Function at 0x4182f0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe78
mov eax, dword [0x455e64]
mov ecx, dword [0x454dfc]
mov dword [esp + 0xe74], eax
mov eax, 0x2d5481cb
imul ecx
mov ecx, dword [0x454e08]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
push ebp
push esi
mov esi, eax
mov eax, 0xa390ca33
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push edi
mov edi, ecx
mov ecx, dword [0x454e14]
mov eax, 0x5c6f35cd
imul ecx
mov ecx, dword [0x454e0c]
sub edi, esi
sar edx, 0xb
mov esi, edx
add edi, edx
mov eax, 0x3de9fdd3
imul ecx
sar edx, 0xa
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add esi, edi
add eax, edx
sub esi, eax
push 0
sub esi, 0x1b7b
push 2
mov dword [0x454dfc], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x454e08]
mov ebp, eax
mov eax, 0x9a96bd3d
imul esi
mov ecx, dword [0x454df8]
add edx, esi
imul ecx, ecx, 0x9f1
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454dfc]
imul edx, edx, 0x1628
sub edx, eax
mov eax, dword [0x454e14]
imul eax, eax, 0x10a2
mov ebx, dword [0x454e10]
add edx, ecx
imul ebx, ebx, 0x1b7b
lea edx, [eax + edx + 0x20a4]
mov dword [str._r_____r_____n], edx
mov eax, 0xb40b40b5
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
imul edx, edx, 0x108a
sub ebx, eax
xor edi, edi
add ebx, ecx
lea eax, [edx + ebx + 0x20a4]
mov dword [esp + 0xdc], 0x128
mov dword [0x454e00], eax
lea ecx, [esp + 0xdc]
push ecx
push ebp
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x418444
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe74]
call fcn.004274c1
add esp, 0xe78
ret
mov ecx, dword [0x454df4]
mov eax, 0x950d22f9
imul ecx
add edx, ecx
mov ecx, dword [0x454e0c]
sar edx, 0xc
imul ecx, ecx, 0x1a7f
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x454e08]
mov eax, 0xa06e4bd5
imul ecx
add edx, ecx
mov ecx, dword [0x454e10]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3de9fdd3
imul ecx
mov eax, dword [str._r_____r_____n]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
add esi, eax
mov dword [0x454df4], esi
xor eax, eax
mov cl, byte [esp + eax + 0x100]
mov byte [esp + eax + 0x204], cl
inc eax
test cl, cl
jne 0x4184b0
mov ecx, dword [0x454e00]
mov eax, 0x1f5f3801
imul ecx
mov ecx, dword [0x454e14]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x1f5f3801
imul ecx
imul ecx, ecx, 0x1b7b
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, esi
sub ebx, ecx
mov ecx, dword [0x454e04]
mov eax, 0x7b214ec3
imul ecx
mov eax, dword [esp + 0xe8c]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
lea edx, [ecx + ebx + 0x16c0]
push eax
lea ecx, [esp + 0x208]
push ecx
mov dword [0x454e04], edx
call fcn.00431f5e
mov ecx, dword [0x454e0c]
add esp, 8
test eax, eax
jne 0x418591
mov edx, dword [0x454dfc]
mov eax, 0x1f5f3801
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e00]
imul edx, edx, 0x16c0
sub eax, edx
mov edx, dword [0x454e14]
imul edx, edx, 0x10a2
sub eax, edx
mov edx, ecx
imul edx, edx, 0x9f1
lea eax, [eax + edx + 0x1697]
mov dword [0x454df8], eax
mov edi, 1
mov esi, dword [0x454df4]
imul ecx, ecx, 0x1a7f
mov eax, 0x950d22f9
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x454e08]
mov eax, 0xa06e4bd5
imul ecx
add edx, ecx
sar edx, 0xc
mov ebx, dword [str._r_____r_____n]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x454e10]
mov eax, 0x3de9fdd3
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [esp + 0xdc]
sub esi, eax
push ecx
add esi, ebx
push ebp
mov dword [0x454df4], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x418714
mov eax, edi
shl eax, 6
lea edx, [esp + 0x100]
lea ebx, [esp + eax + 0x204]
sub eax, edx
lea esi, [esp + eax + 0x204]
jmp 0x418630
lea eax, [esp + 0x100]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x418637
mov ecx, dword [0x454dfc]
mov eax, 0x1f5f3801
imul ecx
mov ecx, dword [0x454e00]
imul ecx, ecx, 0x16c0
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e14]
sub eax, ecx
imul edx, edx, 0x10a2
mov ecx, dword [0x454e0c]
imul ecx, ecx, 0x9f1
sub eax, edx
lea edx, [eax + ecx + 0x1697]
mov eax, dword [esp + 0xe8c]
push eax
push ebx
mov dword [0x454df8], edx
call fcn.00431f5e
add esp, 8
test eax, eax
jne 0x4186fe
mov eax, dword [0x454e00]
mov ecx, dword [0x454dfc]
imul eax, eax, 0x1b7c
imul ecx, ecx, 0x1a7f
add eax, ecx
mov ecx, dword [0x454df8]
mov edx, ecx
imul edx, edx, 0x1988
sub eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x3de9fdd3
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x454e08], ecx
mov ecx, dword [esp + 0xe4]
mov dword [esp + edi*4 + 0x14], ecx
inc edi
add ebx, 0x40
add esi, 0x40
lea edx, [esp + 0xdc]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x418630
mov ecx, dword [0x454df8]
mov eax, 0x2d5481cb
imul ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 0xa
imul ecx, ecx, 0x1697
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
imul edx, edx, 0x8e6
sub ecx, eax
lea eax, [ecx + edx - 0x1b7b]
push ebp
mov dword [0x454e0c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe84]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.004274c1
add esp, 0xe78
ret