Function at 0x40e3c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x944
mov eax, dword [0x45f640]
xor eax, ebp
mov dword [esp + 0x940], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 4], eax
mov eax, dword [0x45dbd4]
push esi
cdq
push edi
mov esi, eax
mov eax, dword [0x45dbd8]
push 2
mov edi, edx
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebx, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
push 1
push 0xba7a7bcd
push edi
push esi
add ebx, eax
call fcn.004305f0
push 2
push 0x1b912b5c
push edi
push esi
sub ebx, eax
call fcn.004305f0
mov ecx, dword [0x45dbdc]
mov edx, dword [0x45dbe0]
imul ecx, ecx, 0x6d4760f7
add ebx, eax
imul edx, edx, 0x264da184
add ebx, ecx
xor eax, eax
mov byte [esp + 0x148], 0
mov ecx, 0x1ff
lea edi, [esp + 0x149]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x14c]
add ebx, edx
push 0x44e064
push ecx
mov dword [0x45dbc4], ebx
call fcn.0043069a
mov eax, dword [0x45dbdc]
add esp, 0xc
push 1
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
mov edi, dword [0x45dbe0]
mov ebx, dword [0x45dbd0]
mov ecx, eax
mov eax, 0x1f64bb9f
mul edi
shr edx, 0x1c
sub ecx, edx
mov eax, 0x2d0ae8c5
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
mov esi, dword [0x45dbd8]
mov edx, edi
imul edx, edx, 0x3053d3f1
shr eax, 0x1f
add ecx, eax
add ecx, edx
mov eax, 0x45291d0f
imul dword [0x45dbe4]
sar edx, 0x1d
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
mov ecx, esi
imul ecx, ecx, 0x7672ee00
add eax, ecx
push 2
mov dword [0x45dbc8], eax
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov dword [esp + 0xc], eax
push 2
mov eax, esi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ecx, dword [esp + 0xc]
sub ecx, eax
push 1
mov eax, edi
cdq
push 0xba7a7bcd
push edx
push eax
mov dword [esp + 0x1c], ecx
call fcn.004305f0
mov ecx, dword [esp + 0xc]
add ecx, eax
mov esi, dword [0x45dbc4]
mov eax, 0x1f64bb9f
mul ebx
shr edx, 0x1c
sub ecx, edx
mov eax, 0x9a168f41
mul dword [0x45dbdc]
shr edx, 0x1f
add ecx, edx
mov edx, esi
imul edx, edx, 0x1531b042
sub ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [0x45dbd4]
mov eax, 0x45291d0f
imul ecx
mov ecx, dword [esp + 0xc]
sar edx, 0x1d
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
mov dword [0x45dbcc], eax
mov eax, dword [0x45dbe8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
mov dword [esp + 0x1c], 0
call fcn.004305f0
imul esi, esi, 0xf414a551
sub esi, eax
mov eax, 0x9a168f41
mul ebx
mov eax, dword [0x45dbe8]
shr edx, 0x1f
sub esi, edx
imul eax, eax, 0x1531b042
sub esi, eax
mov eax, 0x45291d0f
imul dword [0x45dbd8]
mov eax, dword [0x45dbe4]
imul eax, eax, 0x7d86eec7
sar edx, 0x1d
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, eax
push 0
lea edx, [ecx + edi - 0x7672ee00]
push 2
mov dword [0x45dbd0], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
push 1
mov dword [esp + 0x1c], ebx
push 0x388a7f11
jne 0x40e6b1
mov eax, dword [0x45dbdc]
cdq
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004305f0
push 2
push 0x1b912b5c
push edi
push esi
mov ebx, eax
call fcn.004305f0
mov ecx, dword [0x45dbe8]
mov edx, dword [0x45dbc4]
imul ecx, ecx, 0x1b912b5c
mov edi, dword [0x45dbe4]
imul edx, edx, 0x4f22272
sub eax, ebx
add eax, ecx
mov ecx, dword [0x45dbc8]
imul ecx, ecx, 0x264da184
add edx, edi
add edx, eax
lea edx, [ecx + edx + 0x7672ee00]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45dbd4], edx
call fcn.004311a6
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x940]
xor ecx, ebp
call fcn.0043040d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45dbe0]
cdq
push edx
push eax
call fcn.004305f0
mov esi, dword [0x45dbc8]
mov edi, eax
push 2
mov eax, esi
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
sub edi, eax
mov eax, dword [0x45dbc4]
push 1
cdq
push 0xeace4fbe
