Function at 0x40f670
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x45e540]
xor eax, esp
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9cc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45cbcc]
mov edi, eax
mov ebx, dword [0x45cbe8]
mov eax, 0x98eb62a3
imul ebx, ebx, 0x857ee
imul ecx
add edx, ecx
mov esi, dword [0x45cbd4]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x898dd
sub ebx, eax
add ebx, edx
mov eax, 0x220de0d
imul esi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x220de0d
imul ecx
sar edx, 0xd
mov ecx, edx
add ebx, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0xa0576
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
mov eax, 0x331da7cd
imul esi
sar edx, 0x11
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
lea ecx, [esp + 0x9c]
push ecx
push edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0xa4], 0x128
mov dword [str._r_____r____], eax
mov dword [esp + 0x18], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40f759
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b8]
xor ecx, esp
call fcn.0042fe7d
add esp, 0x9bc
ret
mov ecx, dword [0x45cbcc]
mov esi, dword [0x45cbe8]
mov eax, 0x63b1cbb5
imul esi, esi, 0x857ee
imul ecx
mov ecx, dword [0x45cbe4]
sar edx, 0x12
imul ecx, ecx, 0x69fe2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x898dd
mov edi, eax
sub edi, esi
add edi, ecx
mov ecx, dword [0x45cbd4]
add edi, edx
mov eax, 0x662e995b
imul ecx
sar edx, 0x12
add edi, edx
mov esi, edx
mov eax, 0x331da7cd
imul ecx
shr esi, 0x1f
sar edx, 0x11
add esi, edi
mov edi, dword [str._r_____r____]
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, edi
add ecx, 0x6a03b
mov dword [0x45cbcc], ecx
xor eax, eax
mov edi, edi
mov dl, byte [esp + eax + 0xc0]
mov byte [esp + eax + 0x1c4], dl
inc eax
test dl, dl
jne 0x40f7e0
mov eax, dword [0x45cbd8]
mov esi, dword [0x45cbdc]
push ebp
lea ebp, [eax + edi]
mov eax, 0x63b1cbb5
imul ebp, ebp, 0xa0576
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov ebx, edi
imul ebx, ebx, 0xa0437
mov eax, esi
imul eax, eax, 0x898dd
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, 0x331da7cd
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
add edx, ebp
add eax, edx
mov edx, dword [0x45cbe0]
lea eax, [eax + edx - 0x69fe2]
mov dword [0x45cbd4], eax
mov eax, dword [esp + 0x9d0]
mov dword [esp + 0x1c], ebx
lea ebp, [esp + 0x1c8]
mov edi, edi
mov bl, byte [ebp]
mov dl, bl
cmp bl, byte [eax]
jne 0x40f895
test dl, dl
je 0x40f891
mov bl, byte [ebp + 1]
mov dl, bl
cmp bl, byte [eax + 1]
jne 0x40f895
add ebp, 2
add eax, 2
test dl, dl
jne 0x40f870
xor eax, eax
jmp 0x40f89a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f90e
mov edx, dword [0x45cbd0]
imul esi, esi, 0x69fe2
mov eax, dword [0x45cbe0]
lea ebx, [edx + ecx]
imul eax, eax, 0xd5e3b
imul ebx, ebx, 0xd6486
add ebx, eax
add ebx, esi
mov esi, dword [0x45cbe4]
mov eax, 0x220de0d
imul esi
sar edx, 0xd
add ebx, edx
mov ebp, edx
mov eax, 0x662e995b
imul ecx
sar edx, 0x12
mov eax, edx
shr ebp, 0x1f
shr eax, 0x1f
add eax, edx
add ebp, ebx
sub ebp, eax
mov eax, 0x331da7cd
imul esi
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov dword [0x45cbdc], ecx
mov ebx, 1
jmp 0x40f918
mov ebx, dword [esp + 0x14]
mov esi, dword [0x45cbe4]
mov edx, dword [0x45cbc8]
mov eax, dword [0x45cbd4]
mov ecx, dword [0x45cbd8]
lea ebp, [edx + eax]
mov eax, 0x98eb62a3
imul ebp, ebp, 0xa4579
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x9a8b8787
imul edi
add edx, edi
sar edx, 0x12
add ebp, edx
mov edi, edx
mov eax, 0x220de0d
imul esi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
add edi, ebp
mov ebp, dword [esp + 0x1c]
sub edi, eax
mov eax, 0x331da7cd
imul ecx
mov eax, dword [esp + 0x18]
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0xa0]
sub edi, ecx
push edx
add edi, ebp
push eax
mov dword [0x45cbe4], edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40fb4c
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea edi, [esp + eax + 0x1c8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edi
jmp 0x40f9d2
mov edi, dword [esp + 0x10]
mov esi, dword [0x45cbd0]
mov eax, 0x99335f19
imul esi
add edx, esi
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0x69fe2
add ecx, edx
mov eax, 0x4d49d1e9
imul esi
sar edx, 0x11
add ecx, edx
mov ebp, edx
mov eax, 0x3b8e0831
imul esi
mov eax, dword [0x45cbe0]
imul eax, eax, 0x50c98
sar edx, 0x11
shr ebp, 0x1f
add ebp, ecx
mov ecx, edx
add ebp, edx
shr ecx, 0x1f
add ecx, ebp
sub ecx, eax
mov eax, 0x662e995b
imul dword [0x45cbe4]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x45cbc8], ecx
lea eax, [esp + 0xc4]
mov dl, byte [eax]
mov byte [edi + eax], dl
inc eax
test dl, dl
jne 0x40fa50
mov ebp, dword [esp + 0x9d0]
mov edi, dword [esp + 0x14]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40fa8a
test al, al
je 0x40fa86
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40fa8a
add edi, 2
add ebp, 2
test al, al
jne 0x40fa65
xor eax, eax
jmp 0x40fa8f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fb32
mov edi, dword [0x45cbe8]
imul ecx, ecx, 0xa0576
mov eax, 0x9a8b8787
imul edi, edi, 0x857ee
imul esi
add edx, esi
mov esi, dword [0x45cbd8]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x4d49d1e9
imul esi
imul esi, esi, 0xf08ec
sar edx, 0x11
add edi, edx
mov ebp, edx
mov edx, dword [0x45cbdc]
mov eax, 0x220de0d
imul edx
shr ebp, 0x1f
sar edx, 0xd
add ebp, edi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
add ebp, esi
sub ebp, eax
mov eax, dword [0x45cbe4]
add ebp, ecx
mov ecx, dword [esp + 0xa8]
sub ebp, eax
mov dword [esp + ebx*4 + 0x20], ecx
mov ecx, dword [esp + 0x10]
sub ebp, 0x69fe2
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [0x45cbd0], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xa0]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40f9ce
mov esi, dword [0x45cbe8]
mov ecx, dword [0x45cbe0]
mov eax, 0x7abb0ab
imul esi
sar edx, 0xe
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x63b1cbb5
imul ecx
imul ecx, ecx, 0xa4579
sar edx, 0x12
mov ebp, edx
shr ebp, 0x1f
add edi, edx
add ebp, edi
add ebp, ecx
mov ecx, esi
imul ecx, ecx, 0x69fe2
mov eax, 0x3b8e0831
imul esi
sub ebp, ecx
mov ecx, dword [0x45cbc8]
sar edx, 0x11
imul ecx, ecx, 0xa0437
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov ecx, dword [0x45cbd4]
mov eax, 0x331da7cd
imul ecx
mov ecx, dword [esp + 0x18]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
push ecx
mov dword [0x45cbd8], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0042fe7d
add esp, 0x9bc
ret