Function at 0x40c570
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9b8
mov eax, dword [0x458190]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45681c]
mov edi, dword [0x456838]
mov esi, eax
imul edi, edi, 0xe0dd
mov eax, 0x49f9945f
imul ecx
mov ecx, dword [0x456824]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x302debc5
imul ecx
sar edx, 0xe
mov ebx, edx
add edi, edx
mov edx, dword [0x456830]
imul edx, edx, 0xa8da
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
lea ecx, [esp + 0x98]
add eax, edx
push ecx
sub ebx, eax
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xa0], 0x128
mov dword [str._r_____r____], ebx
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40c637
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b4]
call fcn.0042a141
add esp, 0x9b8
ret
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov edi, esi
imul edi, edi, 0xe0dd
mov eax, 0x302debc5
imul esi
mov esi, dword [0x456830]
sar edx, 0xe
sub ebx, edi
mov edi, dword [str._r_____r____]
add ebx, edx
mov ecx, edx
mov edx, esi
imul edx, edx, 0xa8da
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
sub ecx, edi
add ecx, 0xaaa7
mov dword [0x45681c], ecx
xor eax, eax
jmp 0x40c6a0
mov dl, byte [esp + eax + 0xbc]
mov byte [esp + eax + 0x1c0], dl
inc eax
test dl, dl
jne 0x40c6a0
mov ebx, dword [0x45682c]
imul edi, edi, 0x15410
mov eax, 0x99b19d5b
imul ebx
add edx, ebx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
imul edx, edx, 0x398f
add edx, esi
mov esi, dword [0x456818]
sub edi, eax
mov eax, esi
imul eax, eax, 0xa8da
add edx, edi
lea edx, [eax + edx - 0x1558c]
push ebp
mov ebp, dword [esp + 0x9cc]
mov dword [0x456824], edx
lea edi, [esp + 0x1c4]
mov edi, edi
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40c735
test al, al
je 0x40c731
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40c735
add edi, 2
add ebp, 2
test al, al
jne 0x40c710
xor eax, eax
jmp 0x40c73a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c794
mov edi, dword [0x456820]
imul ebx, ebx, 0x1558c
mov eax, 0x47298a5
imul ecx
mov ebp, edi
imul ebp, ebp, 0xdd7b
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebp, ebx
sub ebp, eax
mov eax, dword [0x456830]
imul eax, eax, 0x8ed2
add ebp, eax
mov eax, 0x3e12562b
imul edi
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov dword [0x45682c], ecx
mov ebx, 1
jmp 0x40c798
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x456828]
imul esi, esi, 0xd534
mov eax, 0x49f9945f
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub esi, eax
add esi, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
mov eax, dword [esp + 0x14]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x9c]
push edx
sub esi, ecx
push eax
mov dword [0x456834], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40c983
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1c4]
lea edx, [esp + 0xc0]
sub eax, edx
lea esi, [esp + eax + 0x1c4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
jmp 0x40c840
mov esi, dword [esp + 0x10]
jmp 0x40c840
mov ebp, dword [0x456834]
mov ecx, dword [0x456830]
mov eax, 0x2ff8513b
imul ecx, ecx, 0xdd7b
imul ebp
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, ecx
mov ecx, dword [0x456818]
mov eax, 0x47298a5
imul ecx, ecx, 0x1558c
imul ebp
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, ecx
sub edi, eax
mov eax, 0x395bd985
imul dword [0x456820]
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov dword [0x456818], ecx
lea eax, [esp + 0xc0]
lea esp, [esp]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40c8b0
mov edi, dword [esp + 0x9cc]
mov esi, dword [esp + 0x18]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40c8e9
test al, al
je 0x40c8e5
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40c8e9
add esi, 2
add edi, 2
test al, al
jne 0x40c8c5
xor eax, eax
jmp 0x40c8ee
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c969
mov eax, 0x18008403
imul ecx, ecx, 0x398f
imul dword [0x456820]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub ecx, eax
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x107f4
sub ecx, eax
mov eax, dword [esp + 0xa4]
add ecx, edx
mov edx, dword [esp + 0x18]
sub ecx, ebp
sub ecx, 0x1558c
mov dword [esp + ebx*4 + 0x1c], eax
mov dword [0x456820], ecx
mov ecx, dword [esp + 0x10]
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x9c]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40c833
mov ecx, dword [0x456838]
mov eax, 0x246e57b5
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, dword [0x45681c]
mov edx, ecx
imul eax, eax, 0xd534
imul edx, edx, 0x1558c
sub esi, edx
mov edx, dword [0x456824]
add esi, eax
mov eax, 0x302debc5
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61082f49
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x14]
sub esi, ecx
push edx
mov dword [0x456828], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c4]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0042a141
add esp, 0x9b8
ret