Function at 0x40d800
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x45c540]
mov ecx, dword [0x45abd4]
xor eax, ebp
mov dword [esp + 0x938], eax
mov eax, dword [0x45abdc]
push ebx
imul eax, eax, 0x37
push esi
push edi
mov edi, dword [0x45abe8]
imul edi, edi, 0x54
add edi, eax
mov eax, 0x3159721f
imul ecx
sar edx, 4
add edi, edx
mov ebx, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shr ebx, 0x1f
add ebx, edi
sub ebx, ecx
mov ecx, dword [0x45abcc]
mov edx, ecx
imul edx, edx, 0x59
add ebx, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov esi, dword [ebp + 8]
mov edi, edx
add ebx, edx
mov eax, 0x78787879
imul ecx
sar edx, 5
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, ebx
add eax, edx
sub edi, eax
mov dword [str._r_____r____], edi
mov byte [esp + 0x140], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea ecx, [esp + 0x144]
push 0x44b064
push ecx
stosb byte es:[edi], al
call fcn.0042e1a1
mov edx, dword [0x45abc8]
mov edi, dword [0x45abd0]
mov esi, dword [0x45abe0]
lea ecx, [esi + edx]
mov eax, 0xb81702e1
imul edi
add edx, edi
sar edx, 6
shl ecx, 4
mov ebx, edx
add ecx, edx
mov eax, 0x94f2095
imul dword [0x45abe4]
sar edx, 1
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add eax, edx
add ebx, ecx
sub ebx, eax
mov eax, 0x3e0f83e1
add esp, 0xc
imul edi
sar edx, 3
imul esi, esi, 0x59
add ebx, edx
mov ecx, edx
mov eax, edi
cdq
and edx, 0xf
add eax, edx
sar eax, 4
mov edx, dword [0x45abe4]
shl edx, 4
add esi, edx
shr ecx, 0x1f
add ecx, ebx
add ecx, eax
mov eax, 0x3159721f
imul dword [0x45abd4]
sar edx, 4
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov dword [esp + 0x14], eax
mov ebx, dword [0x45abe8]
mov eax, 0x94f2095
imul ebx, ebx, 0x54
imul dword [0x45abd4]
mov eax, dword [esp + 0x14]
sar edx, 1
add eax, edx
mov esi, edx
mov edx, dword [0x45abcc]
shr esi, 0x1f
add esi, eax
mov eax, 0xdd67c8a7
imul edx
add edx, dword [0x45abcc]
sar edx, 5
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov esi, dword [str._r_____r____]
sub eax, ebx
sub eax, esi
mov esi, dword [0x45abd8]
add eax, 0x4c
mov dword [0x45abcc], eax
mov eax, esi
imul eax, eax, 0x52
mov dword [esp + 0x10], eax
mov eax, 0x6bca1af3
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
mov dword [esp + 0x10], edx
mov dword [0x45abc8], ecx
imul ecx, ecx, 0x37
mov eax, esi
cdq
and edx, 0xf
add eax, edx
mov edx, dword [esp + 0x10]
sar eax, 4
add edx, eax
add edx, ecx
mov ecx, dword [0x45abdc]
mov dword [esp + 0x10], edx
mov eax, 0x63e7063f
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
mov dword [esp + 0x14], 0
add ecx, edx
mov esi, dword [0x45abe4]
sub eax, ecx
sub eax, esi
push 0
lea edx, [eax + ebx - 0x10]
push 2
mov dword [0x45abd0], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40dab9
mov esi, dword [0x45abdc]
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45abd8]
lea edi, [eax + ecx]
imul ecx, ecx, 0x53
mov edx, esi
imul edi, edi, 0x37
imul edx, edx, 0x59
add edi, edx
mov eax, 0x3159721f
imul esi
sar edx, 4
mov ebx, edx
add edi, edx
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abe0]
add ebx, edi
sub ebx, eax
add ebx, edx
lea ecx, [ecx + ebx - 0x10]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45abd4], ecx
call fcn.0042eca6
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x938]
xor ecx, ebp
call fcn.0042dfcd
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45abe0]
mov edi, dword [0x45abc8]
mov eax, 0xdd67c8a7
imul edi, edi, 0x53
imul ecx
add edx, ecx
imul ecx, ecx, 0x25
sar edx, 5
