Function at 0x40fb80
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x45f540]
xor eax, esp
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45dbd4]
mov esi, eax
mov eax, 0x771da23
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x77668d35
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45dbcc]
mov eax, 0x77668d35
imul ecx
sar edx, 0xc
mov ebx, edx
add edi, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x2214
mov eax, ecx
imul eax, eax, 0x2179
shr ebx, 0x1f
add ebx, edi
add ebx, edx
add ebx, eax
mov eax, 0x98742075
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbdc]
imul edx, edx, 0x147d
lea eax, [esp + 0xa0]
sub ebx, ecx
push eax
add ebx, edx
push esi
mov dword [esp + 0x24], esi
mov dword [esp + 0xa8], 0x128
mov dword [str._r_____r____], ebx
mov dword [esp + 0x20], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40fc6c
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9bc]
xor ecx, esp
call fcn.0043045d
add esp, 0x9c0
ret
mov ecx, dword [0x45dbd4]
mov eax, 0x771da23
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
mov esi, eax
imul edx, edx, 0x2214
mov eax, dword [0x45dbe0]
imul eax, eax, 0x2179
sub esi, edx
add esi, eax
mov eax, 0xc7eb4e25
imul ecx
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 0xc
add esi, edx
mov edi, edx
mov eax, 0x49e7e4dd
imul ecx
shr edi, 0x1f
sar edx, 0xa
add edi, esi
add edi, edx
mov ecx, edx
mov edx, dword [0x45dbe4]
imul edx, edx, 0x4de
shr ecx, 0x1f
add ecx, edi
mov edi, dword [str._r_____r____]
add ecx, edx
sub ecx, edi
add ecx, 0x1cbc
mov dword [0x45dbcc], ecx
xor eax, eax
jmp 0x40fd00
mov dl, byte [esp + eax + 0xc4]
mov byte [esp + eax + 0x1c8], dl
inc eax
test dl, dl
jne 0x40fd00
mov eax, dword [0x45dbd8]
mov esi, dword [0x45dbdc]
lea ebx, [eax + edi]
mov eax, 0x771da23
imul ebx, ebx, 0x147d
imul esi
sar edx, 8
add ebx, edx
mov eax, edx
shr eax, 0x1f
mov edx, esi
imul edx, edx, 0x2179
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x49e7e4dd
imul esi
push ebp
sar edx, 0xa
mov ebp, edi
imul ebp, ebp, 0x2263
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe0]
sub ebx, eax
add ebx, ebp
lea eax, [ebx + edx - 0x4de]
mov edx, dword [esp + 0x9d4]
mov dword [0x45dbd4], eax
mov dword [esp + 0x14], edx
lea eax, [esp + 0x1cc]
jmp 0x40fd90
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x40fdc0
test dl, dl
je 0x40fdbc
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x40fdc0
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x40fd90
xor eax, eax
jmp 0x40fdc5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fe45
mov eax, dword [0x45dbd0]
imul esi, esi, 0x4de
lea ebx, [eax + ecx]
imul ebx, ebx, 0x1ade
mov eax, 0x771da23
imul dword [0x45dbe4]
sar edx, 8
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, 0x77668d35
imul dword [0x45dbe4]
mov eax, dword [esp + 0x18]
sar edx, 0xc
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0xc7eb4e25
imul ecx
mov eax, dword [0x45dbe0]
add edx, ecx
imul eax, eax, 0xdf5
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
add ebx, eax
add ebx, esi
mov dword [0x45dbdc], ebx
mov dword [esp + 0x1c], 1
mov edx, dword [0x45dbc8]
mov eax, dword [0x45dbd4]
mov ecx, dword [0x45dbd8]
lea esi, [edx + eax]
mov eax, 0x771da23
imul esi, esi, 0xddb
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x77668d35
imul dword [0x45dbe4]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x8e8c0a95
imul edi
add edx, edi
sar edx, 0xc
mov edi, edx
add esi, edx
mov eax, 0x98742075
imul ecx
mov eax, dword [esp + 0x20]
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr edi, 0x1f
shr ecx, 0x1f
add ecx, edx
add edi, esi
lea edx, [esp + 0xa4]
sub edi, ecx
push edx
add edi, ebp
push eax
mov dword [0x45dbe4], edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x41008c
mov eax, dword [esp + 0x1c]
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea edi, [esp + eax + 0x1cc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
jmp 0x40ff01
mov edi, dword [esp + 0x18]
mov esi, dword [0x45dbd0]
mov ebx, dword [0x45dbe4]
mov eax, 0x3d2f2c3f
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xc7eb4e25
imul ebx
add edx, ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x92bc6f7d
imul esi
add edx, esi
sar edx, 0xb
add ecx, edx
mov ebp, edx
mov edx, dword [0x45dbc8]
shr ebp, 0x1f
imul edx, edx, 0x4de
add ebp, ecx
mov ecx, dword [0x45dbe0]
imul ecx, ecx, 0x736
add ebp, ecx
add ebp, edx
mov eax, 0x6931b881
imul esi
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov dword [0x45dbc8], ecx
lea eax, [esp + 0xc8]
mov dl, byte [eax]
mov byte [edi + eax], dl
inc eax
test dl, dl
jne 0x40ff86
mov ebp, dword [esp + 0x9d4]
mov edi, dword [esp + 0x14]
jmp 0x40ffa0
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40ffc5
test al, al
je 0x40ffc1
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40ffc5
add edi, 2
add ebp, 2
test al, al
jne 0x40ffa0
xor eax, eax
jmp 0x40ffca
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410072
mov edx, dword [0x45dbdc]
imul ecx, ecx, 0x147d
mov edi, dword [0x45dbd8]
mov eax, 0x77668d35
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x2214
mov ebp, edi
imul ebp, ebp, 0x224e
sub ebp, eax
add ebp, edx
mov eax, 0x8e8c0a95
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x6931b881
imul edi
mov eax, dword [esp + 0x1c]
add ebp, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
mov edx, dword [esp + 0xac]
add ecx, ebp
sub ecx, ebx
sub ecx, 0x4de
mov dword [esp + eax*4 + 0x24], edx
mov edx, dword [esp + 0x14]
inc eax
mov dword [0x45dbd0], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xa4]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40fefd
mov ecx, dword [0x45dbd4]
mov esi, dword [0x45dbc8]
mov eax, 0x771da23
imul esi, esi, 0x2263
imul ecx
mov ecx, dword [0x45dbe8]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1e0c7127
imul ecx
sar edx, 0xa
add esi, edx
mov edi, edx
mov eax, 0x3d2f2c3f
imul ecx
imul ecx, ecx, 0x4de
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45dbe0]
sub edi, eax
mov eax, 0x49e7e4dd
imul esi
imul esi, esi, 0xddb
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x20]
push ecx
mov dword [0x45dbd8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9cc]
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043045d
add esp, 0x9c0
ret