Function at 0x40b7f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x458190]
mov ecx, dword [0x456824]
mov dword [esp + 0x938], eax
mov eax, 0x7f3171f
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
push ebx
imul edx, edx, 0x293deaa
push esi
mov esi, dword [0x456838]
imul esi, esi, 0x372f5c1
sub esi, eax
add esi, edx
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [0x45681c]
push edi
sar edx, 0x19
mov edi, edx
add esi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, esi
sub edi, eax
mov dword [str._r_____r____], edi
mov byte [esp + 0x140], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
push ecx
stosw word es:[edi], ax
lea edx, [esp + 0x144]
push 0x446fbc
push edx
stosb byte es:[edi], al
call fcn.0042a341
mov ebx, dword [0x456820]
mov edi, dword [0x456834]
mov eax, 0x3ac7f767
imul ebx
sar edx, 0x17
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x62ace781
imul edi
mov eax, dword [0x456818]
imul eax, eax, 0x5305094
sar edx, 0x19
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x456830]
add ecx, eax
mov eax, 0x936c7f27
imul edi
add edx, edi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x360833b
sub ecx, eax
mov eax, dword [0x456838]
add esp, 0xc
sub ecx, edx
mov dword [0x456818], ecx
mov edx, dword [0x45681c]
imul eax, eax, 0x372f5c1
imul esi, esi, 0x293deaa
sub esi, eax
imul ecx, ecx, 0xde454f
mov eax, 0x13a45601
imul edx
sar edx, 0x16
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov esi, eax
mov eax, 0x61bc1a5d
imul dword [0x456838]
sar edx, 0x19
add esi, edx
mov eax, edx
mov edx, dword [0x45682c]
shr eax, 0x1f
add eax, esi
mov esi, dword [str._r_____r____]
sub eax, esi
imul esi, esi, 0x4067eec
add eax, 0x294039f
mov dword [0x45681c], eax
mov eax, 0x7f3171f
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x31a5bd5f
imul ebx
add esi, ecx
sar edx, 0x17
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
sub esi, edi
push 0
sub esi, 0x5305094
push 2
mov dword [esp + 0x18], 0
mov dword [0x456820], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x14], esi
jne 0x40ba3f
mov esi, dword [0x456818]
mov edx, dword [0x456828]
imul esi, esi, 0x293deaa
mov ecx, dword [0x45682c]
imul edx, edx, 0xde454f
add esi, edx
mov eax, 0x13a45601
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x16
imul ecx, ecx, 0x53d1950
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
sub esi, eax
add esi, edx
lea edx, [ecx + esi - 0x5305094]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x456824], edx
call fcn.0042ae66
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042a171
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x456838]
mov eax, 0x94723637
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x63510a67
imul ecx
imul ecx, ecx, 0x5305094
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
sub edi, ecx
mov ecx, dword [0x45681c]
imul ecx, ecx, 0x3422234
add edi, ecx
mov ecx, dword [0x456824]
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
lea ecx, [esp + 0x18]
add eax, edx
push ecx
sub edi, eax
push esi
mov dword [0x456828], edi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40bb30
mov ecx, dword [0x456820]
mov eax, 0x7f3171f
imul ecx
imul ecx, ecx, 0x360833b
mov eax, dword [0x45682c]
mov edi, dword [0x45681c]
imul eax, eax, 0x5305094
sar edx, 0x15
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x456830]
imul edx, edx, 0x22d753a
add ebx, edx
add ebx, eax
mov eax, 0x936c7f27
imul edi
add edx, edi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
push esi
mov dword [0x45682c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042a171
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [0x456828]
mov ecx, dword [0x456824]
imul edi, edi, 0x22d753a
mov edx, dword [0x45682c]
imul ecx, ecx, 0xdef222
imul edx, edx, 0x5305094
sub edi, ecx
mov ecx, dword [0x45681c]
sub edi, edx
mov eax, 0x31a5bd5f
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [esp + 0x140]
push ecx
lea edx, [esp + 0x40]
sub edi, eax
push edx
mov dword [0x456830], edi
call fcn.00434bee
add esp, 8
test eax, eax
je 0x40bf1e
mov ecx, dword [str._r_____r____]
mov esi, dword [0x456834]
mov eax, 0x3ac7f767
imul esi, esi, 0xfacfaf6c
imul ecx
mov ecx, dword [0x456820]
sar edx, 0x17
