Function at 0x40bba0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9b8
mov eax, dword [0x457000]
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45569c]
mov esi, eax
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x4556a8]
mov edx, eax
shl edx, 4
add edx, eax
mov edi, edx
sub edi, ecx
mov ecx, dword [0x455690]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [0x455694]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
add edi, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x34
shr ecx, 0x1f
lea eax, [esp + 0x94]
add ecx, edi
push eax
add ecx, edx
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x9c], 0x128
mov dword [str._r_____r____], ecx
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40bc6c
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x9b4]
call fcn.00428ee1
add esp, 0x9b8
ret
mov esi, dword [0x4556a0]
mov eax, dword [0x4556a8]
imul esi, esi, 0x34
mov ecx, eax
shl ecx, 4
add ecx, eax
sub esi, ecx
mov ecx, dword [0x45568c]
mov eax, 0x30c30c31
imul ecx
sar edx, 3
add esi, edx
mov edi, edx
mov eax, 0x66666667
imul dword [0x455690]
sar edx, 2
shr edi, 0x1f
add edi, esi
mov ecx, edx
shr ecx, 0x1f
add edi, edx
mov edx, dword [0x455694]
add ecx, edi
sub ecx, edx
add ecx, 0x37
mov dword [0x45568c], ecx
xor eax, eax
jmp 0x40bcd0
mov dl, byte [esp + eax + 0xb8]
mov byte [esp + eax + 0x1bc], dl
inc eax
test dl, dl
jne 0x40bcd0
mov eax, dword [0x455698]
mov esi, dword [0x45569c]
lea edx, [eax + eax*8]
shl edx, 2
mov edi, edx
mov eax, 0x30c30c31
imul esi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x34
push ebx
push ebp
mov ebp, dword [0x4556a4]
sub edi, eax
mov eax, dword [str._r_____r____]
add edx, ebp
mov ebp, dword [esp + 0x9cc]
add edx, edi
lea eax, [eax + eax*4]
lea edx, [edx + eax*2 - 0x39]
mov dword [0x455694], edx
lea edi, [esp + 0x1c4]
lea ebx, [ebx]
mov bl, byte [edi]
mov al, bl
cmp bl, byte [ebp]
jne 0x40bd65
test al, al
je 0x40bd61
mov bl, byte [edi + 1]
mov al, bl
cmp bl, byte [ebp + 1]
jne 0x40bd65
add edi, 2
add ebp, 2
test al, al
jne 0x40bd40
xor eax, eax
jmp 0x40bd6a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40bdb7
mov edi, edx
mov eax, 0x2aaaaaab
imul edi, edi, 0x39
imul edx
mov eax, dword [0x455690]
sar edx, 3
imul eax, eax, 0x31
add edi, edx
mov esi, edx
mov edx, ecx
imul edx, edx, 0x61
shr esi, 0x1f
add esi, edi
add esi, edx
add esi, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x45569c], esi
mov ebp, 1
jmp 0x40bdbb
mov ebp, dword [esp + 0x10]
mov edi, dword [0x455688]
mov eax, 0x2aaaaaab
imul edi, edi, 0x2a
imul dword [0x4556a4]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x5397829d
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
lea edx, [esi + esi*4]
lea esi, [edi + edx*2]
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x9c]
push ecx
sub esi, eax
push edx
mov dword [0x4556a4], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40bf87
mov eax, ebp
shl eax, 6
lea ecx, [esp + eax + 0x1c4]
lea edx, [esp + 0xc0]
sub eax, edx
lea esi, [esp + eax + 0x1c4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
jmp 0x40be51
mov esi, dword [esp + 0x10]
mov ecx, dword [0x4556a4]
mov ebx, dword [0x45569c]
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x151d07eb
imul ebx
mov edi, dword [0x455688]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455690]
sub eax, ecx
imul edx, edx, 0x39
mov ecx, dword [0x4556a0]
imul ecx, ecx, 0x31
sub eax, ecx
sub eax, edx
add eax, dword [str._r_____r____]
add edi, eax
mov dword [0x455688], edi
lea eax, [esp + 0xc0]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x40beb4
mov esi, dword [esp + 0x9cc]
mov eax, dword [esp + 0x18]
lea esp, [esp]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40bef4
test cl, cl
je 0x40bef0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40bef4
add eax, 2
add esi, 2
test cl, cl
jne 0x40bed0
xor eax, eax
jmp 0x40bef9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40bf6d
mov eax, dword [0x4556a8]
lea edx, [eax + eax*2]
shl edx, 4
lea ecx, [edi + edi*8]
lea ecx, [edx + ecx*4]
mov eax, 0x2aaaaaab
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov ebx, dword [0x4556a0]
mov eax, 0x94f2095
imul dword [0x455690]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
sub ecx, eax
sub ecx, ebx
sub ecx, 0x39
mov dword [0x455690], ecx
mov ecx, dword [esp + 0xa4]
mov dword [esp + ebp*4 + 0x1c], ecx
mov ecx, dword [esp + 0x10]
mov eax, 0x40
add edx, eax
inc ebp
add ecx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x9c]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40be4d
mov ecx, dword [0x455698]
mov eax, 0x78787879
imul ecx
mov ecx, dword [0x4556a0]
sar edx, 3
imul ecx, ecx, 0x2a
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, ecx
mov ecx, dword [0x4556a8]
mov edx, ecx
imul edx, edx, 0x39
sub esi, edx
mov eax, 0x4ec4ec4f
imul ecx
mov ecx, dword [0x455694]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x14]
sub esi, ecx
push edx
mov dword [0x455698], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c4]
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
call fcn.00428ee1
add esp, 0x9b8
ret