Function at 0x418310
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe78
mov eax, dword [0x455e64]
mov ecx, dword [0x454dfc]
mov dword [esp + 0xe74], eax
mov eax, 0xa2ad5745
imul ecx
add edx, ecx
mov ecx, dword [0x454e0c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
push ebp
push esi
mov esi, eax
mov eax, 0xc2bd9c5d
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push edi
mov edi, ecx
mov ecx, dword [0x454e08]
mov eax, 0x7fbc240d
imul ecx
mov ecx, dword [0x454e14]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, esi
sub edi, eax
mov eax, 0x7fbc240d
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add edi, edx
push 0
lea edx, [ecx + edi - 0xdecb]
push 2
mov dword [0x454dfc], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x454e08]
mov edi, dword [0x454e14]
mov ebp, eax
imul edi, edi, 0xfb02
mov ecx, dword [0x454df8]
mov eax, 0x9c9a6c87
imul ecx, ecx, 0xcd41
imul esi
add edx, esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454dfc]
imul edx, edx, 0x10088
sub edi, eax
mov ebx, dword [0x454e10]
add edi, ecx
imul ebx, ebx, 0xdecb
lea eax, [edx + edi + 0x139e4]
mov dword [str._r_____r_____n], eax
mov eax, 0x7514b1e9
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
imul edx, edx, 0x85ba
sub ebx, eax
xor edi, edi
add ebx, ecx
lea eax, [edx + ebx + 0x139e4]
lea ecx, [esp + 0xdc]
mov dword [esp + 0xdc], 0x128
mov dword [0x454e00], eax
push ecx
push ebp
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x418463
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe74]
call fcn.00427501
add esp, 0xe78
ret
mov ecx, dword [0x454df4]
mov esi, dword [0x454e0c]
mov eax, 0x93140835
imul esi, esi, 0x689f
imul ecx
add edx, ecx
mov ecx, dword [0x454e08]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x30780947
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, esi
sub ebx, ecx
mov ecx, dword [0x454e10]
mov eax, 0x3d4263a3
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, dword [str._r_____r_____n]
mov dword [0x454df4], ebx
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x100]
mov byte [esp + eax + 0x204], cl
inc eax
test cl, cl
jne 0x4184d0
mov ecx, dword [0x454e04]
mov eax, 0x20a2ed5d
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x454e14]
mov edx, ecx
imul edx, edx, 0xdecb
sub esi, edx
mov edx, dword [0x454e00]
mov eax, 0x68649efd
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x68649efd
imul ecx
mov eax, dword [esp + 0xe8c]
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add esi, edx
lea edx, [ecx + esi + 0x8bf0]
push eax
lea ecx, [esp + 0x208]
push ecx
mov dword [0x454e04], edx
call fcn.00431f9e
mov ecx, dword [0x454e0c]
add esp, 8
test eax, eax
jne 0x4185b1
mov edx, dword [0x454e14]
imul edx, edx, 0xfb02
mov esi, ecx
imul esi, esi, 0xcd41
sub esi, edx
mov edx, dword [0x454dfc]
mov eax, 0x68649efd
imul edx
sar edx, 0xf
add esi, edx
mov eax, edx
mov edx, dword [0x454e00]
imul edx, edx, 0x8bf0
shr eax, 0x1f
add eax, esi
sub eax, edx
add eax, 0x64b7
mov dword [0x454df8], eax
mov edi, 1
mov esi, dword [0x454df4]
imul ecx, ecx, 0x689f
mov eax, 0x93140835
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x454e08]
mov eax, 0x30780947
imul ecx
sar edx, 0xe
mov ebx, dword [str._r_____r_____n]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x454e10]
mov eax, 0x3d4263a3
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [esp + 0xdc]
sub esi, eax
push ecx
add esi, ebx
push ebp
mov dword [0x454df4], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x41873c
mov eax, edi
shl eax, 6
lea edx, [esp + 0x100]
lea ebx, [esp + eax + 0x204]
sub eax, edx
lea esi, [esp + eax + 0x204]
jmp 0x418650
lea eax, [esp + 0x100]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x418657
mov eax, dword [0x454e14]
mov ecx, dword [0x454e0c]
imul eax, eax, 0xfb02
imul ecx, ecx, 0xcd41
sub ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [0x454dfc]
mov eax, 0x68649efd
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0xf
add eax, edx
mov ecx, edx
mov edx, dword [0x454e00]
imul edx, edx, 0x8bf0
shr ecx, 0x1f
add ecx, eax
mov eax, dword [esp + 0xe8c]
sub ecx, edx
push eax
add ecx, 0x64b7
push ebx
mov dword [0x454df8], ecx
call fcn.00431f9e
add esp, 8
test eax, eax
jne 0x418726
mov eax, dword [0x454dfc]
mov ecx, dword [0x454e00]
imul eax, eax, 0x689f
imul ecx, ecx, 0xdecc
add eax, ecx
mov ecx, dword [0x454df8]
mov edx, ecx
imul edx, edx, 0x15208
sub eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x3d4263a3
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x454e08], ecx
mov ecx, dword [esp + 0xe4]
mov dword [esp + edi*4 + 0x14], ecx
inc edi
add ebx, 0x40
add esi, 0x40
lea edx, [esp + 0xdc]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x418650
mov ecx, dword [0x454df8]
mov eax, 0xa2ad5745
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 0xe
imul ecx, ecx, 0x64b7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
imul edx, edx, 0x5706
sub ecx, eax
lea eax, [ecx + edx - 0xdecb]
push ebp
mov dword [0x454e0c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe84]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.00427501
add esp, 0xe78
ret