Function at 0x40c660
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x458190]
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x456824]
mov esi, eax
mov eax, 0xbdd265f5
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45681c]
mov edi, eax
mov eax, 0x5f7fac71
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x1525
sub edi, eax
add edi, edx
mov eax, 0x61e35267
imul ecx
mov ecx, dword [0x456838]
sar edx, 0xb
imul ecx, ecx, 0x58f
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [esp + 0x98]
sub edi, eax
push edx
add edi, ecx
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0xa0], 0x128
mov dword [str._r_____r____], edi
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40c729
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x9b8]
call fcn.0042a321
add esp, 0x9bc
ret
mov esi, dword [0x456838]
mov ecx, dword [0x45681c]
mov eax, 0xbdd265f5
imul esi
add edx, esi
imul esi, esi, 0x58f
sar edx, 0xc
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov edi, dword [0x456830]
mov eax, edi
imul eax, eax, 0x1525
add ecx, eax
mov eax, dword [str._r_____r____]
sub ecx, esi
sub ecx, eax
add ecx, 0x1126
mov dword [0x45681c], ecx
xor esi, esi
lea ebx, [ebx]
mov dl, byte [esp + esi + 0xbc]
mov byte [esp + esi + 0x1c0], dl
inc esi
test dl, dl
jne 0x40c790
imul eax, eax, 0x1594
push ebx
mov ebx, dword [0x456828]
mov esi, ebx
imul esi, esi, 0x1ec0
add esi, eax
push ebp
mov ebp, dword [0x45682c]
mov eax, 0xc152500d
imul ebp
add edx, ebp
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x1525
sub esi, eax
add esi, edi
mov edi, dword [esp + 0x9d0]
lea eax, [edx + esi - 0x11cf]
mov dword [0x456824], eax
lea esi, [esp + 0x1c8]
mov edi, edi
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40c824
test al, al
je 0x40c820
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40c824
add esi, 2
add edi, 2
test al, al
jne 0x40c800
xor eax, eax
jmp 0x40c829
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c884
mov eax, 0x214d0215
imul ebp, ebp, 0x11cf
imul ecx
mov ecx, dword [0x456820]
mov esi, ecx
imul esi, esi, 0x1572
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61e35267
imul ecx
mov eax, dword [0x456830]
sar edx, 0xb
imul eax, eax, 0xcde
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
add ecx, ebp
add ecx, eax
mov dword [0x45682c], ecx
mov dword [esp + 0x10], 1
mov eax, 0xbdd265f5
imul ebx
add edx, ebx
sar edx, 0xc
mov esi, ebx
imul esi, esi, 0x1594
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5f7fac71
imul ebx
mov eax, dword [0x456818]
imul eax, eax, 0x1530
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x456834]
add esi, eax
mov eax, 0x61e35267
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xa0]
push ecx
sub esi, eax
push edx
mov dword [0x456834], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40ca77
mov eax, dword [esp + 0x10]
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea esi, [esp + eax + 0x1c8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], esi
jmp 0x40c930
mov esi, dword [esp + 0x18]
jmp 0x40c930
mov ebp, dword [0x456834]
mov ecx, dword [0x456830]
mov eax, 0x214d0215
imul ecx, ecx, 0xffffea8e
imul ebp
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov ebx, dword [0x456820]
mov eax, 0xe6005641
imul ebp
add edx, ebp
sar edx, 0xc
add ecx, edx
mov edi, edx
mov edx, dword [0x456818]
imul edx, edx, 0x11cf
shr edi, 0x1f
add edi, ecx
add edi, edx
mov eax, 0x4f950fb3
imul ebx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov dword [0x456818], ecx
lea eax, [esp + 0xc4]
mov edi, edi
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40c9a0
mov edi, dword [esp + 0x9d0]
mov esi, dword [esp + 0x1c]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40c9d9
test al, al
je 0x40c9d5
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40c9d9
add esi, 2
add edi, 2
test al, al
jne 0x40c9b5
xor eax, eax
jmp 0x40c9de
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ca5d
mov edx, dword [0x45682c]
imul ecx, ecx, 0x1ec0
mov eax, 0x61e35267
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x14ec
sub ecx, eax
add ecx, edx
mov eax, 0x776d83ad
imul ebx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x1c]
sub ecx, eax
mov eax, dword [esp + 0x10]
sub ecx, ebp
sub ecx, 0x11cf
mov dword [0x456820], ecx
mov ecx, dword [esp + 0xa8]
mov dword [esp + eax*4 + 0x20], ecx
mov ecx, dword [esp + 0x18]
inc eax
mov dword [esp + 0x10], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xa0]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40c922
mov ecx, dword [0x456824]
mov eax, 0xbdd265f5
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x456838]
mov eax, 0x9f248ed3
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45681c]
mov edi, eax
imul edx, edx, 0x1530
mov eax, ecx
imul eax, eax, 0x11cf
sub edi, esi
add edi, edx
sub edi, eax
mov eax, 0xb838211b
imul ecx
add edx, ecx
sar edx, 0xa
mov ecx, edx
add edi, edx
mov edx, dword [esp + 0x14]
shr ecx, 0x1f
add ecx, edi
push edx
mov dword [0x456828], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
call fcn.0042a321
add esp, 0x9bc
ret