ebp, eax
mov eax, 0x2a01e433
imul esi
sar edx, 0x1c
add ebp, ecx
mov esi, edx
shr esi, 0x1f
add ebp, edx
add esi, ebp
mov dword [0x45ecc8], esi
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x114]
mov byte [esp + eax + 0x218], cl
inc eax
test cl, cl
jne 0x406570
mov eax, dword [0x45ece8]
cdq
mov ebp, eax
mov eax, dword [0x45ecd4]
push 1
mov dword [esp + 0x1c], edx
cdq
push 0xeae0c6d3
push edx
push eax
mov dword [esp + 0x24], ebp
call fcn.004319f0
mov edx, dword [esp + 0x18]
push 0xfffffffffffffffe
push 0x140cef57
push edx
push ebp
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x14]
mov ebp, eax
mov eax, dword [esp + 0x10]
push 2
sub ebp, eax
mov eax, dword [esp + 0x1c]
push 0x6b66a94
push eax
push ecx
call fcn.004319f0
imul esi, esi, 0x151f392d
add ebp, eax
mov eax, 0x2a215c6f
mul edi
mov ecx, dword [esp + 0x24]
mov eax, edi
imul edi, edi, 0x242d3a05
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
add ebp, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x6181b446
sub ebp, eax
sub ebp, esi
push ecx
lea edx, [esp + 0x21c]
sub ebp, edi
push edx
mov dword [0x45ecd8], ebp
call fcn.0043c32e
mov ebp, dword [0x45ece4]
mov esi, dword [0x45ece0]
add esp, 8
test eax, eax
jne 0x4066c6
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov ebx, edx
mov edi, eax
push ebx
push edi
call fcn.004319f0
push 1
push 0x5295f78d
push ebx
push edi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
add ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [0x45eccc]
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [esp + 0x10]
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece8]
shr ecx, 0x1f
imul edx, edx, 0x6b66a94
add eax, ecx
mov ecx, esi
imul ecx, ecx, 0x140cef57
sub eax, ecx
mov ecx, ebp
imul ecx, ecx, 0x6181b446
sub eax, edx
mov edx, dword [str._r_____r____]
add eax, ecx
sub eax, edx
sub eax, 0x4f64023c
mov dword [0x45eccc], eax
mov ebx, 1
mov edi, dword [0x45ecd0]
push 1
mov eax, edi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov dword [esp + 0x10], eax
push 1
mov eax, ebp
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
imul esi, esi, 0x7f4ea4e2
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov eax, 0x4d7937c3
mul edi
shr edx, 0x1e
add ecx, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x6181b446
sub ecx, esi
add ecx, edx
mov eax, 0x2a01e433
imul edi
sar edx, 0x1c
mov eax, edx
add ecx, edx
mov edx, dword [esp + 0x1c]
shr eax, 0x1f
add eax, ecx
lea ecx, [esp + 0xf0]
push ecx
push edx
mov dword [0x45ecc8], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4068e5
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x218]
lea edx, [esp + 0x114]
sub eax, edx
lea ebp, [esp + eax + 0x218]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x114]
mov cl, byte [eax]
mov byte [eax + ebp], cl
inc eax
test cl, cl
jne 0x406777
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004319f0
push 1
push 0x5295f78d
push edi
push esi
mov dword [esp + 0x24], eax
call fcn.004319f0
mov ecx, dword [esp + 0x14]
add ecx, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [0x45eccc]
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [esp + 0x14]
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece8]
shr ecx, 0x1f
imul edx, edx, 0x6b66a94
add eax, ecx
mov ecx, dword [0x45ece0]
imul ecx, ecx, 0x140cef57
sub eax, ecx
mov ecx, dword [0x45ece4]
imul ecx, ecx, 0x6181b446
sub eax, edx
mov edx, dword [str._r_____r____]
add eax, ecx
sub eax, edx
mov edx, dword [esp + 0x24]
sub eax, 0x4f64023c
mov dword [0x45eccc], eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.0043c32e
add esp, 8
test eax, eax
jne 0x4068cb
mov eax, dword [0x45ece4]
mov ebp, dword [0x45eccc]
cdq
mov esi, eax
push 0xfffffffffffffffe
mov edi, edx
mov eax, ebp
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
add ebp, ecx
imul ebp, ebp, 0x79faf08a
push 2
push 0xb57eb16
push edi
sub eax, ebp
push esi
mov dword [esp + 0x24], eax
call fcn.004319f0
mov ecx, dword [esp + 0x14]
push 1
push 0xeae0c6d3
push edi
add ecx, eax
push esi
mov dword [esp + 0x24], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x14]
mov edx, dword [0x45ece0]
mov ebp, dword [esp + 0x10]
imul edx, edx, 0x2c857103
add ecx, eax
mov eax, dword [0x45ecdc]
imul eax, eax, 0x6181b446
sub ecx, edx
add ecx, eax
mov dword [0x45ecdc], ecx
mov ecx, dword [esp + 0xf8]
mov dword [esp + ebx*4 + 0x28], ecx
mov ecx, dword [esp + 0x20]
add ecx, 0x40
inc ebx
add ebp, 0x40
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0xf0]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x406770
mov eax, dword [0x45eccc]
mov ecx, dword [0x45ecd0]
mov esi, dword [0x45ece8]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
lea edi, [esi + ecx]
push eax
imul edi, edi, 0x4f64023c
call fcn.004319f0
mov ebp, eax
push 1
mov eax, esi
cdq
push 0x86050f76
push edx
push eax
sub ebp, edi
call fcn.004319f0
mov edx, dword [0x45ecd4]
mov ecx, dword [0x45ecdc]
imul edx, edx, 0x6b66a94
add ebp, eax
imul ecx, ecx, 0x6181b446
mov eax, dword [0x45ecd8]
imul eax, eax, 0x2c857103
sub ebp, edx
mov edx, dword [esp + 0x1c]
sub ebp, eax
sub ebp, ecx
push edx
mov dword [0x45ece0], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [esp + 0xe98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043180d
add esp, 0xe8c
ret