Function at 0x40afb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x457190]
mov ecx, dword [0x45581c]
mov dword [esp + 0x938], eax
mov eax, 0x51eb851f
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
push esi
mov esi, eax
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
mov edi, eax
mov eax, 0x4bda12f7
imul ecx
mov eax, dword [0x455830]
sar edx, 4
imul eax, eax, 0x35
sub edi, esi
add edi, edx
mov ecx, edx
mov edx, dword [0x455838]
imul edx, edx, 0xd
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add ecx, eax
mov dword [str._r_____r____], ecx
mov byte [esp + 0x140], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
push ecx
stosw word es:[edi], ax
lea edx, [esp + 0x144]
push 0x445fbc
push edx
stosb byte es:[edi], al
call fcn.00429011
mov ecx, dword [0x455834]
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x78787879
imul dword [0x455820]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x5397829d
imul ecx
sar edx, 4
sub edi, esi
mov esi, dword [0x455830]
add edi, edx
mov ecx, edx
mov edx, dword [0x455818]
imul edx, edx, 0x31
mov eax, esi
imul eax, eax, 0x32
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add esp, 0xc
sub ecx, eax
mov edi, dword [0x455838]
imul esi, esi, 0x35
mov eax, 0x4bda12f7
imul edi
imul edi, edi, 0xd
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45581c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, edi
mov edi, dword [0x45582c]
add eax, esi
mov esi, dword [str._r_____r____]
sub eax, esi
imul esi, esi, 0x38
add eax, 0x28
mov dword [0x45581c], eax
mov eax, 0x92492493
imul edi
add edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x99999999
imul dword [0x455820]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x455818], ecx
sub eax, edi
mov edi, dword [0x455834]
lea ecx, [ecx + ecx*8]
lea edx, [eax + ecx*8]
add edx, esi
sub edx, edi
push 0
sub edx, 0x31
push 2
mov dword [esp + 0x1c], 0
mov dword [0x455820], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x40b1e3
mov eax, dword [0x455828]
mov ecx, dword [0x45582c]
lea eax, [eax + eax*8]
shl eax, 3
mov esi, eax
mov ebx, dword [0x455830]
mov eax, 0x4bda12f7
imul ecx
mov eax, dword [str._r_____r____]
sar edx, 4
imul eax, eax, 0x36
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455818]
imul edx, edx, 0x35
sub esi, ecx
add edx, ebx
add edx, esi
lea ecx, [eax + edx - 0x31]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x455824], ecx
call fcn.00429b36
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.00428e41
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x455838]
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45581c]
mov esi, ecx
imul edx, edx, 0x36
imul esi, esi, 0xffffffcf
sub esi, eax
add esi, edx
mov edx, dword [0x455824]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov ecx, edx
add esi, edx
lea edx, [esp + 0x18]
shr ecx, 0x1f
push edx
add ecx, esi
push edi
mov dword [0x455828], ecx
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40b2d0
mov ecx, dword [0x455820]
mov esi, dword [0x45582c]
mov eax, 0x92492493
imul esi, esi, 0x31
imul ecx
add edx, ecx
imul ecx, ecx, 0x32
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add esi, edx
add ebx, esi
add ebx, ecx
mov ecx, dword [0x45581c]
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x455830]
sar edx, 4
imul ecx, ecx, 0x22
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
push edi
mov dword [0x45582c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.00428e41
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x455828]
mov edx, dword [0x45582c]
imul esi, esi, 0x22
mov ecx, dword [0x45581c]
imul edx, edx, 0x31
sub esi, edx
mov eax, 0x66666667
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
imul ecx, ecx, 0x1b
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
add esi, ecx
push eax
mov dword [0x455830], esi
call fcn.004338be
add esp, 8
test eax, eax
mov eax, 0x4bda12f7
je 0x40b66b
mov ecx, dword [0x45582c]
