Function at 0x405a20
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe80
mov eax, dword [0x45c540]
xor eax, esp
mov dword [esp + 0xe7c], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45abdc]
mov eax, dword [esp + 0xe94]
mov dword [esp + 0x14], eax
mov eax, 0x63e7063f
imul ecx
mov eax, dword [0x45abc8]
imul eax, eax, 0x37
mov esi, dword [0x45abe8]
sar edx, 5
imul esi, esi, 0x54
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45abd8]
mov edx, ecx
imul edx, edx, 0x52
add esi, edx
mov edx, dword [0x45abd0]
add esi, eax
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, ecx
cdq
and edx, 0xf
add eax, edx
mov edx, dword [0x45abe4]
sar eax, 4
add esi, eax
sub esi, edx
push 0
sub esi, 0x10
push 2
mov dword [0x45abd0], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45abd4]
mov ebp, eax
mov eax, 0x3159721f
imul ecx
sar edx, 4
mov esi, dword [0x45abcc]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, esi
imul edx, edx, 0x59
sub edi, ecx
add edi, edx
mov eax, 0x63e7063f
imul esi
sar edx, 5
add edi, edx
mov ecx, edx
mov eax, 0x78787879
imul esi
sar edx, 5
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, edi
mov dword [esp + 0x18], ebp
add eax, edx
mov esi, dword [0x45abdc]
mov edx, dword [0x45abe8]
sub ecx, eax
imul edx, edx, 0x54
add ecx, edx
mov eax, esi
imul eax, eax, 0x37
add ecx, eax
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x8a
mov edx, esi
imul edx, edx, 0x59
add ecx, edx
mov eax, 0x3159721f
imul esi
sar edx, 4
add ecx, edx
mov ebx, edx
mov eax, 0xdd67c8a7
imul esi
add edx, esi
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x45abd8]
sar edx, 5
imul ecx, ecx, 0x37
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, dword [0x45abe0]
lea eax, [esp + 0xe4]
push eax
lea edx, [ecx + ebx - 0x10]
push ebp
mov dword [esp + 0xec], 0x128
xor edi, edi
mov dword [0x45abd4], edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x405bb4
or eax, 0xffffffff
jmp 0x405f96
mov ecx, dword [0x45abc8]
mov esi, dword [0x45abe0]
lea edx, [esi + ecx]
mov ecx, dword [0x45abe4]
shl edx, 4
mov eax, edx
mov dword [esp + 0x10], eax
mov ebx, dword [0x45abd0]
mov eax, 0x94f2095
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xb81702e1
imul ebx
add edx, ebx
sar edx, 6
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov dword [esp + 0x10], eax
mov eax, 0x3e0f83e1
imul ebx
mov eax, dword [esp + 0x10]
sar edx, 3
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, ebx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add ecx, eax
mov dword [0x45abc8], ecx
xor eax, eax
jmp 0x405c40
mov dl, byte [esp + eax + 0x108]
mov byte [esp + eax + 0x20c], dl
inc eax
test dl, dl
jne 0x405c40
mov edx, dword [0x45abd4]
imul ecx, ecx, 0x53
mov eax, 0x3159721f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
imul esi, esi, 0x25
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
add eax, esi
mov esi, dword [0x45abe8]
mov ebx, eax
mov eax, 0xb81702e1
imul esi
add edx, esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x30c30c31
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
mov ecx, dword [esp + 0x14]
shl esi, 4
push ecx
lea edx, [esp + 0x210]
sub eax, esi
push edx
mov dword [0x45abd8], eax
call fcn.00438ade
mov esi, dword [0x45abe4]
mov ebx, dword [0x45abe0]
add esp, 8
test eax, eax
jne 0x405d62
mov ecx, dword [0x45abd4]
mov eax, 0x3159721f
imul ecx
sar edx, 4
mov edi, ebx
imul edi, edi, 0x59
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [esp + 0x10], eax
mov eax, 0x94f2095
imul ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [0x45abcc]
sar edx, 1
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov eax, dword [0x45abe8]
imul eax, eax, 0x54
sub edi, eax
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 5
add edi, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, edi
mov edx, esi
shl edx, 4
add ecx, edx
sub ecx, dword [str._r_____r____]
add ecx, 0x4c
mov dword [0x45abcc], ecx
mov edi, 1
mov eax, dword [0x45abc8]
add ebx, eax
mov eax, 0x94f2095
imul esi
sar edx, 1
mov ecx, edx
shl ebx, 4
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45abd0]
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
add ebx, edx
mov esi, edx
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
shr esi, 0x1f
add esi, ebx
mov ebx, edx
add esi, edx
mov eax, ecx
cdq
and edx, 0xf
add eax, edx
shr ebx, 0x1f
lea edx, [esp + 0xe4]
sar eax, 4
add ebx, esi
push edx
add ebx, eax
push ebp
mov dword [0x45abc8], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405f2a
mov eax, edi
shl eax, 6
lea ecx, [esp + 0x108]
lea esi, [esp + eax + 0x20c]
sub eax, ecx
lea ebx, [esp + eax + 0x20c]
lea eax, [esp + 0x108]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x405df8
mov ecx, dword [0x45abd4]
mov ebp, dword [0x45abe0]
mov eax, 0x3159721f
imul ebp, ebp, 0x59
imul ecx
sar edx, 4
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov dword [esp + 0x10], eax
mov eax, 0x94f2095
imul ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [0x45abcc]
sar edx, 1
add eax, edx
mov ebp, edx
mov edx, dword [0x45abe8]
imul edx, edx, 0x54
shr ebp, 0x1f
add ebp, eax
sub ebp, edx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
mov ecx, dword [0x45abe4]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [str._r_____r____]
add eax, ebp
shl ecx, 4
add eax, ecx
sub eax, edx
mov edx, dword [esp + 0x14]
push edx
add eax, 0x4c
push esi
mov dword [0x45abcc], eax
call fcn.00438ade
add esp, 8
test eax, eax
jne 0x405f10
mov ecx, dword [0x45abcc]
mov eax, dword [0x45abd0]
mov edx, dword [0x45abe0]
lea ebp, [ecx + eax]
imul edx, edx, 0x21
imul ebp, ebp, 0x44
add ebp, edx
mov eax, 0x94f2095
imul ecx
mov ecx, dword [0x45abe4]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x3159721f
imul ecx
sar edx, 4
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x63e7063f
imul ecx
mov eax, dword [esp + 0xec]
sar edx, 5
add ebp, edx
mov ecx, edx
mov edx, dword [0x45abdc]
shr ecx, 0x1f
add ecx, ebp
shl edx, 4
add ecx, edx
mov dword [esp + edi*4 + 0x1c], eax
inc edi
add esi, 0x40
mov dword [0x45abdc], ecx
add ebx, 0x40
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0xe4]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405df1
mov ecx, dword [0x45abe8]
mov edx, dword [0x45abd0]
mov eax, dword [0x45abd4]
lea esi, [ecx + edx]
imul eax, eax, 0x54
mov edx, dword [0x45abcc]
imul esi, esi, 0x4c
sub esi, eax
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x78787879
imul ecx
mov eax, dword [0x45abd8]
sar edx, 5
imul eax, eax, 0x21
mov ecx, edx
add esi, edx
mov edx, dword [0x45abdc]
shr ecx, 0x1f
add ecx, esi
shl edx, 4
sub ecx, edx
add ecx, eax
push ebp
mov dword [0x45abe0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0xe8c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042dfcd
add esp, 0xe80
ret