Function at 0x405e00
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe80
mov eax, dword [0x45f640]
xor eax, esp
push ebx
push ebp
push esi
mov esi, dword [0x45dbe8]
mov dword [esp + 0xe88], eax
mov eax, dword [esp + 0xe90]
push edi
mov dword [esp + 0x18], eax
push 2
mov eax, esi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
imul esi, esi, 0x1531b042
mov edi, dword [0x45dbc4]
mov ecx, dword [0x45dbd8]
imul edi, edi, 0xf414a551
sub edi, eax
mov eax, 0x9a168f41
mul dword [0x45dbd0]
shr edx, 0x1f
sub edi, edx
mov eax, 0x45291d0f
imul ecx
mov eax, dword [0x45dbe0]
sar edx, 0x1d
mov ecx, edx
sub edi, esi
add edi, edx
mov edx, dword [0x45dbe4]
imul edx, edx, 0x7d86eec7
shr ecx, 0x1f
add ecx, edi
sub ecx, edx
push 0
lea ecx, [ecx + eax - 0x7672ee00]
push 2
mov dword [0x45dbd0], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x14], eax
mov eax, dword [0x45dbd4]
cdq
mov edi, eax
mov eax, dword [0x45dbcc]
push 2
mov ebx, edx
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbd8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
push 1
push 0xba7a7bcd
push ebx
push edi
add esi, eax
call fcn.004305f0
push 2
push 0x1b912b5c
push ebx
push edi
sub esi, eax
call fcn.004305f0
mov ecx, dword [0x45dbe0]
add esi, eax
mov eax, dword [0x45dbdc]
mov edx, eax
imul edx, edx, 0x6d4760f7
add esi, edx
imul ecx, ecx, 0x264da184
cdq
push 1
push 0x388a7f11
mov ebx, edx
mov edi, eax
push ebx
add esi, ecx
push edi
mov dword [0x45dbc4], esi
mov dword [esp + 0xf4], 0x128
xor ebp, ebp
call fcn.004305f0
push 2
push 0x1b912b5c
push ebx
push edi
mov dword [esp + 0x20], eax
call fcn.004305f0
imul esi, esi, 0x4f22272
mov edx, dword [0x45dbe8]
mov ecx, dword [esp + 0x10]
imul edx, edx, 0x1b912b5c
mov ebx, dword [0x45dbe4]
sub eax, ecx
mov ecx, dword [0x45dbc8]
imul ecx, ecx, 0x264da184
add eax, edx
add esi, ebx
add esi, eax
lea edx, [ecx + esi + 0x7672ee00]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xe4]
push eax
push ecx
mov dword [0x45dbd4], edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x405fac
or eax, 0xffffffff
jmp 0x4063dc
mov eax, dword [0x45dbdc]
push 1
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
mov edi, dword [0x45dbe0]
mov ecx, dword [0x45dbd0]
mov ebx, eax
mov eax, 0x1f64bb9f
mul edi
shr edx, 0x1c
sub ebx, edx
mov eax, 0x2d0ae8c5
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, edi
imul edx, edx, 0x3053d3f1
shr ecx, 0x1f
add ebx, ecx
mov ecx, dword [0x45dbe4]
add ebx, edx
mov eax, 0x45291d0f
imul ecx
mov eax, dword [0x45dbd8]
imul eax, eax, 0x7672ee00
sar edx, 0x1d
mov esi, edx
shr esi, 0x1f
add ebx, edx
add esi, ebx
add esi, eax
mov dword [0x45dbc8], esi
xor eax, eax
jmp 0x406030
mov cl, byte [esp + eax + 0x108]
mov byte [esp + eax + 0x20c], cl
inc eax
test cl, cl
jne 0x406030
push 1
mov eax, edi
cdq
push 0x388a7f11
push edx
push eax
call fcn.004305f0
mov edi, eax
push 2
mov eax, esi
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
sub edi, eax
mov eax, dword [0x45dbc4]
push 1
cdq
push 0xeace4fbe
push edx
push eax
call fcn.004305f0
imul esi, esi, 0x1b912b5c
mov ecx, dword [0x45dbe8]
add edi, eax
mov eax, 0x2d0ae8c5
mul ecx
mov eax, ecx
imul ecx, ecx, 0x7672ee00
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [0x45dbcc]
imul edx, edx, 0x388a7f11
shr eax, 0x1f
add edi, eax
mov eax, dword [esp + 0x18]
sub edi, edx
add edi, esi
sub edi, ecx
push eax
lea ecx, [esp + 0x210]
push ecx
mov dword [0x45dbd8], edi
call fcn.0043af2e
mov esi, dword [0x45dbd0]
mov ebx, dword [0x45dbd8]
mov edi, dword [0x45dbe0]
add esp, 8
test eax, eax
jne 0x406175
