Function at 0x40af50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x456fc0]
mov ecx, dword [0x455690]
mov dword [esp + 0x938], eax
mov eax, 0x709ad4e5
imul ecx
mov ecx, dword [0x45569c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
push esi
mov esi, eax
mov eax, 0xc2c05bdf
imul ecx
mov eax, dword [0x4556a8]
sar edx, 7
imul eax, eax, 0x12b
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45568c]
push edi
imul edx, edx, 0x217
mov edi, ecx
mov ecx, dword [0x455694]
sub edi, esi
add edi, edx
add edi, eax
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
add edi, edx
mov ecx, edx
mov edx, dword [ebp + 8]
shr ecx, 0x1f
add ecx, edi
mov dword [str._r_____r____], ecx
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x144]
push 0x445f7c
push eax
call fcn.0042992a
mov ecx, dword [0x4556a4]
mov eax, 0x42776e9b
imul ecx
mov edi, dword [0x455690]
sar edx, 7
mov esi, dword [0x4556a0]
mov ecx, edx
imul esi, esi, 0x217
shr ecx, 0x1f
add ecx, edx
mov eax, 0x3949660b
imul dword [0x45569c]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub eax, ecx
mov ecx, edi
imul ecx, ecx, 0xb8
sub eax, ecx
mov ecx, dword [0x455688]
sub eax, esi
add eax, edx
add ecx, eax
mov dword [0x455688], ecx
mov ecx, dword [0x4556a8]
mov ebx, ecx
add esp, 0xc
imul ebx, ebx, 0x12b
mov edx, dword [0x45568c]
imul ecx, ecx, 0x246
mov eax, 0xc3a13de7
imul edx
add edx, dword [0x45568c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov ebx, eax
mov eax, 0xe070381d
imul edi
add edx, edi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [0x455694]
add eax, ebx
sub eax, edx
lea edx, [eax + esi + 0x1d3]
mov dword [0x45568c], edx
mov eax, 0x709ad4e5
imul dword [0x45569c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [0x455688]
imul eax, eax, 0x1ed
add ecx, eax
mov eax, 0x8c55841d
imul edi
add edx, edi
mov edi, dword [0x4556a0]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, edi
push 0
sub ecx, 0xb8
push 2
mov dword [esp + 0x14], 0
mov dword [0x455690], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x14], esi
jne 0x40b1b1
mov esi, dword [0x455698]
mov ecx, dword [0x45568c]
imul esi, esi, 0x1ed
imul ecx, ecx, 0x217
add esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 8
imul ecx, ecx, 0x92
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub esi, eax
add esi, edx
lea edx, [ecx + esi - 0xb8]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x455694], edx
call fcn.00429f06
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.004291fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4556a8]
mov edi, dword [0x4556a0]
mov eax, 0x3d3fa421
imul edi, edi, 0x14f
imul ecx
imul ecx, ecx, 0xb8
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
sub edi, eax
mov eax, 0x6d978b8f
imul edx
sar edx, 7
mov ebx, edx
add edi, edx
shr ebx, 0x1f
add ebx, edi
sub ebx, ecx
mov ecx, dword [0x455694]
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x18]
push edx
sub ebx, ecx
push esi
mov dword [0x455698], ebx
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40b2a0
mov ecx, dword [0x455694]
mov eax, 0x709ad4e5
imul ecx
imul ecx, ecx, 0xb8
sar edx, 8
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45568c]
mov eax, edx
imul eax, eax, 0x23c
add edi, eax
mov eax, dword [0x455690]
imul eax, eax, 0x217
add edi, eax
mov eax, 0x42776e9b
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push esi
mov dword [0x45569c], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.004291fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45568c]
mov eax, 0x8c55841d
imul ecx
mov eax, dword [0x455698]
add edx, ecx
imul eax, eax, 0x59
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x1d3
sub edx, ecx
add edx, eax
lea ecx, [esp + 0x140]
mov dword [0x4556a0], edx
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00433c8e
add esp, 8
test eax, eax
je 0x40b68b
mov ecx, dword [str._r_____r____]
mov esi, dword [0x455690]
mov eax, 0x3949660b
imul esi, esi, 0x217
imul ecx
mov ecx, dword [0x455698]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xc3a13de7
imul ecx
mov eax, dword [esp + 0x20]
add edx, ecx
sar edx, 8
mov ecx, edx
