Function at 0x403ab0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x452944]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9cc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x4518e8]
mov edi, dword [0x4518f4]
mov ebx, dword [0x4518d8]
imul edi, edi, 0x62fe
mov esi, eax
mov eax, 0x58fba7b7
imul ecx
mov ecx, dword [0x4518dc]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
lea eax, [esp + 0x9c]
sub edi, ebx
push eax
lea edx, [edi + ecx + 0xd46b]
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0xa4], 0x128
mov dword [str._r_____r_____n], edx
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x403b52
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b8]
call fcn.00424991
add esp, 0x9bc
ret
mov ecx, dword [0x4518f4]
mov esi, dword [0x4518ec]
imul ecx, ecx, 0x62fe
push ebp
imul esi, esi, 0xd4a0
mov ebp, dword [0x4518dc]
mov eax, 0x7225d683
imul ebp
sub esi, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add esi, edx
mov edx, dword [0x4518e0]
add ecx, esi
sub ecx, edx
add ecx, 0x131b4
mov dword [0x4518d8], ecx
xor eax, eax
lea esp, [esp]
mov dl, byte [esp + eax + 0xc4]
mov byte [esp + eax + 0x1c8], dl
inc eax
test dl, dl
jne 0x403ba0
mov ebx, dword [0x4518e8]
mov eax, 0x9a5307c5
imul ebx
mov edi, dword [esp + 0x9d0]
add edx, ebx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
mov esi, ecx
imul edx, edx, 0x33af
imul esi, esi, 0xd4a0
sub esi, eax
add esi, dword [0x4518f0]
lea eax, [edx + esi + 0xc49d]
mov dword [0x4518e0], eax
lea esi, [esp + 0x1c8]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x403c26
test al, al
je 0x403c22
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x403c26
add esi, 2
add edi, 2
test al, al
jne 0x403c02
xor eax, eax
jmp 0x403c2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403c6e
mov eax, dword [0x4518e0]
imul ebp, ebp, 0x5c10
imul eax, eax, 0x5a75
add ebp, eax
mov eax, ecx
imul eax, eax, 0xbb8d
sub ebp, eax
mov eax, 0x27a02fad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov ebx, ebp
mov dword [0x4518e8], ebx
mov edi, 1
jmp 0x403c72
mov edi, dword [esp + 0x10]
mov esi, dword [0x4518d4]
imul ebx, ebx, 0x11f11
mov eax, 0xe4218e9
imul esi, esi, 0xd455
imul dword [0x4518f0]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
sub esi, eax
add esi, ebx
sub esi, ecx
lea ecx, [esp + 0xa0]
push ecx
add esi, 0xc301
push edx
mov dword [0x4518f0], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x403e1d
mov eax, edi
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea esi, [esp + eax + 0x1c8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
jmp 0x403cf0
mov esi, dword [esp + 0x10]
nop
mov ebx, dword [0x4518e8]
mov ebp, dword [0x4518ec]
mov eax, 0xd45237bd
imul ebx
mov ecx, ebp
imul ecx, ecx, 0x5c10
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x4518f0]
mov dword [esp + 0x1c], eax
mov eax, 0x27a02fad
imul ecx
mov eax, dword [esp + 0x1c]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518d4]
sub eax, ecx
add eax, dword [str._r_____r_____n]
lea eax, [edx + eax - 0x5a74]
mov dword [0x4518d4], eax
lea eax, [esp + 0xc4]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x403d57
mov esi, dword [esp + 0x9d0]
mov eax, dword [esp + 0x14]
lea esp, [esp]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403d94
test cl, cl
je 0x403d90
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403d94
add eax, 2
add esi, 2
test cl, cl
jne 0x403d70
xor eax, eax
jmp 0x403d99
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403e03
mov ecx, dword [0x4518dc]
mov eax, 0x57bc6617
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xf1bde717
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x4518f4]
sub eax, ebp
lea edx, [eax + ecx - 0x5a6f]
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0x10]
mov dword [0x4518dc], edx
mov edx, dword [esp + 0x14]
mov dword [esp + edi*4 + 0x20], eax
mov eax, 0x40
add edx, eax
inc edi
add ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xa0]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403ceb
mov ecx, dword [0x4518e4]
mov eax, 0xa5820cf9
imul ecx
add edx, ecx
mov ecx, dword [0x4518f4]
sar edx, 0xe
imul ecx, ecx, 0x5a75
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x4518e0]
mov eax, 0x7225d683
imul ecx
mov ecx, dword [esp + 0x18]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, 0x1f366
push ecx
mov dword [0x4518e4], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.00424991
add esp, 0x9bc
ret