Function at 0x40c550
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x458190]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9cc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x456824]
mov esi, eax
mov edi, dword [0x456838]
mov eax, 0x7f3171f
imul edi, edi, 0x372f5c1
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x293deaa
sub edi, eax
add edi, edx
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [0x45681c]
sar edx, 0x19
mov ebx, edx
add edi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
lea ecx, [esp + 0x9c]
add eax, edx
add ebx, edi
push ecx
sub ebx, eax
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xa4], 0x128
mov dword [str._r_____r____], ebx
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40c619
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b8]
call fcn.0042a171
add esp, 0x9bc
ret
mov ecx, dword [0x456838]
mov esi, dword [0x456830]
mov edx, ecx
imul esi, esi, 0x293deaa
imul edx, edx, 0x372f5c1
sub esi, edx
mov edx, dword [0x45681c]
mov eax, 0x13a45601
imul edx
sar edx, 0x16
add esi, edx
mov edi, edx
mov eax, 0x61bc1a5d
imul ecx
shr edi, 0x1f
sar edx, 0x19
add edi, esi
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov edi, dword [str._r_____r____]
sub ecx, edi
add ecx, 0x294039f
mov dword [0x45681c], ecx
xor eax, eax
jmp 0x40c680
mov dl, byte [esp + eax + 0xc0]
mov byte [esp + eax + 0x1c4], dl
inc eax
test dl, dl
jne 0x40c680
mov esi, dword [0x456818]
imul edi, edi, 0x53d1950
mov ebx, dword [0x456828]
push ebp
mov ebp, esi
imul ebp, ebp, 0x293deaa
mov eax, ebx
imul eax, eax, 0xde454f
add ebp, eax
mov eax, 0x13a45601
imul dword [0x45682c]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, dword [0x456830]
lea edx, [edi + ebp - 0x5305094]
mov ebp, dword [esp + 0x9d0]
mov dword [0x456824], edx
lea edi, [esp + 0x1c8]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40c715
test al, al
je 0x40c711
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40c715
add edi, 2
add ebp, 2
test al, al
jne 0x40c6f0
xor eax, eax
jmp 0x40c71a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c77a
mov edi, dword [0x456820]
mov eax, 0x7f3171f
imul edi
imul edi, edi, 0x360833b
mov eax, dword [0x456830]
imul eax, eax, 0x22d753a
sar edx, 0x15
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
add ebp, eax
mov eax, dword [0x45682c]
imul eax, eax, 0x5305094
add ebp, eax
mov eax, 0x936c7f27
imul ecx
add edx, ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, edi
mov dword [0x45682c], ebp
mov dword [esp + 0x10], 1
mov ecx, dword [0x456834]
imul esi, esi, 0x3422234
mov eax, 0x7f3171f
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x61bc1a5d
imul ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, ecx
sub esi, eax
mov eax, 0x979d1eb7
imul ebx
mov ecx, ebx
imul ecx, ecx, 0x53d1950
add edx, ebx
sar edx, 0x19
mov eax, edx
add esi, ecx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xa0]
push ecx
sub esi, eax
push edx
mov dword [0x456834], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40c967
mov eax, dword [esp + 0x10]
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea esi, [esp + eax + 0x1c8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], esi
jmp 0x40c820
mov esi, dword [esp + 0x18]
jmp 0x40c820
mov ebx, dword [0x456820]
mov ebp, dword [0x456834]
mov eax, 0x3ac7f767
imul ebx
sar edx, 0x17
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x62ace781
imul ebp
mov eax, dword [0x456818]
imul eax, eax, 0x5305094
sar edx, 0x19
mov ecx, edx
add edi, edx
shr ecx, 0x1f
add ecx, edi
add ecx, eax
mov eax, 0x936c7f27
imul ebp
add edx, ebp
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x360833b
sub ecx, eax
sub ecx, edx
mov dword [0x456818], ecx
lea eax, [esp + 0xc4]
lea ecx, [ecx]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40c890
mov edi, dword [esp + 0x9d0]
mov esi, dword [esp + 0x1c]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40c8c9
test al, al
je 0x40c8c5
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40c8c9
add esi, 2
add edi, 2
test al, al
jne 0x40c8a5
xor eax, eax
jmp 0x40c8ce
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c94d
mov edx, dword [0x45682c]
imul ecx, ecx, 0xde454f
mov esi, dword [str._r_____r____]
mov eax, 0x7f3171f
imul esi, esi, 0x4067eec
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x31a5bd5f
imul ebx
mov eax, dword [esp + 0x10]
add esi, ecx
sar edx, 0x17
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0xa8]
sub esi, ecx
mov ecx, dword [esp + 0x18]
sub esi, ebp
mov dword [esp + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
sub esi, 0x5305094
inc eax
mov dword [esp + 0x10], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [0x456820], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xa0]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40c813
mov ecx, dword [0x456838]
mov eax, 0x94723637
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x63510a67
imul ecx
imul ecx, ecx, 0x5305094
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45681c]
imul ecx, ecx, 0x3422234
add esi, ecx
mov ecx, dword [0x456824]
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [esp + 0x14]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push ecx
mov dword [0x456828], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
call fcn.0042a171
add esp, 0x9bc
ret