Function at 0x40bbc0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9b8
mov eax, dword [0x456fc0]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [0x4556a8]
mov ecx, dword [0x45569c]
imul edi, edi, 0xcecf4
mov esi, eax
mov eax, dword [0x45568c]
imul eax, eax, 0x6e7be
add edi, eax
mov eax, 0x948af151
imul ecx
add edx, ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x455694]
mov eax, 0x3b1784cb
imul ecx
mov ecx, dword [0x455690]
sar edx, 0x11
mov ebx, edx
add edi, edx
mov eax, 0xcccc28f7
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
lea ecx, [esp + 0x98]
add eax, edx
add ebx, edi
push ecx
sub ebx, eax
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xa0], 0x128
mov dword [str._r_____r____], ebx
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40bc90
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b4]
call fcn.0042909d
add esp, 0x9b8
ret
mov edx, dword [0x4556a8]
mov esi, dword [0x4556a0]
imul edx, edx, 0xcecf4
mov ecx, dword [0x45568c]
imul esi, esi, 0x6e7be
mov edi, dword [0x455690]
sub esi, edx
mov eax, 0x30f1b28f
imul ecx
sar edx, 0x10
add esi, edx
mov ebx, edx
mov eax, 0x3b1784cb
imul edi
sar edx, 0x11
shr ebx, 0x1f
add ebx, esi
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
mov edx, dword [0x455694]
add ecx, ebx
sub ecx, edx
add ecx, 0xbae2b
mov dword [0x45568c], ecx
xor eax, eax
jmp 0x40bd00
mov dl, byte [esp + eax + 0xbc]
mov byte [esp + eax + 0x1c0], dl
inc eax
test dl, dl
jne 0x40bd00
mov ebx, dword [0x455698]
mov esi, dword [0x45569c]
imul ebx, ebx, 0x5715a
mov eax, ecx
imul eax, eax, 0x6e7be
add ebx, eax
mov eax, 0x30f1b28f
imul esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x8aa1b
sub ebx, eax
add ebx, dword [0x4556a4]
lea eax, [edx + ebx - 0x205c4]
push ebp
mov dword [0x455694], eax
mov eax, dword [esp + 0x9cc]
lea ebp, [esp + 0x1c4]
nop
mov bl, byte [ebp]
mov dl, bl
cmp bl, byte [eax]
jne 0x40bd95
test dl, dl
je 0x40bd91
mov bl, byte [ebp + 1]
mov dl, bl
cmp bl, byte [eax + 1]
jne 0x40bd95
add ebp, 2
add eax, 2
test dl, dl
jne 0x40bd70
xor eax, eax
jmp 0x40bd9a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40bdf3
mov esi, dword [0x455694]
imul edi, edi, 0xdc98b
mov eax, 0x1784740b
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, esi
mov edx, ecx
imul eax, eax, 0x205c4
imul edx, edx, 0x8a933
add edi, edx
add edi, eax
mov eax, 0xcccc28f7
imul esi
add edx, esi
sar edx, 0x13
mov esi, edx
shr esi, 0x1f
add edi, edx
add esi, edi
mov dword [0x45569c], esi
mov ebx, 1
jmp 0x40bdf7
mov ebx, dword [esp + 0x10]
mov edi, dword [0x455688]
mov eax, 0x948af151
imul edi, edi, 0x53aff
imul esi
add edx, esi
imul esi, esi, 0x8aa1b
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3b1784cb
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add edi, esi
sub edi, ecx
mov ecx, dword [0x4556a4]
mov eax, 0xcccc28f7
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x9c]
push ecx
sub edi, eax
push edx
mov dword [0x4556a4], edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40bfe5
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1c4]
lea edx, [esp + 0xc0]
sub eax, edx
lea esi, [esp + eax + 0x1c4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
jmp 0x40bea0
mov esi, dword [esp + 0x10]
jmp 0x40bea0
mov ecx, dword [0x4556a4]
mov ebp, dword [0x45569c]
mov eax, 0x1784740b
imul ecx
mov ecx, dword [0x4556a0]
imul ecx, ecx, 0xfff23675
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x3b1db3af
imul ebp
mov edi, dword [str._r_____r____]
sar edx, 0x11
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x455690]
imul ecx, ecx, 0x205c4
sub eax, ecx
mov ecx, dword [0x455688]
add eax, edi
add ecx, eax
mov dword [0x455688], ecx
lea eax, [esp + 0xc0]
lea esp, [esp]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40bf10
mov edi, dword [esp + 0x9cc]
mov esi, dword [esp + 0x18]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40bf49
test al, al
je 0x40bf45
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40bf49
add esi, 2
add edi, 2
test al, al
jne 0x40bf25
xor eax, eax
jmp 0x40bf4e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40bfcb
mov eax, 0x57ab2ce3
imul ecx, ecx, 0x5715a
imul dword [0x455690]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a8]
imul edx, edx, 0xa0008
sub ecx, eax
add ecx, edx
mov eax, 0xcccc28f7
imul ebp
add edx, ebp
mov ebp, dword [0x4556a0]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
sub ecx, eax
sub ecx, ebp
sub ecx, 0x205c4
mov dword [0x455690], ecx
mov ecx, dword [esp + 0xa4]
mov dword [esp + ebx*4 + 0x1c], ecx
mov ecx, dword [esp + 0x10]
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x9c]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40be94
mov ecx, dword [0x455698]
mov eax, 0x9e71fdc9
imul ecx
add edx, ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x4556a8]
mov eax, 0x944b09c1
imul ecx
add edx, ecx
imul ecx, ecx, 0x205c4
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a0]
imul edx, edx, 0x53aff
sub esi, eax
add esi, edx
mov edx, dword [0x455694]
mov eax, 0x3b1784cb
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [esp + 0x14]
push ecx
mov dword [0x455698], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c4]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0042909d
add esp, 0x9b8
ret