add edi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, edi
add ebx, ecx
mov ecx, dword [0x45abe8]
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov edi, edx
add ebx, edx
mov edx, dword [0x45abd4]
mov eax, 0x3159721f
imul edx
sar edx, 4
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, ebx
add eax, edx
shl ecx, 4
sub edi, eax
sub edi, ecx
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [0x45abd8], edi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40dbe0
mov ecx, dword [0x45abcc]
mov edx, dword [0x45abd0]
mov edi, dword [0x45abe4]
lea ebx, [edx + ecx]
mov eax, 0x3159721f
imul ebx, ebx, 0x44
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov ebx, eax
mov eax, 0x63e7063f
imul edi
mov eax, dword [0x45abe0]
imul eax, eax, 0x21
sar edx, 5
mov edi, edx
add ebx, edx
mov edx, dword [0x45abdc]
shr edi, 0x1f
add edi, ebx
add edi, eax
shl edx, 4
add edi, edx
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push esi
mov dword [0x45abdc], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x938]
xor ecx, ebp
call fcn.0042dfcd
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45abe8]
mov edx, dword [0x45abd0]
mov eax, dword [0x45abd8]
lea edi, [edx + ecx]
imul eax, eax, 0x21
imul edi, edi, 0x4c
add edi, eax
mov eax, 0x78787879
imul ecx
mov ecx, dword [0x45abd4]
imul ecx, ecx, 0x54
sar edx, 5
mov ebx, edx
add edi, edx
shr ebx, 0x1f
add ebx, edi
sub ebx, ecx
mov ecx, dword [0x45abcc]
mov eax, 0x6bca1af3
imul ecx
mov ecx, dword [0x45abdc]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
lea edx, [esp + 0x140]
shl ecx, 4
push edx
lea eax, [esp + 0x40]
sub ebx, ecx
push eax
mov dword [0x45abe0], ebx
call fcn.00438ade
add esp, 8
test eax, eax
je 0x40e080
mov eax, dword [0x45abd0]
mov ecx, dword [0x45abd8]
lea edi, [ecx + eax]
imul eax, eax, 0x53
mov ecx, dword [0x45abc8]
imul edi, edi, 0x59
sub edi, eax
mov eax, 0x3159721f
imul ecx
sar edx, 4
add edi, edx
mov ebx, edx
mov edx, dword [0x45abe4]
shl edx, 4
shr ebx, 0x1f
add ebx, edi
sub ebx, edx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 5
mov edi, edx
add ebx, edx
mov eax, 0x3e0f83e1
imul ecx
mov ecx, dword [esp + 0x20]
sar edx, 3
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
push ecx
add eax, edx
add edi, ebx
push 0
sub edi, eax
push 0x1f0fff
mov dword [0x45abe8], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x45abe8]
mov edx, dword [0x45abdc]
imul ebx, ebx, 0x54
mov ecx, dword [0x45abd4]
imul edx, edx, 0x37
mov edi, eax
add ebx, edx
mov eax, 0x3159721f
imul ecx
sar edx, 4
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x63e7063f
imul ecx
mov ecx, dword [0x45abcc]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, ecx
imul edx, edx, 0x59
add ebx, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov ebx, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
test edi, edi
mov dword [str._r_____r____], ebx
jne 0x40dd76
push 0x44b030
call fcn.0042eca6
add esp, 4
jmp 0x40de04
mov ecx, dword [0x45abc8]
mov edx, dword [0x45abe0]
lea ebx, [edx + ecx]
mov ecx, dword [0x45abd0]
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
shl ebx, 4
add ebx, edx
mov edx, dword [0x45abe4]
add eax, ebx
mov ebx, eax
mov eax, 0x94f2095
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov ebx, eax
mov eax, ecx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add ebx, eax
push edi
mov dword [0x45abc8], ebx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40ddfd
push 0x44b01c
call fcn.0042eca6
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x45abe0]
