Function at 0x406160
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe80
mov eax, dword [0x460640]
xor eax, esp
mov dword [esp + 0xe7c], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45ebe8]
mov eax, dword [esp + 0xe94]
mov dword [esp + 0x18], eax
mov eax, 0x98f19603
imul ecx
add edx, ecx
sar edx, 0x13
mov esi, ecx
mov ecx, edx
imul esi, esi, 0x6e773
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ebc4]
imul edx, edx, 0xd63fb
sub esi, ecx
mov ecx, dword [0x45ebd0]
sub esi, edx
mov eax, 0x7d19681
imul ecx
mov ecx, dword [0x45ebd8]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xaf53e355
imul ecx
mov eax, dword [0x45ebe0]
add edx, ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ebe4]
imul edx, edx, 0xdae0a
add ecx, eax
add ecx, esi
push 0
lea eax, [edx + ecx - 0xbae55]
push 2
mov dword [0x45ebd0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45ebcc]
mov ebx, eax
mov eax, 0x98f19603
imul ecx
add edx, ecx
mov ecx, dword [0x45ebd8]
sar edx, 0x13
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x98f19603
imul ecx
add edx, ecx
mov ecx, dword [0x45ebd4]
sar edx, 0x13
mov edi, edx
add esi, edx
mov eax, 0x7af682a5
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ebe0]
imul edx, edx, 0x852b6
shr edi, 0x1f
add edi, esi
sub edi, eax
mov eax, 0x64ddc525
sub edi, edx
imul ecx
mov dword [esp + 0x14], ebx
mov esi, dword [0x45ebdc]
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add edi, edx
mov edx, dword [0x45ebc8]
mov eax, esi
imul edx, edx, 0x852b6
imul eax, eax, 0x14957d
add ecx, edi
add ecx, eax
mov dword [0x45ebc4], ecx
imul ecx, ecx, 0x1b5c14
sub ecx, edx
mov eax, 0x64ddc525
imul esi
mov eax, dword [0x45ebe8]
imul eax, eax, 0xa26ed
sar edx, 0x12
add ecx, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, ecx
add ebp, eax
mov eax, 0x2a9f6a15
imul esi
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ebe4]
sub ebp, ecx
lea ecx, [esp + 0xe4]
push ecx
lea eax, [edx + ebp + 0xbae55]
push ebx
mov dword [esp + 0xec], 0x128
xor edi, edi
mov dword [0x45ebd4], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40631a
or eax, 0xffffffff
jmp 0x4067a5
mov ecx, dword [0x45ebd0]
mov ebx, dword [0x45ebe0]
mov eax, 0x1ec1ffc5
imul ecx
mov ecx, dword [0x45ebe4]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0xaf53e355
imul ecx
mov esi, ebx
imul esi, esi, 0x16c72
add edx, ecx
mov ecx, dword [0x45ebd8]
sub ebp, esi
imul ecx, ecx, 0xbae55
sar edx, 0x13
add ebp, edx
mov esi, edx
mov eax, 0x4adacc0f
imul ebx
sar edx, 0x12
shr esi, 0x1f
mov eax, edx
add esi, ebp
add esi, ecx
mov ecx, dword [0x45ebdc]
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x441d07d
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
mov dword [0x45ebc8], ecx
xor esi, esi
mov al, byte [esp + esi + 0x108]
mov byte [esp + esi + 0x20c], al
inc esi
test al, al
jne 0x4063a0
mov edx, dword [0x45ebc4]
mov esi, dword [0x45ebe8]
mov eax, 0x4a28aa57
imul edx
sar edx, 0x11
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x1ec1ffc5
imul esi
imul esi, esi, 0xbae55
sar edx, 0x10
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
sub eax, esi
mov ebp, eax
mov eax, 0x64ddc525
imul ecx
imul ecx, ecx, 0xa26ed
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov ecx, dword [0x45ebcc]
mov eax, 0x2a9f6a15
imul ecx, ecx, 0xc032b
imul ebx
sar edx, 0x11
sub ebp, ecx
mov ecx, dword [esp + 0x18]
mov eax, edx
add ebp, edx
shr eax, 0x1f
push ecx
lea edx, [esp + 0x210]
add eax, ebp
push edx
mov dword [0x45ebd8], eax
call fcn.0043c45e
mov ebp, dword [0x45ebd0]
mov ecx, dword [0x45ebd8]
mov ebx, dword [0x45ebe0]
add esp, 8
test eax, eax
jne 0x4064fe
mov esi, dword [0x45ebc8]
mov edi, dword [0x45ebc4]
imul edi, edi, 0x6e773
mov eax, 0x98f19603
imul esi
add edx, esi
sar edx, 0x13
add edi, edx
mov esi, edx
mov eax, 0x98f19603
