Function at 0x40e7f0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x45c540]
xor eax, esp
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [0x45abe8]
mov ecx, dword [0x45abd4]
imul edi, edi, 0x54
mov esi, eax
mov eax, dword [0x45abdc]
imul eax, eax, 0x37
add edi, eax
mov eax, 0x3159721f
imul ecx
sar edx, 4
add edi, edx
mov ebx, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov ecx, edx
shr ebx, 0x1f
add ebx, edi
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45abcc]
mov edx, ecx
imul edx, edx, 0x59
add ebx, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov edi, edx
add ebx, edx
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
lea ecx, [esp + 0xa0]
add eax, edx
add edi, ebx
push ecx
sub edi, eax
push esi
mov dword [esp + 0x20], esi
mov dword [esp + 0xa8], 0x128
mov dword [str._r_____r____], edi
mov dword [esp + 0x24], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40e8ce
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9bc]
xor ecx, esp
call fcn.0042dfcd
add esp, 0x9c0
ret
mov edx, dword [0x45abe8]
mov ecx, dword [0x45abd4]
imul edx, edx, 0x54
push ebp
mov ebp, dword [0x45abe0]
mov esi, ebp
imul esi, esi, 0x59
sub esi, edx
mov eax, 0x3159721f
imul ecx
mov eax, dword [0x45abe4]
sar edx, 4
add esi, edx
mov edi, edx
shl eax, 4
shr edi, 0x1f
add edi, esi
add edi, eax
mov eax, 0x94f2095
imul ecx
mov ecx, dword [0x45abcc]
sar edx, 1
add edi, edx
mov esi, edx
mov eax, 0xdd67c8a7
imul ecx
mov eax, dword [str._r_____r____]
add edx, ecx
shr esi, 0x1f
sar edx, 5
add esi, edi
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, eax
add ecx, 0x4c
mov dword [0x45abcc], ecx
xor esi, esi
jmp 0x40e950
mov dl, byte [esp + esi + 0xc8]
mov byte [esp + esi + 0x1cc], dl
inc esi
test dl, dl
jne 0x40e950
mov esi, dword [0x45abdc]
mov edx, dword [0x45abd8]
lea ebx, [edx + eax]
mov edi, eax
imul ebx, ebx, 0x37
mov eax, esi
imul edi, edi, 0x53
imul eax, eax, 0x59
add ebx, eax
mov eax, 0x3159721f
imul esi
sar edx, 4
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0x9d4]
add ebx, edi
lea edx, [ebx + ebp - 0x10]
mov dword [esp + 0x14], eax
mov dword [0x45abd4], edx
lea eax, [esp + 0x1cc]
lea esp, [esp]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x40ea00
test dl, dl
je 0x40e9fc
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x40ea00
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x40e9d0
xor eax, eax
jmp 0x40ea05
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ea73
mov eax, dword [0x45abd0]
imul ebp, ebp, 0x21
lea ebx, [eax + ecx]
imul ebx, ebx, 0x44
mov eax, 0x3159721f
imul dword [0x45abe4]
sar edx, 4
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, 0x63e7063f
imul dword [0x45abe4]
mov eax, dword [esp + 0x18]
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add eax, edx
add ebx, eax
mov eax, 0x94f2095
imul ecx
sar edx, 1
add ebx, ebp
mov ecx, edx
shl esi, 4
shr ecx, 0x1f
add ebx, esi
add ecx, edx
sub ebx, ecx
mov dword [0x45abdc], ebx
mov ebx, 1
jmp 0x40ea77
mov ebx, dword [esp + 0x20]
mov edx, dword [0x45abc8]
mov eax, dword [0x45abd4]
mov ecx, dword [0x45abd8]
lea esi, [edx + eax]
mov eax, 0x3159721f
imul esi, esi, 0x25
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x63e7063f
imul dword [0x45abe4]
sar edx, 5
mov eax, edx
sub esi, ecx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x6bca1af3
imul dword [str._r_____r____]
mov eax, dword [esp + 0x1c]
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0xa4]
add esi, edi
push edx
add ecx, esi
push eax
mov dword [0x45abe4], ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40ec8b
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea edi, [esp + eax + 0x1cc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
jmp 0x40eb30
mov edi, dword [esp + 0x18]
mov edi, edi
mov eax, dword [0x45abe0]
mov ecx, dword [0x45abc8]
mov esi, dword [0x45abd0]
add ecx, eax
mov eax, 0xb81702e1
imul esi
add edx, esi
sar edx, 6
shl ecx, 4
add ecx, edx
mov ebp, edx
mov eax, 0x3e0f83e1
imul esi
sar edx, 3
shr ebp, 0x1f
add ebp, ecx
add ebp, edx
mov ecx, edx
mov eax, 0x94f2095
imul dword [0x45abe4]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ecx, 0x1f
add ecx, ebp
sub ecx, eax
mov eax, esi
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add ecx, eax
mov dword [0x45abc8], ecx
lea eax, [esp + 0xc8]
mov edi, edi
mov dl, byte [eax]
mov byte [edi + eax], dl
inc eax
test dl, dl
jne 0x40eba0
mov ebp, dword [esp + 0x9d4]
mov edi, dword [esp + 0x14]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40ebda
test al, al
je 0x40ebd6
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40ebda
add edi, 2
add ebp, 2
test al, al
jne 0x40ebb5
xor eax, eax
jmp 0x40ebdf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ec71
mov eax, 0x6bca1af3
imul ecx, ecx, 0x37
imul esi
mov esi, dword [0x45abd8]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, esi
imul edx, edx, 0x52
add ecx, edx
mov edx, dword [0x45abdc]
mov eax, 0x63e7063f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abe8]
mov ebp, dword [0x45abe4]
imul edx, edx, 0x54
sub ecx, eax
add ecx, edx
mov eax, esi
cdq
and edx, 0xf
add eax, edx
mov edx, dword [esp + 0x14]
sar eax, 4
add ecx, eax
mov eax, dword [esp + 0xac]
sub ecx, ebp
sub ecx, 0x10
mov dword [esp + ebx*4 + 0x24], eax
mov dword [0x45abd0], ecx
mov ecx, dword [esp + 0x18]
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xa4]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40eb2a
mov ecx, dword [0x45abe8]
mov esi, dword [0x45abc8]
mov eax, 0xb81702e1
imul esi, esi, 0x53
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45abe0]
mov eax, 0xdd67c8a7
imul esi
add edx, esi
imul esi, esi, 0x25
sar edx, 5
mov ebp, edx
add edi, edx
mov edx, dword [0x45abd4]
mov eax, 0x3159721f
imul edx
sar edx, 4
shr ebp, 0x1f
mov eax, edx
add ebp, edi
shr eax, 0x1f
add ebp, esi
add eax, edx
shl ecx, 4
sub ebp, eax
sub ebp, ecx
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [0x45abd8], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9cc]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0042dfcd
add esp, 0x9c0
ret