Function at 0x40b770
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x458190]
mov dword [esp + 0x938], eax
mov ecx, dword [0x45682c]
push ebx
push esi
mov esi, dword [0x456824]
mov eax, 0x606c8017
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
mov edi, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x329dfa79
imul esi
sub edi, ecx
mov ecx, dword [0x456838]
sar edx, 0x14
imul ecx, ecx, 0x15bc8b
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
sub edi, eax
imul edx, edx, 0x53af19
add edi, ecx
add edi, edx
mov dword [str._r_____r____], edi
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0x144]
push 0x446fc4
push ecx
call fcn.0042a331
mov ecx, dword [0x456820]
mov edi, dword [0x456830]
mov eax, 0x521ee247
imul ecx
imul ecx, ecx, 0x45ab63
sar edx, 0x14
mov esi, edi
imul esi, esi, 0x537276
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, esi
mov esi, dword [0x456834]
mov eax, 0x759571eb
imul esi
add ebx, ecx
sar edx, 0x15
add ebx, edx
mov ecx, edx
mov eax, 0x224214b1
imul esi
mov esi, dword [0x456838]
sar edx, 0x14
mov eax, edx
shr ecx, 0x1f
shr eax, 0x1f
add ecx, ebx
add eax, edx
add esp, 0xc
sub ecx, eax
mov dword [0x456818], ecx
mov eax, 0x606c8017
imul ecx, ecx, 0x779018
imul esi
imul esi, esi, 0x15bc8b
sar edx, 0x15
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
sub eax, esi
mov esi, dword [0x456824]
mov edx, edi
imul edx, edx, 0x53af19
add eax, edx
mov edx, dword [0x45682c]
sub eax, esi
mov esi, dword [str._r_____r____]
add eax, 0x42333a
imul esi, esi, 0x50ebd8
mov dword [0x45681c], eax
mov eax, 0x329dfa79
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1eefbef3
imul dword [0x456820]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
sub esi, edi
push 0
sub esi, 0x45ab63
push 2
mov dword [esp + 0x18], 0
mov dword [0x456820], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x14], esi
jne 0x40b9c2
mov ecx, dword [0x45682c]
mov esi, dword [str._r_____r____]
mov ebx, dword [0x456834]
imul esi, esi, 0x54f550
mov eax, 0x622f07f9
imul ecx
mov eax, dword [0x456828]
sar edx, 0x15
imul eax, eax, 0x779018
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x53af19
sub esi, ecx
add edx, ebx
add edx, esi
lea ecx, [eax + edx - 0x45ab63]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x456824], ecx
call fcn.0042ae95
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042a161
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x456824]
mov edi, dword [0x45681c]
mov eax, 0x606c8017
imul edi, edi, 0x536f78
imul ecx
mov ecx, dword [0x456838]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xbc70579
imul ecx
sar edx, 0x10
mov ebx, edx
add edi, edx
mov eax, 0x61e4609d
imul ecx
imul ecx, ecx, 0x45ab63
sar edx, 0x15
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add ebx, edi
add eax, edx
sub ebx, eax
sub ebx, ecx
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [0x456828], ebx
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40bab0
mov ecx, dword [0x456820]
mov edi, ecx
mov eax, 0x329dfa79
imul edi, edi, 0x537276
imul ecx
mov eax, dword [0x456824]
mov ecx, dword [0x45681c]
imul eax, eax, 0x45ab63
sar edx, 0x14
mov ebx, edx
add edi, edx
mov edx, dword [0x456830]
imul edx, edx, 0x31e0ba
shr ebx, 0x1f
add ebx, edi
add ebx, edx
add ebx, eax
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
push esi
mov dword [0x45682c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042a161
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45681c]
mov eax, 0x1eefbef3
imul ecx
mov ecx, dword [0x456824]
imul ecx, ecx, 0x42333a
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub ecx, eax
imul edx, edx, 0x45ab63
mov eax, dword [0x456828]
imul eax, eax, 0x1c242f
sub ecx, edx
add ecx, eax
mov dword [0x456830], ecx
lea ecx, [esp + 0x140]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00434bee
add esp, 8
test eax, eax
je 0x40be93
mov ecx, dword [0x45682c]
mov eax, 0x622f07f9
imul ecx
mov ecx, dword [str._r_____r____]
mov esi, dword [0x456830]
sar edx, 0x15
imul esi, esi, 0x54f550
