Function at 0x40bc50
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9b8
mov eax, dword [0x458000]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x456694]
mov edi, dword [0x45668c]
mov esi, eax
imul edi, edi, 0xdcfc
mov eax, 0x95e7555
imul ecx
mov ecx, dword [0x456690]
sar edx, 9
mov ebx, edx
add edi, edx
mov eax, 0x5bdd0ecb
imul ecx
mov ecx, dword [0x4566a8]
sar edx, 0xe
imul ecx, ecx, 0x3117
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebx, 0x1f
add ebx, edi
sub ebx, eax
add ebx, ecx
mov ecx, dword [0x45669c]
mov eax, 0x6000f003
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
lea ecx, [esp + 0x98]
add eax, edx
push ecx
sub ebx, eax
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xa0], 0x128
mov dword [str._r_____r____], ebx
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40bd1d
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b4]
call fcn.00429911
add esp, 0x9b8
ret
mov ebx, dword [0x456690]
mov ecx, dword [0x4566a0]
imul ecx, ecx, 0xdcfc
mov eax, 0x95e7555
imul ebx
sar edx, 9
add ecx, edx
mov esi, edx
shr esi, 0x1f
add esi, ecx
mov ecx, dword [0x45668c]
mov eax, 0xb73ab967
imul ecx
add edx, ecx
sar edx, 0xf
add esi, edx
mov ecx, edx
mov edx, dword [0x4566a8]
imul edx, edx, 0x3117
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
sub ecx, dword [0x456694]
add ecx, 0xdbb5
mov dword [0x45668c], ecx
xor eax, eax
nop
mov dl, byte [esp + eax + 0xbc]
mov byte [esp + eax + 0x1c0], dl
inc eax
test dl, dl
jne 0x40bd80
mov eax, dword [str._r_____r____]
mov esi, dword [0x45669c]
imul eax, eax, 0x36a6
mov edi, ecx
imul edi, edi, 0xdcfc
add edi, eax
mov eax, 0xb73ab967
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456698]
imul edx, edx, 0x7f22
sub edi, eax
add edi, dword [0x4566a4]
lea eax, [edx + edi - 0xdd0b]
push ebp
mov ebp, dword [esp + 0x9cc]
mov dword [0x456694], eax
lea edi, [esp + 0x1c4]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40be15
test al, al
je 0x40be11
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40be15
add edi, 2
add ebp, 2
test al, al
jne 0x40bdf0
xor eax, eax
jmp 0x40be1a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40be73
mov edx, dword [0x456694]
imul ebx, ebx, 0xaaa9
mov edi, edx
mov eax, 0x5bdd0ecb
imul edi, edi, 0xdd0b
imul edx
sar edx, 0xe
mov eax, ecx
imul eax, eax, 0x18161
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
add esi, ebx
add esi, eax
mov eax, 0x80df83a9
imul ecx
add edx, ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x45669c], esi
mov ebx, 1
jmp 0x40be77
mov ebx, dword [esp + 0x10]
mov eax, 0x95e7555
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456688]
imul edx, edx, 0xb2d6
mov edi, esi
imul edi, edi, 0x36a6
sub edi, ecx
add edi, edx
mov eax, 0x5bdd0ecb
imul dword [0x4566a4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x6000f003
imul esi
mov eax, dword [esp + 0x14]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x9c]
push edx
sub edi, ecx
push eax
mov dword [0x4566a4], edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40c055
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1c4]
lea edx, [esp + 0xc0]
sub eax, edx
lea esi, [esp + eax + 0x1c4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
jmp 0x40bf14
mov esi, dword [esp + 0x10]
mov ebp, dword [0x456690]
mov ecx, dword [0x4566a0]
imul ecx, ecx, 0xffff5557
mov eax, ebp
imul eax, eax, 0xdd0b
sub ecx, eax
mov eax, 0x55072b69
imul dword [0x45669c]
sar edx, 0xf
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x4566a4]
mov eax, 0x80df83a9
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x456688]
add ecx, edi
mov dword [0x456688], ecx
lea eax, [esp + 0xc0]
nop
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40bf80
mov edi, dword [esp + 0x9cc]
mov esi, dword [esp + 0x18]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40bfb9
test al, al
je 0x40bfb5
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40bfb9
add esi, 2
add edi, 2
test al, al
jne 0x40bf95
xor eax, eax
jmp 0x40bfbe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c03b
mov esi, dword [0x4566a8]
imul ecx, ecx, 0x7f22
mov eax, 0x9524e185
imul esi, esi, 0xb25a
imul ebp
add edx, ebp
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov ebp, dword [0x4566a0]
mov eax, 0x5bdd0ecb
imul dword [0x45669c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
sub esi, eax
add esi, ecx
mov ecx, dword [esp + 0xa4]
sub esi, ebp
mov dword [esp + ebx*4 + 0x1c], ecx
mov ecx, dword [esp + 0x10]
sub esi, 0xdd0b
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [0x456690], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x9c]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40bf10
mov ecx, dword [0x4566a8]
mov eax, 0x6bb7d05b
imul ecx
sub edx, ecx
mov esi, ecx
sar edx, 0xf
imul esi, esi, 0xdd0b
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x456694]
mov eax, 0x95e7555
imul ecx
mov ecx, dword [0x4566a0]
sar edx, 9
imul ecx, ecx, 0xb2d6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, esi
sub edi, eax
add edi, ecx
mov ecx, dword [0x456698]
mov eax, 0x14dc1615
imul ecx
mov ecx, dword [esp + 0x14]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
push ecx
mov dword [0x456698], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c4]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.00429911
add esp, 0x9b8
ret