Function at 0x404960
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x455e64]
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x454e08]
mov edi, dword [0x454e14]
mov esi, eax
imul edi, edi, 0xfb02
mov eax, 0x9c9a6c87
imul ecx
add edx, ecx
mov ecx, dword [0x454df8]
sar edx, 0xe
imul ecx, ecx, 0xcd41
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454dfc]
imul edx, edx, 0x10088
sub edi, eax
add edi, ecx
lea ecx, [esp + 0x98]
push ecx
lea eax, [edi + edx + 0x139e4]
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xa0], 0x128
mov dword [str._r_____r_____n], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x404a0d
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x9b8]
call fcn.00427501
add esp, 0x9bc
ret
mov edx, dword [0x454e14]
mov esi, dword [0x454e0c]
imul edx, edx, 0xfb02
imul esi, esi, 0xcd41
push ebx
mov ebx, dword [0x454dfc]
sub esi, edx
mov eax, 0x68649efd
imul ebx
mov eax, dword [0x454e00]
imul eax, eax, 0x8bf0
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, eax
add ecx, 0x64b7
push ebp
mov dword [0x454df8], ecx
xor eax, eax
lea ecx, [ecx]
mov dl, byte [esp + eax + 0xc4]
mov byte [esp + eax + 0x1c8], dl
inc eax
test dl, dl
jne 0x404a60
mov edi, dword [0x454e10]
mov esi, dword [0x454e08]
imul edi, edi, 0xdecb
mov edx, ecx
imul edx, edx, 0xcd41
add edi, edx
mov eax, 0x7514b1e9
imul esi
mov ebp, dword [esp + 0x9d0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
sub edi, eax
imul edx, edx, 0x85ba
lea eax, [edi + edx + 0x139e4]
mov dword [0x454e00], eax
lea edi, [esp + 0x1c8]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x404aed
test al, al
je 0x404ae9
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x404aed
add edi, 2
add ebp, 2
test al, al
jne 0x404ac8
xor eax, eax
jmp 0x404af2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x404b35
mov eax, dword [0x454e00]
imul ebx, ebx, 0x689f
imul eax, eax, 0xdecc
add ebx, eax
mov eax, ecx
imul eax, eax, 0x15208
sub ebx, eax
mov eax, 0x3d4263a3
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov esi, ebx
mov dword [0x454e08], esi
mov edi, 1
jmp 0x404b39
mov edi, dword [esp + 0x10]
mov edx, dword [0x454df4]
imul esi, esi, 0x139e4
imul edx, edx, 0x8bf0
add esi, edx
mov eax, 0x7fbc240d
imul dword [0x454e10]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
sub esi, eax
sub esi, ecx
lea ecx, [esp + 0xa0]
push ecx
add esi, 0xd145
push edx
mov dword [0x454e10], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x404d2d
mov eax, edi
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea esi, [esp + eax + 0x1c8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], esi
jmp 0x404bc0
mov esi, dword [esp + 0x10]
jmp 0x404bc0
mov ecx, dword [0x454df4]
mov ebp, dword [0x454e0c]
mov eax, 0x93140835
imul ecx
add edx, ecx
sar edx, 0xf
mov ebx, ebp
imul ebx, ebx, 0x689f
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov ebx, dword [0x454e08]
mov dword [esp + 0x14], eax
mov eax, 0x30780947
imul ebx
mov eax, dword [esp + 0x14]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov ecx, dword [0x454e10]
mov dword [esp + 0x14], eax
mov eax, 0x3d4263a3
imul ecx
mov ecx, dword [esp + 0x14]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, dword [str._r_____r_____n]
mov dword [0x454df4], ecx
lea eax, [esp + 0xc4]
mov edi, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x404c40
mov esi, dword [esp + 0x9d0]
mov eax, dword [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x404c79
test cl, cl
je 0x404c75
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x404c79
add eax, 2
add esi, 2
test cl, cl
jne 0x404c55
xor eax, eax
jmp 0x404c7e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x404d13
mov ecx, dword [0x454dfc]
mov eax, 0xa2ad5745
imul ecx
add edx, ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xc2bd9c5d
imul ebp
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x454e14]
mov eax, 0x7fbc240d
imul ecx
sar edx, 0xf
add esi, edx
mov ecx, edx
mov eax, 0x7fbc240d
imul ebx
sar edx, 0xf
shr ecx, 0x1f
mov eax, edx
add ecx, esi
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x1c]
sub ecx, eax
sub ecx, 0xdecb
mov dword [0x454dfc], ecx
mov ecx, dword [esp + 0xa8]
mov dword [esp + edi*4 + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov eax, 0x40
add edx, eax
inc edi
add ecx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xa0]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404bb2
mov ecx, dword [0x454e04]
mov eax, 0x20a2ed5d
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x454e14]
mov edx, ecx
imul edx, edx, 0xdecb
sub esi, edx
mov edx, dword [0x454e00]
mov eax, 0x68649efd
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x68649efd
imul ecx
mov eax, dword [esp + 0x18]
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add esi, edx
lea edx, [ecx + esi + 0x8bf0]
push eax
mov dword [0x454e04], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
call fcn.00427501
add esp, 0x9bc
ret