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x521ee247
imul ecx
mov eax, dword [0x456834]
sar edx, 0x14
imul eax, eax, 0x45ab63
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456820]
imul edx, edx, 0x53af19
sub edi, esi
sub edi, ecx
mov ecx, dword [esp + 0x20]
push ecx
add edi, edx
push 0
sub edi, eax
push 0x1f0fff
mov dword [0x456838], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x456824]
mov esi, eax
mov ecx, dword [0x45682c]
mov eax, 0x606c8017
imul edi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x329dfa79
imul edi
sub ebx, ecx
mov ecx, dword [0x456838]
sar edx, 0x14
imul ecx, ecx, 0x15bc8b
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
mov ecx, dword [0x456830]
mov edx, ecx
imul edx, edx, 0x53af19
add ebx, edx
test esi, esi
mov dword [str._r_____r____], ebx
jne 0x40bc06
push 0x446f90
call fcn.0042ae95
add esp, 4
jmp 0x40bc80
mov edi, dword [0x456820]
imul ecx, ecx, 0x537276
mov eax, 0x521ee247
imul edi
imul edi, edi, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x456834]
mov eax, 0x759571eb
imul ecx
add ebx, edi
sar edx, 0x15
mov edi, edx
add ebx, edx
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov ecx, edx
shr edi, 0x1f
shr ecx, 0x1f
add ecx, edx
add edi, ebx
sub edi, ecx
push esi
mov dword [0x456818], edi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40bc79
push 0x446f7c
call fcn.0042ae95
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x456838]
mov eax, 0x606c8017
imul ecx
imul ecx, ecx, 0x15bc8b
sar edx, 0x15
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
mov ebx, dword [0x456824]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x53af19
add eax, ecx
lea edx, [esp + 0x18]
sub eax, ebx
push edx
add eax, 0x42333a
push esi
mov dword [0x45681c], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40bab0
mov ecx, dword [0x456818]
mov edi, dword [esp + 0x10]
mov edx, dword [0x45682c]
imul ecx, ecx, 0x779018
mov ebx, dword [str._r_____r____]
mov eax, 0x329dfa79
imul ebx, ebx, 0x50ebd8
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456820]
sub ebx, eax
mov eax, 0x1eefbef3
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x456830]
add ebx, ecx
sub ebx, eax
sub ebx, 0x45ab63
push esi
mov dword [0x456820], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40b9ad
mov ecx, dword [0x45682c]
mov esi, dword [str._r_____r____]
mov eax, 0x622f07f9
imul esi, esi, 0x54f550
imul ecx
mov eax, dword [0x456834]
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x53af19
add edx, eax
mov eax, dword [0x456828]
imul eax, eax, 0x779018
sub esi, ecx
add edx, esi
lea ecx, [eax + edx - 0x45ab63]
mov edx, dword [esp + 0x20]
push edx
push 0
push 0x1f0fff
mov dword [0x456824], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x456824]
mov esi, dword [0x45682c]
mov edi, eax
mov eax, 0x606c8017
imul ebx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xc4570565
imul esi
add edx, esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xcd620587
imul ebx
mov ebx, dword [0x456830]
sar edx, 0x14
imul ebx, ebx, 0x53af19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
mov esi, dword [0x456838]
mov edx, esi
imul edx, edx, 0x15bc8b
add edx, ecx
add edx, eax
add ebx, edx
test edi, edi
mov dword [str._r_____r____], ebx
je 0x40b9ad
mov ebx, dword [0x45681c]
mov eax, 0xbc70579
imul ebx, ebx, 0x536f78
imul esi
sar edx, 0x10
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x61e4609d
imul esi
imul esi, esi, 0x45ab63
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, esi
sub ebx, ecx
mov ecx, dword [esp + 0x944]
mov dword [0x456828], ebx
mov eax, edi
call fcn.0042a161
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45681c]
mov ecx, dword [0x456828]
mov eax, 0x606c8017
imul edx
sar edx, 0x15
mov edi, ecx
imul edi, edi, 0x54f550
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x456818]
mov edx, ecx
imul edx, edx, 0x536f78
add edi, edx
mov edx, dword [0x456834]
mov eax, 0x329dfa79
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [0x456834], edi
mov edi, dword [esp + 0x20]
jmp 0x40bcf9