imul ecx, ecx, 0x2a93aa6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45682c]
mov eax, 0x13a45601
imul ecx
mov ecx, dword [esp + 0x20]
sar edx, 0x16
mov eax, edx
push ecx
shr eax, 0x1f
add esi, edx
push 0
add eax, esi
push 0x1f0fff
mov dword [0x456838], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x456824]
mov edi, eax
mov ebx, dword [0x456838]
mov esi, dword [0x456830]
imul ebx, ebx, 0x372f5c1
mov eax, 0x7f3171f
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, esi
imul edx, edx, 0x293deaa
add ebx, edx
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [0x45681c]
sar edx, 0x19
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
test edi, edi
mov dword [str._r_____r____], ebx
jne 0x40bc7a
push 0x446f88
call fcn.0042ae66
add esp, 4
jmp 0x40bcfc
mov ecx, dword [0x456820]
imul esi, esi, 0x360833b
mov eax, 0x3ac7f767
imul ecx
mov ecx, dword [0x456834]
sar edx, 0x17
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x62ace781
imul ecx
sar edx, 0x19
add ebx, edx
mov eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x5305094
shr eax, 0x1f
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x936c7f27
imul ecx
add edx, ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, esi
push edi
mov dword [0x456818], ebx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40bcf5
push 0x446f74
call fcn.0042ae66
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x456838]
mov esi, dword [0x456830]
mov edx, ecx
imul esi, esi, 0x293deaa
imul edx, edx, 0x372f5c1
sub esi, edx
mov edx, dword [0x45681c]
mov eax, 0x13a45601
imul edx
mov ebx, dword [str._r_____r____]
sar edx, 0x16
add esi, edx
mov edi, edx
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
shr edi, 0x1f
add edi, esi
mov esi, dword [esp + 0x14]
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
lea ecx, [esp + 0x18]
sub eax, ebx
push ecx
add eax, 0x294039f
push esi
mov dword [0x45681c], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40bb30
mov edi, dword [0x456818]
mov ecx, dword [0x456834]
mov ebx, dword [esp + 0x10]
mov edx, dword [0x45682c]
imul edi, edi, 0xde454f
mov eax, 0x7f3171f
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x4067eec
sub edx, eax
add edx, edi
mov dword [esp + 0x10], edx
mov edx, dword [0x456820]
mov eax, 0x31a5bd5f
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
sub edx, ecx
sub edx, 0x5305094
push esi
mov dword [0x456820], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40ba2a
mov esi, dword [0x456818]
mov ecx, dword [0x456828]
imul esi, esi, 0x293deaa
imul ecx, ecx, 0xde454f
mov edi, dword [0x456830]
add esi, ecx
mov ecx, dword [0x45682c]
mov eax, 0x13a45601
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x16
imul ecx, ecx, 0x53d1950
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [esp + 0x20]
push eax
add esi, edi
push 0
lea edx, [ecx + esi - 0x5305094]
push 0x1f0fff
mov dword [0x456824], edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x456824]
mov dword [esp + 0xc], eax
mov eax, 0x61bc1a5d
imul esi
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, dword [0x45681c]
mov eax, 0x7f3171f
imul esi
mov esi, dword [0x456838]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
mov ebx, esi
imul edx, edx, 0x293deaa
imul ebx, ebx, 0x372f5c1
sub ebx, eax
add ebx, edx
mov eax, 0x979d1eb7
imul edi
add edx, edi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0xc]
add ebx, ecx
test eax, eax
mov dword [str._r_____r____], ebx
je 0x40ba2a
mov eax, 0x94723637
imul edi, edi, 0x3422234
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x63510a67
imul esi
imul esi, esi, 0x5305094
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0xc]
sub ebx, esi
add ebx, edi
sub ebx, ecx
mov ecx, dword [esp + 0x944]
mov dword [0x456828], ebx
call fcn.0042a171
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x456834]
mov edi, dword [0x456818]
mov ebx, dword [0x456828]
mov eax, 0x7f3171f
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, edi
imul ecx, ecx, 0x3422234
sub ecx, eax
mov eax, 0x61bc1a5d
imul ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0x53d1950
sub ecx, eax
add ecx, edx
mov eax, 0x979d1eb7
imul ebx
add edx, ebx
mov ebx, dword [esp + 0x20]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x456834], ecx
jmp 0x40bd7d