Function at 0x404d70
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe7c
mov eax, dword [0x458190]
mov dword [esp + 0xe78], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x456820]
mov eax, 0x18008403
imul ecx
mov ecx, dword [0x45682c]
mov esi, dword [0x456818]
imul esi, esi, 0x398f
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
mov ebx, dword [0x456834]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x107f4
sub esi, ecx
add esi, edx
sub esi, ebx
push 0
sub esi, 0x1558c
push 2
mov dword [0x456820], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45681c]
mov edi, dword [0x456838]
mov ebp, eax
imul edi, edi, 0xe0dd
mov esi, dword [0x456824]
mov eax, 0x49f9945f
imul ecx
sar edx, 0xe
mov eax, edx
mov ebx, dword [0x456830]
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x302debc5
imul esi
sar edx, 0xe
add edi, edx
mov ecx, edx
mov edx, ebx
imul edx, edx, 0xa8da
shr ecx, 0x1f
add ecx, edi
add ecx, edx
mov eax, 0x3e12562b
imul esi
mov esi, dword [0x45682c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x99b19d5b
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x15410
imul edx, edx, 0x398f
xor edi, edi
sub ecx, eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0xe0], 0x128
add edx, ebx
mov eax, dword [0x456818]
imul eax, eax, 0xa8da
add edx, ecx
lea ecx, [eax + edx - 0x1558c]
lea edx, [esp + 0xe0]
push edx
push ebp
mov dword [0x456824], ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x404ede
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe78]
call fcn.0042a141
add esp, 0xe7c
ret
mov ecx, dword [0x456834]
mov esi, dword [0x456830]
mov eax, 0x2ff8513b
imul esi, esi, 0xdd7b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x1558c
mov ebx, eax
sub ebx, esi
add ebx, edx
mov eax, 0x47298a5
imul ecx
mov ecx, dword [0x456820]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x395bd985
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
mov dword [0x456818], ecx
xor eax, eax
jmp 0x404f50
mov cl, byte [esp + eax + 0x104]
mov byte [esp + eax + 0x208], cl
inc eax
test cl, cl
jne 0x404f50
mov ecx, dword [0x456838]
mov eax, 0x246e57b5
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, dword [0x45681c]
imul eax, eax, 0xd534
mov edx, ecx
imul edx, edx, 0x1558c
sub esi, edx
mov edx, dword [0x456824]
add esi, eax
mov eax, 0x302debc5
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61082f49
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0xe90]
push edx
lea eax, [esp + 0x20c]
sub esi, ecx
push eax
mov dword [0x456828], esi
call fcn.00434bbe
mov ecx, dword [0x456830]
add esp, 8
test eax, eax
jne 0x405046
mov esi, dword [0x45681c]
mov edi, dword [0x456838]
mov eax, 0x99b19d5b
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov ebx, edi
mov eax, 0x302debc5
imul ebx, ebx, 0xe0dd
imul edi
sar edx, 0xe
sub esi, ebx
add esi, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0xa8da
shr eax, 0x1f
add eax, esi
mov esi, dword [str._r_____r____]
add eax, edx
sub eax, esi
add eax, 0xaaa7
mov dword [0x45681c], eax
mov edi, 1
mov esi, dword [0x456834]
imul ecx, ecx, 0xdd7b
mov eax, 0x2ff8513b
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x456818]
mov eax, 0x47298a5
imul ecx, ecx, 0x1558c
imul esi
sar edx, 8
mov eax, edx
add ebx, ecx
mov ecx, dword [0x456820]
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x395bd985
imul ecx
sar edx, 0xd
mov ecx, edx
add ebx, edx
lea edx, [esp + 0xe0]
shr ecx, 0x1f
push edx
add ecx, ebx
push ebp
mov dword [0x456818], ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4051fb
mov eax, edi
shl eax, 6
lea ecx, [esp + 0x104]
lea ebx, [esp + eax + 0x208]
sub eax, ecx
lea edx, [esp + eax + 0x208]
mov dword [esp + 0x10], edx
jmp 0x4050e3
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x104]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4050f0
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x302debc5
imul esi
mov ebp, esi
imul ebp, ebp, 0xe0dd
sar edx, 0xe
sub ecx, ebp
mov eax, edx
add ecx, edx
mov edx, dword [str._r_____r____]
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0xa8da
add eax, ecx
sub eax, edx
mov edx, dword [esp + 0xe90]
push edx
add eax, 0xaaa7
push ebx
mov dword [0x45681c], eax
call fcn.00434bbe
add esp, 8
test eax, eax
jne 0x4051e1
mov ecx, dword [0x456820]
mov eax, dword [0x45682c]
mov edx, dword [0x45681c]
imul eax, eax, 0x1558c
mov esi, ecx
imul esi, esi, 0xdd7b
add esi, eax
mov eax, 0x47298a5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub esi, eax
add esi, edx
mov eax, 0x3e12562b
imul ecx
mov ecx, dword [esp + 0xe8]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x45682c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + edi*4 + 0x18], ecx
inc edi
add ebx, 0x40
add eax, 0x40
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0xe0]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4050df
mov eax, dword [0x45682c]
mov esi, dword [0x456824]
imul eax, eax, 0x1558c
mov ecx, dword [0x45681c]
imul esi, esi, 0xffffc9ca
sub esi, eax
mov eax, 0x18008403
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456828]
imul edx, edx, 0x8ed2
sub esi, ecx
add esi, edx
push ebp
mov dword [0x456830], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe88]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.0042a141
add esp, 0xe7c
ret