mov edx, dword [0x45abe8]
imul edi, edi, 0x59
mov ecx, dword [0x45abe4]
imul edx, edx, 0x54
shl ecx, 4
add edi, ecx
mov ecx, dword [0x45abd4]
sub edi, edx
mov eax, 0x3159721f
imul ecx
sar edx, 4
add edi, edx
mov ebx, edx
mov eax, 0x94f2095
imul ecx
mov ecx, dword [0x45abcc]
sar edx, 1
shr ebx, 0x1f
add ebx, edi
mov edi, edx
add ebx, edx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 5
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, ebx
add edi, edx
add eax, edi
sub eax, ecx
lea ecx, [esp + 0x18]
push ecx
add eax, 0x4c
push esi
mov dword [0x45abcc], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40dbe0
mov ecx, dword [0x45abe4]
mov edi, dword [0x45abd8]
mov edx, dword [0x45abd0]
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, edi
imul ebx, ebx, 0x52
sub ebx, eax
mov eax, edi
cdq
and edx, 0xf
add eax, edx
mov edx, dword [0x45abdc]
sar eax, 4
add ebx, eax
mov eax, dword [0x45abc8]
imul eax, eax, 0x37
add ebx, eax
mov eax, 0x63e7063f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abe8]
imul edx, edx, 0x54
sub ebx, eax
add ebx, edx
sub ebx, ecx
sub ebx, 0x10
push esi
mov dword [0x45abd0], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40daa2
mov esi, dword [0x45abdc]
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45abd8]
lea edi, [eax + ecx]
imul ecx, ecx, 0x53
imul edi, edi, 0x37
mov edx, esi
imul edx, edx, 0x59
add edi, edx
mov eax, 0x3159721f
imul esi
sar edx, 4
add edi, edx
mov ebx, edx
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add ebx, edi
mov edi, dword [0x45abe0]
add eax, edx
mov edx, dword [esp + 0x20]
sub ebx, eax
push edx
add ebx, edi
push 0
lea ecx, [ecx + ebx - 0x10]
push 0x1f0fff
mov dword [0x45abd4], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [0x45abd4]
mov esi, dword [0x45abe8]
mov dword [esp + 0x14], eax
mov eax, 0x3159721f
imul edi
mov eax, dword [0x45abdc]
imul eax, eax, 0x37
sar edx, 4
mov ebx, esi
imul ebx, ebx, 0x54
add ebx, eax
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x63e7063f
imul edi
mov edi, dword [0x45abcc]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, edi
imul edx, edx, 0x59
add ebx, edx
mov eax, 0x63e7063f
imul edi
sar edx, 5
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x78787879
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0x14]
add ebx, ecx
test eax, eax
mov dword [str._r_____r____], ebx
je 0x40daa2
mov edi, dword [0x45abe0]
mov ebx, dword [0x45abc8]
mov eax, 0xdd67c8a7
imul ebx, ebx, 0x53
imul edi
add edx, edi
imul edi, edi, 0x25
sar edx, 5
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, edi
mov ebx, eax
mov eax, 0xb81702e1
imul esi
add edx, esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x30c30c31
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
shl esi, 4
sub eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x944]
pop edi
pop esi
mov dword [0x45abd8], eax
mov eax, dword [esp + 0xc]
xor ecx, ebp
pop ebx
call fcn.0042dfcd
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45abd4]
mov eax, dword [0x45abc8]
mov edi, dword [0x45abd8]
lea ebx, [eax + edx]
mov eax, 0x3159721f
imul ebx, ebx, 0x25
imul edi
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x78787879
imul edi
sar edx, 5
sub ebx, ecx
mov ecx, dword [0x45abe4]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x53
add ebx, edx
mov eax, 0x6bca1af3
imul ecx
mov eax, dword [esp + 0x20]
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
mov dword [0x45abe4], ecx
mov dword [esp + 0x14], eax
jmp 0x40de98