Function at 0x40ebd0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x45d320]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45b9ac]
mov ebx, dword [0x45b9c0]
mov edi, eax
imul ebx, ebx, 0x427252
mov esi, dword [0x45b9b4]
mov eax, 0x7e3fea57
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x7595e9bf
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x9eea7d1d
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
add ebx, edx
mov eax, 0x9eea7d1d
imul esi
shr ecx, 0x1f
add edx, esi
sar edx, 0x16
add ecx, ebx
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x45b9c8]
imul ecx, ecx, 0x8b0f0c
lea edx, [esp + 0xa0]
push edx
add eax, ecx
push edi
mov dword [esp + 0x24], edi
mov dword [esp + 0xa8], 0x128
mov dword [str._r_____r____], eax
mov dword [esp + 0x20], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40ecad
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9bc]
call fcn.0042f231
add esp, 0x9c0
ret
mov ecx, dword [0x45b9ac]
mov esi, dword [0x45b9c0]
mov eax, 0x76294c27
imul esi, esi, 0x427252
imul ecx
sar edx, 0x15
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45b9c8]
mov eax, 0x9eea7d1d
imul esi
add edx, esi
sar edx, 0x16
mov edi, edx
add ecx, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [str._r_____r____]
mov eax, 0x9eea7d1d
imul ecx
add edx, ecx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
add eax, 0x26e3e3
mov dword [0x45b9ac], eax
xor eax, eax
jmp 0x40ed20
mov dl, byte [esp + eax + 0xc4]
mov byte [esp + eax + 0x1c8], dl
inc eax
test dl, dl
jne 0x40ed20
mov edi, dword [0x45b9b8]
imul ecx, ecx, 0x671938
mov ebx, dword [0x45b9bc]
push ebp
mov eax, esi
mov esi, dword [0x45b9a8]
imul eax, eax, 0x458786
mov dword [esp + 0x18], eax
mov ebp, esi
imul ebp, ebp, 0x427252
mov edx, edi
imul edx, edx, 0x78665a
add ebp, edx
mov eax, 0x76294c27
imul ebx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x9eea7d1d
imul dword [0x45b9c4]
add edx, dword [0x45b9c4]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, dword [esp + 0x18]
mov edx, dword [esp + 0x9d4]
add eax, ebp
mov ebp, dword [0x45b9c0]
add ecx, eax
lea ecx, [ecx + ebp - 0x346bb5]
mov dword [0x45b9b4], ecx
mov dword [esp + 0x14], edx
lea eax, [esp + 0x1cc]
mov cl, byte [eax]
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], cl
cmp cl, byte [edx]
jne 0x40edf5
test cl, cl
je 0x40edf1
mov cl, byte [eax + 1]
mov byte [esp + 0x13], cl
cmp cl, byte [edx + 1]
jne 0x40edf5
add edx, 2
add eax, 2
test cl, cl
mov dword [esp + 0x14], edx
jne 0x40edc5
xor eax, eax
jmp 0x40edfa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ee72
mov ecx, dword [0x45b9ac]
imul ebx, ebx, 0x346bb5
imul ebp, ebp, 0x533b61
mov eax, 0x8814777b
imul ecx
add edx, ecx
mov ecx, dword [0x45b9b0]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x40e326
sub ebx, eax
add ebx, edx
mov eax, 0x7595e9bf
imul ecx
mov eax, dword [esp + 0x18]
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, eax
mov eax, 0x9eea7d1d
imul edi
add edx, edi
sar edx, 0x16
mov eax, edx
add ebx, ebp
shr eax, 0x1f
add eax, edx
add ecx, ebx
add eax, ecx
mov dword [0x45b9bc], eax
mov dword [esp + 0x1c], 1
mov eax, 0x7e3fea57
imul esi, esi, str.LresultFromObject
imul edi
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x7595e9bf
imul dword [0x45b9c4]
sar edx, 0x15
mov eax, edx
sub esi, ecx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x9eea7d1d
imul edi
mov ecx, edi
imul ecx, ecx, 0x671938
add edx, edi
sar edx, 0x16
mov eax, edx
mov ebx, dword [esp + 0x18]
add esi, ecx
mov ecx, dword [0x45b9b4]
shr eax, 0x1f
add eax, edx
mov edi, dword [esp + 0x20]
sub esi, eax
mov eax, 0x9eea7d1d
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0xa4]
add esi, ebx
push edx
add ecx, esi
push edi
mov dword [0x45b9c4], ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40f0c7
mov eax, dword [esp + 0x1c]
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea eax, [esp + eax + 0x1cc]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
jmp 0x40ef30
mov edi, dword [0x45b9c4]
mov ecx, dword [0x45b9a8]
mov eax, 0x9c46284d
imul edi
add edx, edi
sar edx, 0x15
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, ecx
imul edx, edx, 0x346bb5
add ebx, edx
mov eax, 0x8814777b
imul edi
add edx, edi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45b9c0]
imul edx, edx, 0x40e326
mov esi, dword [0x45b9c8]
sub ebx, eax
imul esi, esi, 0x458786
sub ebx, edx
mov eax, 0xc4d8f4f
imul dword [0x45b9b0]
sar edx, 0x12
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x9eea7d1d
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
add ebp, esi
shr ecx, 0x1f
add ecx, edx
add ebp, ebx
add ecx, ebp
mov dword [0x45b9a8], ecx
lea eax, [esp + 0xc8]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [ebx + eax], dl
inc eax
test dl, dl
jne 0x40efc3
mov eax, dword [esp + 0x9d4]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov bl, byte [ebp]
mov dl, bl
cmp bl, byte [eax]
jne 0x40f005
test dl, dl
je 0x40f001
mov bl, byte [ebp + 1]
mov dl, bl
cmp bl, byte [eax + 1]
jne 0x40f005
add ebp, 2
add eax, 2
test dl, dl
jne 0x40efe0
xor eax, eax
jmp 0x40f00a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f0ad
mov eax, 0x69527c69
imul ecx, ecx, 0x78665a
imul dword [0x45b9b0]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45b9bc]
sub ecx, eax
mov ebx, dword [0x45b9c8]
mov eax, 0x7595e9bf
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x45ab1c
sub ecx, eax
add ecx, edx
mov eax, 0x9eea7d1d
imul ebx
add edx, ebx
sar edx, 0x16
add ecx, edx
mov eax, edx
mov edx, dword [esp + 0xac]
shr eax, 0x1f
add eax, ecx
sub eax, edi
lea ecx, [eax + esi - 0x346bb5]
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x24], edx
mov edx, dword [esp + 0x18]
inc eax
mov dword [0x45b9b0], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov edi, dword [esp + 0x20]
lea eax, [esp + 0xa4]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40ef30
mov ecx, dword [0x45b9c8]
mov ebx, dword [0x45b9ac]
mov esi, dword [0x45b9b4]
imul ebx, ebx, str.LresultFromObject
mov eax, 0x1ed25ed3
imul ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x111bd1
sub ebx, eax
add ebx, edx
mov eax, 0x9eea7d1d
imul esi
add edx, esi
mov esi, dword [0x45b9c0]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x9eea7d1d
imul esi
add edx, esi
sar edx, 0x16
mov esi, edx
add ebx, edx
mov eax, 0x1d74861
imul ecx
sar edx, 0xf
shr esi, 0x1f
mov ecx, edx
add esi, ebx
shr ecx, 0x1f
add esi, edx
add ecx, esi
push edi
mov dword [0x45b9b8], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9cc]
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
call fcn.0042f231
add esp, 0x9c0
ret