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455834]
imul edx, edx, 0x31
mov ebx, dword [0x455820]
mov esi, ecx
mov ecx, dword [str._r_____r____]
sub esi, edx
mov eax, 0x78787879
imul ecx
mov ecx, dword [esp + 0x20]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push ecx
sub esi, eax
push 0
sub esi, ebx
push 0x1f0fff
mov dword [0x455838], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45581c]
mov esi, eax
mov eax, 0x51eb851f
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov ebx, eax
mov eax, 0x4bda12f7
imul ecx
mov ecx, dword [0x455838]
imul ecx, ecx, 0xd
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
mov ecx, dword [0x455830]
mov edx, ecx
imul edx, edx, 0x35
add eax, edx
test esi, esi
mov dword [str._r_____r____], eax
jne 0x40b403
push 0x445f88
call fcn.00429b36
add esp, 4
jmp 0x40b480
mov eax, 0x38e38e39
imul ecx, ecx, 0x32
imul dword [0x455834]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455820]
mov ebx, eax
mov eax, 0x78787879
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov ebx, eax
mov eax, 0x5397829d
imul dword [0x455834]
sar edx, 4
mov eax, edx
add ebx, edx
mov edx, dword [0x455818]
imul edx, edx, 0x31
shr eax, 0x1f
add eax, ebx
add eax, edx
sub eax, ecx
push esi
mov dword [0x455818], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40b479
push 0x445f74
call fcn.00429b36
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x455838]
mov eax, 0x4bda12f7
imul ecx
imul ecx, ecx, 0xd
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45581c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
mov ecx, dword [0x455830]
imul ecx, ecx, 0x35
add eax, ecx
mov ecx, dword [str._r_____r____]
lea edx, [esp + 0x18]
sub eax, ecx
push edx
add eax, 0x28
push edi
mov dword [0x45581c], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40b2d0
mov ebx, dword [0x455818]
mov ecx, dword [0x455834]
mov esi, dword [0x45582c]
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455820]
mov esi, eax
mov eax, 0x99999999
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
lea edx, [ebx + ebx*8]
lea eax, [eax + edx*8]
mov edx, dword [str._r_____r____]
imul edx, edx, 0x38
add eax, edx
sub eax, ecx
sub eax, 0x31
push edi
mov dword [0x455820], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40b1ce
mov eax, dword [0x455828]
mov ecx, dword [0x45582c]
lea eax, [eax + eax*8]
shl eax, 3
mov esi, eax
mov eax, 0x4bda12f7
imul ecx
mov eax, dword [0x455830]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455818]
imul edx, edx, 0x35
add edx, eax
mov eax, dword [str._r_____r____]
imul eax, eax, 0x36
sub esi, ecx
add edx, esi
lea ecx, [eax + edx - 0x31]
mov edx, dword [esp + 0x20]
push edx
push 0
push 0x1f0fff
mov dword [0x455824], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x455824]
mov edi, eax
mov eax, 0x4bda12f7
imul esi
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x51eb851f
imul dword [0x45581c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x6db6db6d
imul esi
sub edx, esi
mov esi, dword [0x455838]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov ebx, dword [0x455830]
mov edx, esi
imul ebx, ebx, 0x35
imul edx, edx, 0xd
add edx, ecx
add edx, eax
add ebx, edx
test edi, edi
mov dword [str._r_____r____], ebx
je 0x40b1ce
mov eax, 0x4d4873ed
imul esi
mov ebx, esi
imul ebx, ebx, 0xffffffcf
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x45581c]
imul eax, eax, 0x36
add ebx, eax
mov eax, 0x4ec4ec4f
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, ecx
mov ecx, dword [esp + 0x944]
mov dword [0x455828], eax
mov eax, edi
call fcn.00428e41
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x455828]
mov ebx, dword [0x455818]
imul esi
sar edx, 4
lea ecx, [esi + ebx]
imul ecx, ecx, 0x36
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x51eb851f
imul esi
mov esi, dword [0x455834]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
sub ecx, eax
mov dword [0x455834], ecx
mov dword [esp + 0x14], edx
jmp 0x40b4ef