push edx
push eax
call fcn.004305f0
imul esi, esi, 0x1b912b5c
mov ecx, dword [0x45dbe8]
add edi, eax
mov eax, 0x2d0ae8c5
mul ecx
mov eax, ecx
imul ecx, ecx, 0x7672ee00
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [0x45dbcc]
imul edx, edx, 0x388a7f11
shr eax, 0x1f
add edi, eax
sub edi, edx
lea eax, [esp + 0x20]
add edi, esi
push eax
sub edi, ecx
push ebx
mov dword [0x45dbd8], edi
mov dword [esp + 0x28], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40e7d0
mov eax, dword [0x45dbd0]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbe4]
push 2
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbcc]
add esi, eax
mov eax, 0x1f64bb9f
mul ecx
imul ecx, ecx, 0x74f4f79a
mov eax, dword [0x45dbc4]
shr edx, 0x1c
imul eax, eax, 0x7672ee00
sub esi, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3903276d
sub esi, edx
add esi, eax
add esi, ecx
push ebx
mov dword [0x45dbdc], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x940]
xor ecx, ebp
call fcn.0043040d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45dbe8]
push 1
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbd0]
mov edx, dword [0x45dbd4]
sub edx, ecx
imul edx, edx, 0x2b57abfe
mov esi, eax
add esi, edx
mov eax, 0x9a168f41
mul ecx
mov eax, dword [0x45dbc8]
mov ecx, dword [0x45dbd8]
imul eax, eax, 0x1531b042
shr edx, 0x1f
imul ecx, ecx, 0x3903276d
sub esi, edx
mov edx, dword [0x45dbcc]
imul edx, edx, 0x7672ee00
sub esi, eax
sub esi, ecx
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x48]
sub esi, edx
push ecx
mov dword [0x45dbe0], esi
call fcn.0043af2e
add esp, 8
test eax, eax
je 0x40eccd
mov eax, dword [0x45dbdc]
push 0xfffffffffffffffe
cdq
push 0xc77580ef
push edx
push eax
call fcn.004305f0
mov esi, dword [0x45dbd8]
mov edx, dword [0x45dbd0]
add edx, esi
imul edx, edx, 0x264da184
mov edi, eax
mov eax, dword [0x45dbc8]
push 2
sub edi, edx
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
add edi, eax
push 1
mov eax, esi
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
imul esi, esi, 0x1b912b5c
mov ecx, dword [esp + 0x28]
sub edi, eax
mov eax, dword [0x45dbd4]
imul eax, eax, 0x7672ee00
push ecx
add edi, esi
push 0
sub edi, eax
push 0x1f0fff
mov dword [0x45dbe8], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x45dbd8]
mov dword [esp + 0x1c], eax
mov eax, dword [0x45dbd4]
cdq
mov esi, eax
push 2
mov dword [esp + 0x18], edx
mov eax, edi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebx, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov edx, dword [esp + 0x14]
push 1
push 0xba7a7bcd
push edx
push esi
add ebx, eax
call fcn.004305f0
push 2
sub ebx, eax
mov eax, dword [esp + 0x18]
push 0x1b912b5c
push eax
push esi
call fcn.004305f0
mov esi, dword [0x45dbe0]
add ebx, eax
mov eax, dword [0x45dbdc]
mov ecx, eax
imul ecx, ecx, 0x6d4760f7
add ebx, ecx
mov ecx, dword [esp + 0x1c]
mov edx, esi
imul edx, edx, 0x264da184
add ebx, edx
test ecx, ecx
mov dword [0x45dbc4], ebx
jne 0x40e97c
push 0x44e030
call fcn.004311a6
add esp, 4
jmp 0x40ea02
push 1
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
imul edi, edi, 0x7672ee00
mov ecx, dword [0x45dbd0]
mov ebx, eax
mov eax, 0x1f64bb9f
mul esi
imul esi, esi, 0x3053d3f1
shr edx, 0x1c
sub ebx, edx
mov eax, 0x2d0ae8c5
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
add ebx, ecx
mov ecx, dword [0x45dbe4]
mov eax, 0x45291d0f
imul ecx
sar edx, 0x1d
add ebx, esi
mov esi, dword [esp + 0x1c]
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, edi
push esi
mov dword [0x45dbc8], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40e9fb
push 0x44e01c
call fcn.004311a6
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x45dbc8]
mov ebx, dword [esp + 0x18]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbd8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