add esi, edx
mov edx, dword [0x4556a0]
imul edx, edx, 0x14a
shr ecx, 0x1f
push eax
add ecx, esi
push 0
sub ecx, edx
push 0x1f0fff
mov dword [0x4556a8], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x455690]
mov edi, eax
mov eax, 0x709ad4e5
imul esi
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xc2c05bdf
imul dword [0x45569c]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a8]
mov ebx, eax
imul edx, edx, 0x12b
sub ebx, ecx
mov ecx, dword [0x45568c]
imul ecx, ecx, 0x217
add ebx, ecx
mov ecx, dword [0x455694]
add ebx, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
test edi, edi
mov dword [str._r_____r____], ecx
jne 0x40b3dc
push 0x445f48
call fcn.00429f06
add esp, 4
jmp 0x40b451
mov edx, dword [0x4556a4]
imul esi, esi, 0xb8
mov ebx, dword [0x4556a0]
mov eax, 0xbd889165
imul ebx, ebx, 0x217
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov ebx, eax
mov eax, 0x3949660b
imul dword [0x45569c]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
mov esi, dword [0x455688]
add eax, ecx
add esi, eax
push edi
mov dword [0x455688], esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40b44a
push 0x445f34
call fcn.00429f06
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x4556a0]
mov ecx, dword [0x4556a8]
imul esi, esi, 0x217
imul ecx, ecx, 0x12b
sub esi, ecx
mov ecx, dword [0x45568c]
mov eax, 0xc3a13de7
imul ecx
mov ebx, dword [0x455694]
add edx, ecx
mov ecx, dword [0x455690]
sar edx, 8
add esi, edx
mov edi, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
shr edi, 0x1f
add edi, esi
mov esi, dword [esp + 0x14]
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
lea ecx, [esp + 0x18]
sub eax, ebx
push ecx
add eax, 0x1d3
push esi
mov dword [0x45568c], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40b2a0
mov edi, dword [0x45569c]
mov ecx, dword [0x455688]
mov ebx, dword [esp + 0xc]
mov eax, dword [0x4556a8]
imul ecx, ecx, 0x1ed
imul eax, eax, 0x246
mov dword [esp + 0xc], eax
mov eax, 0x709ad4e5
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
mov edi, dword [0x4556a0]
add edx, ecx
mov ecx, dword [0x455690]
mov dword [esp + 0xc], edx
mov eax, 0x8c55841d
imul ecx
mov eax, dword [esp + 0xc]
add edx, ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
sub eax, edi
sub eax, 0xb8
push esi
mov dword [0x455690], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40b19c
mov esi, dword [0x455698]
mov edx, dword [0x45568c]
imul esi, esi, 0x1ed
mov ecx, dword [0x45569c]
imul edx, edx, 0x217
add esi, edx
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 8
imul ecx, ecx, 0x92
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub esi, eax
mov eax, dword [esp + 0x20]
push eax
add esi, edx
push 0
lea edx, [ecx + esi - 0xb8]
push 0x1f0fff
mov dword [0x455694], edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x455694]
mov edi, eax
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455690]
mov eax, 0x709ad4e5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45569c]
mov esi, eax
mov eax, 0xc2c05bdf
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45568c]
sub eax, esi
imul edx, edx, 0x217
mov esi, dword [0x4556a8]
mov ebx, esi
imul ebx, ebx, 0x12b
add edx, ecx
add edx, eax
add ebx, edx
test edi, edi
mov dword [str._r_____r____], ebx
je 0x40b19c
mov ebx, dword [0x4556a0]
mov eax, 0x3d3fa421
imul ebx, ebx, 0x14f
imul esi
imul esi, esi, 0xb8
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
sub ebx, eax
mov eax, 0x6d978b8f
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x944]
mov dword [0x455698], eax
mov eax, edi
call fcn.004291fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4556a4]
mov edi, dword [0x45569c]
mov eax, 0x709ad4e5
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xc2c05bdf
imul edi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x455688]
mov edx, ecx
imul edx, edx, 0x14f
mov eax, edi
imul eax, eax, 0x92
add ebx, edx
mov edx, dword [0x45568c]
add ebx, eax
mov eax, 0xe070381d
imul edx
add edx, dword [0x45568c]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov dword [0x4556a4], ebx
mov ebx, dword [esp + 0x20]
jmp 0x40b4da