Function at 0x40ff20
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c4
mov eax, dword [0x460640]
xor eax, esp
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45ebd8]
mov esi, eax
mov eax, 0x98f19603
imul ecx
add edx, ecx
mov ecx, dword [0x45ebcc]
sar edx, 0x13
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x98f19603
imul ecx
add edx, ecx
mov ecx, dword [0x45ebd4]
sar edx, 0x13
mov ebx, edx
add edi, edx
mov eax, 0x7af682a5
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ebe0]
imul edx, edx, 0x852b6
shr ebx, 0x1f
add ebx, edi
sub ebx, eax
sub ebx, edx
mov eax, 0x64ddc525
imul ecx
mov ecx, dword [0x45ebdc]
imul ecx, ecx, 0x14957d
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add ebx, edx
lea edx, [esp + 0xa4]
add eax, ebx
push edx
add eax, ecx
push esi
mov dword [esp + 0x24], esi
mov dword [esp + 0xac], 0x128
mov dword [0x45ebc4], eax
mov dword [esp + 0x1c], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x410007
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9c0]
xor ecx, esp
call fcn.0043194d
add esp, 0x9c4
ret
mov esi, dword [0x45ebc8]
mov ecx, dword [0x45ebc4]
mov edi, dword [0x45ebd8]
imul ecx, ecx, 0x6e773
mov eax, 0x98f19603
imul esi
add edx, esi
sar edx, 0x13
add ecx, edx
mov ebx, edx
mov eax, 0x98f19603
imul edi
add edx, edi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x45ebe0]
sub ebx, eax
mov eax, 0x7af682a5
imul ecx
sar edx, 0x12
mov ecx, edx
add ebx, edx
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [0x45ebdc]
mov eax, 0x7d19681
imul ebx
sar edx, 0xe
add ecx, edx
push ebp
mov ebp, edx
shr ebp, 0x1f
add ebp, ecx
mov ecx, dword [0x45ebd4]
mov eax, 0xaf53e355
imul ecx
add edx, ecx
sar edx, 0x13
add ebp, edx
mov ecx, edx
mov eax, 0x4adacc0f
imul dword [0x45ebd0]
sar edx, 0x12
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, ebp
add eax, edx
sub ecx, eax
mov dword [0x45ebcc], ecx
xor ebp, ebp
jmp 0x4100c0
mov al, byte [esp + ebp + 0xcc]
mov byte [esp + ebp + 0x1d0], al
inc ebp
test al, al
jne 0x4100c0
mov ebp, dword [0x45ebc4]
mov eax, dword [0x45ebe8]
imul ebp, ebp, 0x1b5c14
imul eax, eax, 0xa26ed
mov edx, esi
imul edx, edx, 0x852b6
sub ebp, edx
add ebp, eax
mov eax, 0x64ddc525
imul ebx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov ebp, dword [0x45ebe4]
mov dword [esp + 0x1c], eax
mov eax, 0x2a9f6a15
imul ebx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x1c]
sub edx, eax
mov eax, dword [esp + 0x9d8]
lea edx, [edx + ebp + 0xbae55]
mov dword [esp + 0x14], eax
mov dword [0x45ebd4], edx
lea eax, [esp + 0x1d0]
lea esp, [esp]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x410180
test dl, dl
je 0x41017c
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x410180
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x410150
xor eax, eax
jmp 0x410185
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4101f4
mov ebx, dword [0x45ebd0]
imul esi, esi, 0xf08a4
mov eax, 0x98f19603
imul ebx
mov eax, dword [0x45ebc4]
add edx, ebx
imul eax, eax, 0xbae55
sar edx, 0x13
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, eax
mov eax, 0x4adacc0f
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x10a7ca
sub ebx, eax
add ebx, edx
mov eax, 0x64ddc525
imul ebp
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
mov dword [0x45ebdc], eax
mov dword [esp + 0x18], 1
mov eax, 0x98f19603
imul edi, edi, 0xa26ed
imul ebp
add edx, ebp
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x85097d5b
imul dword [0x45ebd0]
sar edx, 0x12
mov eax, edx
mov esi, dword [0x45ebd4]
shr eax, 0x1f
imul esi, esi, 0x180656
add eax, edx
mov ebp, eax
mov eax, 0x7d19681
imul dword [0x45ebc4]
sub ebp, ebx
sar edx, 0xe
mov ebx, edx
add ebp, edx
mov eax, 0x64ddc525
imul ecx
mov eax, dword [esp + 0x20]
shr ebx, 0x1f
sar edx, 0x12
add ebx, ebp
mov ecx, edx
sub ebx, edi
shr ecx, 0x1f
add ebx, edx
lea edx, [esp + 0xa8]
add ecx, ebx
push edx
add ecx, esi
push eax
mov dword [0x45ebe4], ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x41043f
mov eax, dword [esp + 0x18]
shl eax, 6
lea ecx, [esp + eax + 0x1d0]
lea edx, [esp + 0xcc]
sub eax, edx
lea esi, [esp + eax + 0x1d0]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], esi
jmp 0x4102b0
mov esi, dword [esp + 0x1c]
mov edi, edi
mov ebx, dword [0x45ebe0]
mov eax, 0x1ec1ffc5
imul dword [0x45ebd0]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov ebp, dword [0x45ebd8]
mov ecx, ebx
imul ecx, ecx, 0x16c72
sub edi, ecx
mov ecx, dword [0x45ebe4]
mov eax, 0xaf53e355
imul ecx
add edx, ecx
sar edx, 0x13
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edx, ebp
imul edx, edx, 0xbae55
add eax, edx
mov edi, eax
mov eax, 0x4adacc0f
imul ebx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ebdc]
sub edi, eax
mov eax, 0x441d07d
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [0x45ebc8], eax
lea eax, [esp + 0xcc]
lea esp, [esp]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x410340
mov edi, dword [esp + 0x9d8]
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x410379
test al, al
je 0x410375
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x410379
add esi, 2
add edi, 2
test al, al
jne 0x410355
xor eax, eax
jmp 0x41037e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410425
mov esi, dword [0x45ebe8]
imul ecx, ecx, 0xdae0a
mov eax, 0x98f19603
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ebc4]
imul edx, edx, 0xd63fb
mov edi, esi
imul edi, edi, 0x6e773
sub edi, eax
sub edi, edx
mov eax, 0x7d19681
imul dword [0x45ebd0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xaf53e355
imul ebp
add edx, ebp
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xb0]
add eax, ebx
add eax, edi
lea ecx, [ecx + eax - 0xbae55]
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x28], edx
mov edx, dword [esp + 0x14]
inc eax
mov dword [0x45ebd0], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xa8]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4102aa
mov ecx, dword [0x45ebc4]
mov eax, 0x4a28aa57
imul ecx
mov ecx, dword [0x45ebe8]
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x1ec1ffc5
imul ecx
imul ecx, ecx, 0xbae55
sar edx, 0x10
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
sub edi, ecx
mov ecx, dword [0x45ebc8]
mov eax, 0x64ddc525
imul ecx
imul ecx, ecx, 0xa26ed
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x45ebe0]
mov eax, 0x2a9f6a15
imul ecx
mov eax, dword [esp + 0x20]
sar edx, 0x11
mov ecx, edx
add edi, edx
mov edx, dword [0x45ebcc]
imul edx, edx, 0xc032b
shr ecx, 0x1f
add ecx, edi
sub ecx, edx
push eax
mov dword [0x45ebd8], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9d0]
mov eax, dword [esp + 0x18]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043194d
add esp, 0x9c4
ret