sub esi, eax
mov eax, dword [0x45dbe0]
push 1
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
add esi, eax
mov ecx, dword [0x45dbc4]
mov eax, 0x1f64bb9f
imul ecx, ecx, 0x1531b042
mul dword [0x45dbd0]
shr edx, 0x1c
sub esi, edx
mov eax, 0x9a168f41
mul dword [0x45dbdc]
shr edx, 0x1f
add esi, edx
sub esi, ecx
mov ecx, dword [0x45dbd4]
mov eax, 0x45291d0f
imul ecx
sar edx, 0x1d
mov eax, edx
lea ecx, [esp + 0x20]
shr eax, 0x1f
add esi, edx
push ecx
add eax, esi
push ebx
mov dword [0x45dbcc], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40e7d0
mov esi, dword [0x45dbc4]
mov edi, dword [0x45dbe4]
mov eax, dword [0x45dbe8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
imul esi, esi, 0xf414a551
imul edi, edi, 0x7d86eec7
sub esi, eax
mov eax, 0x9a168f41
mul dword [0x45dbd0]
mov eax, dword [0x45dbe8]
imul eax, eax, 0x1531b042
mov ecx, dword [0x45dbe0]
shr edx, 0x1f
sub esi, edx
sub esi, eax
mov eax, 0x45291d0f
imul dword [0x45dbd8]
sar edx, 0x1d
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, edi
lea edx, [eax + ecx - 0x7672ee00]
push ebx
mov dword [0x45dbd0], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40e69a
mov eax, dword [0x45dbdc]
cdq
push 1
push 0x388a7f11
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004305f0
push 2
push 0x1b912b5c
push edi
push esi
mov ebx, eax
call fcn.004305f0
mov ecx, dword [0x45dbe8]
mov edx, dword [0x45dbc4]
imul ecx, ecx, 0x1b912b5c
imul edx, edx, 0x4f22272
sub eax, ebx
add eax, ecx
add edx, dword [0x45dbe4]
mov ecx, dword [0x45dbc8]
imul ecx, ecx, 0x264da184
add edx, eax
mov eax, dword [esp + 0x28]
push eax
push 0
lea edx, [ecx + edx + 0x7672ee00]
push 0x1f0fff
mov dword [0x45dbd4], edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0xc], eax
mov eax, dword [0x45dbd4]
cdq
mov ebx, eax
mov eax, dword [0x45dbd8]
push 2
mov dword [esp + 0x18], edx
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov edi, dword [0x45dbcc]
mov esi, eax
push 2
mov eax, edi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ecx, dword [esp + 0x14]
push 1
push 0xba7a7bcd
push ecx
push ebx
add esi, eax
call fcn.004305f0
mov edx, dword [esp + 0x14]
push 2
push 0x1b912b5c
push edx
push ebx
sub esi, eax
call fcn.004305f0
add esi, eax
mov eax, dword [0x45dbdc]
imul eax, eax, 0x6d4760f7
add esi, eax
mov eax, dword [0x45dbe0]
mov ecx, eax
imul ecx, ecx, 0x264da184
add esi, ecx
mov ecx, dword [esp + 0xc]
test ecx, ecx
mov dword [0x45dbc4], esi
je 0x40e69a
push 1
cdq
push 0x388a7f11
push edx
push eax
call fcn.004305f0
mov ebx, eax
mov eax, dword [0x45dbc8]
push 2
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
sub ebx, eax
push 1
mov eax, esi
cdq
push 0xeace4fbe
push edx
push eax
call fcn.004305f0
imul edi, edi, 0x388a7f11
mov ecx, dword [0x45dbe8]
add ebx, eax
mov eax, 0x2d0ae8c5
mul ecx
mov eax, ecx
imul ecx, ecx, 0x7672ee00
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
add ebx, eax
mov eax, dword [0x45dbc8]
imul eax, eax, 0x1b912b5c
sub ebx, edi
add ebx, eax
mov eax, dword [esp + 0xc]
sub ebx, ecx
mov ecx, dword [esp + 0x94c]
pop edi
pop esi
mov dword [0x45dbd8], ebx
xor ecx, ebp
pop ebx
call fcn.0043040d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45dbe4]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbd0]
push 0xfffffffffffffffe
cdq
push 0x45858433
push edx
push eax
call fcn.004305f0
mov edi, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0x1b912b5c
push edx
push eax
sub edi, esi
call fcn.004305f0
mov esi, dword [0x45dbc4]
add edi, eax
mov eax, 0x9a168f41
mul esi
mov eax, dword [0x45dbd4]
mov ecx, dword [esp + 0x28]
imul eax, eax, 0x7114fe22
shr edx, 0x1f
add edi, edx
mov edx, dword [0x45dbd8]
imul edx, edx, 0x1b912b5c
sub edi, edx
add edi, eax
mov dword [0x45dbe4], edi
mov dword [esp + 0xc], ecx
jmp 0x40eab3