Function at 0x40c6c0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9b8
mov eax, dword [0x458190]
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x456824]
mov esi, eax
mov eax, 0x4c8f8d29
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45681c]
mov eax, 0x36b45a9b
imul ecx
mov ecx, dword [0x456838]
sar edx, 7
imul ecx, ecx, 0x235
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x1aa
sub edi, eax
lea eax, [esp + 0x94]
add edi, ecx
push eax
add edi, edx
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x9c], 0x128
mov dword [str._r_____r____], edi
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40c787
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x9b4]
call fcn.0042a301
add esp, 0x9b8
ret
mov esi, dword [0x456838]
mov ecx, dword [0x45681c]
mov eax, 0x4c8f8d29
imul esi
imul esi, esi, 0x235
sar edx, 8
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0xe1fc780f
imul ecx
add edx, ecx
sar edx, 9
push ebx
mov ebx, dword [0x456830]
add edi, edx
mov ecx, edx
mov edx, ebx
imul edx, edx, 0x1aa
shr ecx, 0x1f
add ecx, edi
sub ecx, esi
mov esi, dword [str._r_____r____]
add ecx, edx
sub ecx, esi
add ecx, 0x1e7
push ebp
mov dword [0x45681c], ecx
xor eax, eax
lea esp, [esp]
mov dl, byte [esp + eax + 0xc0]
mov byte [esp + eax + 0x1c4], dl
inc eax
test dl, dl
jne 0x40c7f0
mov edi, dword [0x45682c]
imul esi, esi, 0x358
mov eax, 0xe1fc780f
imul edi
add edx, edi
sar edx, 9
mov ebp, dword [esp + 0x9cc]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
sub esi, eax
imul edx, edx, 0x1aa
mov eax, dword [0x456828]
imul eax, eax, 0x87
add edx, ebx
add edx, esi
lea edx, [eax + edx - 0x344]
mov dword [0x456824], edx
lea esi, [esp + 0x1c4]
lea ebx, [ebx]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40c885
test al, al
je 0x40c881
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40c885
add esi, 2
add ebp, 2
test al, al
jne 0x40c860
xor eax, eax
jmp 0x40c88a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c8df
mov esi, dword [0x456820]
imul edi, edi, 0x344
imul ebx, ebx, 0x16a
mov eax, 0x30c30c31
imul esi
imul esi, esi, 0x257
sar edx, 7
add edi, edx
mov ebp, edx
mov eax, 0xf2b9d649
imul ecx
shr ebp, 0x1f
add edx, ecx
sar edx, 7
add ebp, edi
mov eax, edx
add ebp, esi
shr eax, 0x1f
add ebp, ebx
add eax, edx
sub ebp, eax
mov dword [0x45682c], ebp
mov ebx, 1
jmp 0x40c8e3
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x456828]
mov eax, 0x4c8f8d29
imul ecx
mov esi, ecx
sar edx, 8
imul esi, esi, 0x358
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456834]
sub esi, eax
mov eax, 0x30c30c31
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x36b45a9b
imul ecx
mov eax, dword [0x456818]
sar edx, 7
imul eax, eax, 0x244
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
add esi, eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x9c]
push edx
push eax
mov dword [0x456834], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40cad4
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1c4]
lea edx, [esp + 0xc0]
sub eax, edx
lea edi, [esp + eax + 0x1c4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edi
jmp 0x40c990
mov edi, dword [esp + 0x10]
jmp 0x40c990
mov esi, dword [0x456834]
mov ecx, dword [0x456830]
mov eax, 0x9cc8e161
imul ecx, ecx, 0x257
imul esi
mov eax, dword [0x456818]
imul eax, eax, 0x344
add edx, esi
sar edx, 9
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
add ebp, eax
mov eax, 0x2d4279a3
imul dword [0x456820]
sar edx, 6
sub ebp, ecx
add ebp, edx
mov ecx, edx
mov eax, 0xf2b9d649
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
shr ecx, 0x1f
add eax, edx
add ecx, ebp
sub ecx, eax
mov dword [0x456818], ecx
lea eax, [esp + 0xc0]
lea ecx, [ecx]
mov dl, byte [eax]
mov byte [edi + eax], dl
inc eax
test dl, dl
jne 0x40ca00
mov ebp, dword [esp + 0x9cc]
mov edi, dword [esp + 0x18]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40ca3a
test al, al
je 0x40ca36
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40ca3a
add edi, 2
add ebp, 2
test al, al
jne 0x40ca15
xor eax, eax
jmp 0x40ca3f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40caba
mov edx, dword [0x45682c]
imul ecx, ecx, 0x87
mov edi, dword [str._r_____r____]
mov eax, 0x30c30c31
imul edi, edi, 0x2a0
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x43491159
imul dword [0x456820]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
sub edi, eax
add edi, ecx
mov ecx, dword [esp + 0xa4]
sub edi, esi
mov dword [esp + ebx*4 + 0x1c], ecx
mov ecx, dword [esp + 0x10]
sub edi, 0x344
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [0x456820], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x9c]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40c983
mov edx, dword [0x456824]
mov ecx, dword [0x456838]
mov eax, 0xb37072d7
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov esi, ecx
imul esi, esi, 0x344
mov eax, 0xe7fc601
imul ecx
sar edx, 5
sub edi, esi
mov esi, edx
add edi, edx
mov edx, dword [0x45681c]
imul edx, edx, 0x244
shr esi, 0x1f
add esi, edi
add esi, edx
mov eax, 0x99d722db
imul ecx
add edx, ecx
mov ecx, dword [esp + 0x14]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push ecx
mov dword [0x456828], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c4]
pop ebp
mov eax, ebx
pop ebx
pop edi
pop esi
call fcn.0042a301
add esp, 0x9b8
ret