mov eax, dword [0x45dbc8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebp, eax
push 2
mov eax, ebx
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
sub ebp, eax
push 1
mov eax, edi
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
add ebp, eax
mov eax, 0x1f64bb9f
mul esi
shr edx, 0x1c
sub ebp, edx
mov ecx, dword [0x45dbd4]
mov eax, 0x9a168f41
mul dword [0x45dbdc]
shr edx, 0x1f
add ebp, edx
mov edx, dword [0x45dbc4]
imul edx, edx, 0x1531b042
sub ebp, edx
mov eax, 0x45291d0f
imul ecx
sar edx, 0x1d
mov eax, edx
add ebp, edx
shr eax, 0x1f
add eax, ebp
mov dword [0x45dbcc], eax
mov ebp, 1
mov eax, dword [0x45dbdc]
push 1
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
imul ebx, ebx, 0x7672ee00
mov dword [esp + 0x10], eax
mov eax, 0x1f64bb9f
mul edi
imul edi, edi, 0x3053d3f1
mov eax, dword [esp + 0x10]
shr edx, 0x1c
sub eax, edx
mov dword [esp + 0x10], eax
mov ecx, dword [0x45dbe4]
mov eax, 0x2d0ae8c5
mul esi
mov eax, dword [esp + 0x10]
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 0x1f
add eax, esi
add eax, edi
mov dword [esp + 0x10], eax
mov eax, 0x45291d0f
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0x1d
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
add ecx, ebx
mov ebx, dword [esp + 0x14]
lea edx, [esp + 0xe4]
push edx
push ebx
mov dword [0x45dbc8], ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40636d
mov eax, ebp
shl eax, 6
lea ecx, [esp + 0x108]
lea esi, [esp + eax + 0x20c]
sub eax, ecx
lea edi, [esp + eax + 0x20c]
lea eax, [esp + 0x108]
jmp 0x406230
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x406230
mov eax, dword [0x45dbc8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebx, eax
mov eax, dword [0x45dbd8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
sub ebx, eax
mov eax, dword [0x45dbe0]
push 1
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
add ebx, eax
mov eax, 0x1f64bb9f
mul dword [0x45dbd0]
shr edx, 0x1c
sub ebx, edx
mov ecx, dword [0x45dbd4]
mov eax, 0x9a168f41
mul dword [0x45dbdc]
shr edx, 0x1f
add ebx, edx
mov edx, dword [0x45dbc4]
imul edx, edx, 0x1531b042
sub ebx, edx
mov eax, 0x45291d0f
imul ecx
mov ecx, dword [esp + 0x18]
sar edx, 0x1d
mov eax, edx
shr eax, 0x1f
add ebx, edx
push ecx
add eax, ebx
push esi
mov dword [0x45dbcc], eax
call fcn.0043af2e
add esp, 8
test eax, eax
jne 0x406353
mov eax, dword [0x45dbd0]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebx, eax
mov eax, dword [0x45dbe4]
push 2
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbcc]
add ebx, eax
mov eax, 0x1f64bb9f
mul ecx
imul ecx, ecx, 0x74f4f79a
mov eax, dword [0x45dbc4]
shr edx, 0x1c
imul eax, eax, 0x7672ee00
sub ebx, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3903276d
sub ebx, edx
add ebx, eax
add ebx, ecx
mov ecx, dword [esp + 0xec]
mov dword [esp + ebp*4 + 0x1c], ecx
inc ebp
add esi, 0x40
mov dword [0x45dbdc], ebx
add edi, 0x40
mov ebx, dword [esp + 0x14]
lea edx, [esp + 0xe4]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x406224
mov eax, dword [0x45dbe8]
push 1
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbd0]
mov esi, eax
mov eax, dword [0x45dbd4]
sub eax, ecx
imul eax, eax, 0x2b57abfe
add esi, eax
mov eax, 0x9a168f41
mul ecx
mov ecx, dword [0x45dbc8]
mov eax, dword [0x45dbcc]
imul ecx, ecx, 0x1531b042
shr edx, 0x1f
imul eax, eax, 0x7672ee00
sub esi, edx
mov edx, dword [0x45dbd8]
imul edx, edx, 0x3903276d
sub esi, ecx
sub esi, edx
sub esi, eax
push ebx
mov dword [0x45dbe0], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov ecx, dword [esp + 0xe8c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043040d
add esp, 0xe80
ret