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
shr esi, 0x1f
add esi, edi
sub esi, eax
mov eax, 0x7af682a5
imul ebx
sar edx, 0x12
add esi, edx
mov edi, edx
mov eax, 0x7d19681
imul dword [0x45ebdc]
sar edx, 0xe
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45ebd4]
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0xaf53e355
imul esi
add edx, esi
sar edx, 0x13
add edi, edx
mov esi, edx
mov eax, 0x4adacc0f
imul ebp
sar edx, 0x12
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add esi, edi
add eax, edx
sub esi, eax
mov dword [0x45ebcc], esi
mov edi, 1
mov eax, 0x1ec1ffc5
imul ecx, ecx, 0xbae55
imul ebp
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, ebx
imul esi, esi, 0x16c72
mov ebp, eax
sub ebp, esi
mov esi, dword [0x45ebe4]
mov eax, 0xaf53e355
imul esi
add edx, esi
sar edx, 0x13
add ebp, edx
mov esi, edx
mov eax, 0x4adacc0f
imul ebx
shr esi, 0x1f
add esi, ebp
mov ebp, dword [esp + 0x14]
add esi, ecx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x441d07d
imul dword [0x45ebdc]
sar edx, 0xe
sub esi, ecx
mov eax, edx
lea ecx, [esp + 0xe4]
shr eax, 0x1f
add esi, edx
push ecx
add eax, esi
push ebp
mov dword [0x45ebc8], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40672a
mov eax, edi
shl eax, 6
lea edx, [esp + 0x108]
lea esi, [esp + eax + 0x20c]
sub eax, edx
lea ebx, [esp + eax + 0x20c]
lea eax, [esp + 0x108]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x4065b0
mov ecx, dword [0x45ebc8]
mov ebp, dword [0x45ebc4]
imul ebp, ebp, 0x6e773
mov eax, 0x98f19603
imul ecx
add edx, ecx
mov ecx, dword [0x45ebd8]
sar edx, 0x13
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x98f19603
imul ecx
add edx, ecx
mov ecx, dword [0x45ebe0]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x7af682a5
imul ecx
mov ecx, dword [0x45ebdc]
sar edx, 0x12
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov dword [esp + 0x10], eax
mov eax, 0x7d19681
imul ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [0x45ebd4]
sar edx, 0xe
add eax, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0xaf53e355
imul ecx
add edx, ecx
mov ecx, dword [0x45ebd0]
sar edx, 0x13
mov eax, edx
add ebp, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x4adacc0f
imul ecx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x18]
push edx
sub ebp, ecx
push esi
mov dword [0x45ebcc], ebp
call fcn.0043c45e
add esp, 8
test eax, eax
jne 0x406710
mov ecx, dword [0x45ebd0]
mov eax, 0x98f19603
imul ecx
mov eax, dword [0x45ebc4]
add edx, ecx
imul eax, eax, 0xbae55
mov ecx, dword [0x45ebcc]
sar edx, 0x13
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
add ebp, eax
mov eax, 0x4adacc0f
imul ecx
imul ecx, ecx, 0x10a7ca
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov ecx, dword [0x45ebe4]
mov eax, 0x64ddc525
imul ecx
mov eax, dword [esp + 0xec]
sar edx, 0x12
add ebp, edx
mov ecx, edx
mov edx, dword [0x45ebc8]
imul edx, edx, 0xf08a4
shr ecx, 0x1f
add ecx, ebp
add ecx, edx
mov dword [esp + edi*4 + 0x1c], eax
inc edi
add esi, 0x40
mov dword [0x45ebdc], ecx
add ebx, 0x40
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0xe4]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4065a3
mov ecx, dword [0x45ebd0]
mov edx, dword [0x45ebd4]
mov esi, ecx
sub esi, edx
mov edx, dword [0x45ebc8]
imul esi, esi, 0x82f7d
imul edx, edx, 0x6e773
add esi, edx
mov edx, dword [0x45ebe8]
mov eax, 0x7af682a5
imul edx
sar edx, 0x12
mov ebx, edx
add esi, edx
mov eax, 0x7d19681
imul ecx
mov ecx, dword [0x45ebcc]
sar edx, 0xe
imul ecx, ecx, 0xbae55
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ebd8]
shr ebx, 0x1f
imul edx, edx, 0xf08a4
add ebx, esi
sub ebx, eax
sub ebx, ecx
add ebx, edx
push ebp
mov dword [0x45ebe0], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0xe8c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043194d
add esp, 0xe80
ret