Function at 0x404f70
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe7c
mov eax, dword [0x456fc0]
mov dword [esp + 0xe78], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x455690]
mov eax, 0x57ab2ce3
imul ecx
mov ecx, dword [0x45569c]
mov esi, dword [0x455688]
imul esi, esi, 0x5715a
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xcccc28f7
imul ecx
mov ebx, dword [0x4556a0]
add edx, ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4556a8]
imul edx, edx, 0xa0008
sub esi, ecx
add esi, edx
sub esi, ebx
push 0
sub esi, 0x205c4
push 2
mov dword [0x455690], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [0x45569c]
mov ebx, dword [0x4556a8]
mov ebp, eax
imul ebx, ebx, 0xcecf4
mov ecx, dword [0x455694]
mov eax, 0x948af151
imul edi
add edx, edi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3b1784cb
imul ecx
sar edx, 0x11
add ebx, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [0x455690]
mov eax, 0xcccc28f7
imul ebx
add edx, ebx
sar edx, 0x13
mov esi, dword [0x45568c]
mov eax, edx
imul esi, esi, 0x6e7be
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [0x455698]
imul eax, eax, 0x5715a
mov dword [esp + 0x10], eax
mov eax, 0x30f1b28f
imul edi
sar edx, 0x10
mov eax, edx
add ecx, esi
shr eax, 0x1f
xor ebx, ebx
add eax, edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], ebp
mov dword [str._r_____r____], ecx
mov dword [esp + 0xe0], 0x128
imul ecx, ecx, 0x8aa1b
sub edx, eax
add edx, esi
add ecx, edx
mov edx, dword [0x4556a4]
lea eax, [ecx + edx - 0x205c4]
lea ecx, [esp + 0xe0]
push ecx
push ebp
mov dword [0x455694], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4050e1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe78]
call fcn.0042909d
add esp, 0xe7c
ret
mov ecx, dword [0x4556a4]
mov esi, dword [0x4556a0]
mov eax, 0x1784740b
imul ecx
mov ecx, dword [0x45569c]
sar edx, 0xf
mov edi, esi
imul edi, edi, 0xfff23675
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3b1db3af
imul ecx
mov eax, dword [0x455688]
sar edx, 0x11
add edi, edx
mov ecx, edx
mov edx, dword [0x455690]
imul edx, edx, 0x205c4
shr ecx, 0x1f
add ecx, edi
sub ecx, edx
add ecx, dword [str._r_____r____]
add eax, ecx
mov dword [0x455688], eax
xor eax, eax
jmp 0x405150
mov cl, byte [esp + eax + 0x104]
mov byte [esp + eax + 0x208], cl
inc eax
test cl, cl
jne 0x405150
mov ecx, dword [0x455698]
imul esi, esi, 0x53aff
mov eax, 0x9e71fdc9
imul ecx
add edx, ecx
mov ecx, dword [0x4556a8]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x944b09c1
imul ecx
add edx, ecx
imul ecx, ecx, 0x205c4
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455694]
sub edi, eax
mov eax, 0x3b1784cb
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, esi
sub edi, eax
sub edi, ecx
mov ecx, dword [esp + 0xe90]
push ecx
lea edx, [esp + 0x20c]
push edx
mov dword [0x455698], edi
call fcn.00433b2e
mov esi, dword [0x455690]
mov ecx, dword [0x4556a0]
add esp, 8
test eax, eax
jne 0x405248
mov eax, dword [0x4556a8]
mov edx, dword [0x45568c]
imul eax, eax, 0xcecf4
mov edi, ecx
imul edi, edi, 0x6e7be
sub edi, eax
mov eax, 0x30f1b28f
imul edx
sar edx, 0x10
add edi, edx
mov ebx, edx
mov eax, 0x3b1784cb
imul esi
shr ebx, 0x1f
sar edx, 0x11
add ebx, edi
mov edi, dword [0x455694]
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, edi
add eax, 0xbae2b
mov dword [0x45568c], eax
mov ebx, 1
mov edx, dword [0x4556a4]
imul ecx, ecx, 0xfff23675
imul esi, esi, 0x205c4
mov eax, 0x1784740b
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45569c]
sub ecx, eax
mov edi, dword [0x455688]
mov eax, 0x3b1db3af
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
mov ecx, dword [str._r_____r____]
sub eax, esi
add eax, ecx
lea ecx, [esp + 0xe0]
push ecx
add edi, eax
push ebp
mov dword [0x455688], edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4053e6
mov eax, ebx
shl eax, 6
lea edx, [esp + 0x104]
lea esi, [esp + eax + 0x208]
sub eax, edx
lea edi, [esp + eax + 0x208]
lea eax, [esp + 0x104]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x4052d7
mov eax, dword [0x4556a8]
mov ecx, dword [0x4556a0]
imul eax, eax, 0xcecf4
imul ecx, ecx, 0x6e7be
sub ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [0x45568c]
mov eax, 0x30f1b28f
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0x10
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x455690]
mov dword [esp + 0x10], eax
mov eax, 0x3b1784cb
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add eax, edx
mov edx, dword [esp + 0xe90]
add ecx, eax
sub ecx, dword [0x455694]
push edx
add ecx, 0xbae2b
push esi
mov dword [0x45568c], ecx
call fcn.00433b2e
add esp, 8
test eax, eax
jne 0x4053d0
mov ecx, dword [0x45568c]
mov ebp, dword [0x455690]
mov eax, 0x1784740b
imul ebp, ebp, 0xdc98b
imul ecx
imul ecx, ecx, 0x8a933
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov ecx, dword [0x455694]
mov edx, ecx
imul edx, edx, 0x205c4
add ebp, edx
mov eax, 0xcccc28f7
imul ecx
add edx, ecx
mov ecx, dword [esp + 0xe8]
sar edx, 0x13
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + ebx*4 + 0x18], ecx
inc ebx
add esi, 0x40
mov dword [0x45569c], eax
add edi, 0x40
lea edx, [esp + 0xe0]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4052d0
mov ecx, dword [0x45568c]
mov esi, dword [0x455698]
mov eax, 0xa854d31d
imul esi, esi, 0x64985
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x12
imul ecx, ecx, 0xbae2b
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
add eax, ecx
push ebp
mov dword [0x4556a0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe88]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
call fcn.0042909d
add esp, 0xe7c
ret