Function at 0x40ad10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x457000]
mov dword [esp + 0x938], eax
push ebx
push esi
push edi
mov ecx, dword [0x45569c]
mov eax, 0x73b2d479
imul ecx
mov ecx, dword [0x455690]
mov esi, dword [0x4556a8]
sar edx, 0xc
imul esi, esi, 0x212c
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x27e98ca1
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x455694]
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [0x45568c]
imul ecx, ecx, 0x11be
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [ebp + 8]
add eax, esi
add eax, ecx
mov dword [str._r_____r____], eax
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x144]
push 0x445f8c
push eax
call fcn.00429b6a
mov edi, dword [0x4556a0]
mov eax, 0x5d929e5d
imul dword [0x45569c]
sar edx, 0xb
mov ecx, edi
imul ecx, ecx, 0x2367
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x4556a4]
mov eax, 0x48dbb693
imul ecx
mov esi, dword [str._r_____r____]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455690]
mov eax, edx
imul eax, eax, 0x544
sub ebx, ecx
mov ecx, dword [0x4556a8]
sub ebx, eax
add ebx, esi
mov esi, dword [0x455688]
add esi, ebx
mov ebx, ecx
add esp, 0xc
imul ebx, ebx, 0x212c
mov dword [0x455688], esi
mov eax, 0x5d0a95d5
imul edx
imul ecx, ecx, 0x19a8
imul esi, esi, 0xe0e
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov edx, edi
imul edx, edx, 0x11be
add eax, edx
mov edx, dword [0x45568c]
mov ebx, eax
mov eax, 0x4b438bdf
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, dword [0x455694]
add eax, 0x1e03
mov dword [0x45568c], eax
mov eax, 0x443d7153
imul dword [0x455690]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x27e98ca1
imul dword [0x45569c]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
sub ecx, edi
push 0
sub ecx, 0x544
push 2
mov dword [esp + 0x18], 0
mov dword [0x455690], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
jne 0x40af61
mov esi, dword [str._r_____r____]
mov ecx, dword [0x45568c]
imul esi, esi, 0x1603
mov edx, dword [0x455698]
imul ecx, ecx, 0x11be
imul edx, edx, 0xe0e
add esi, ecx
mov ecx, dword [0x45569c]
add esi, edx
mov eax, 0x4b438bdf
imul ecx
mov ecx, dword [0x4556a4]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea edx, [esi + ecx - 0x544]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x455694], edx
call fcn.0042a146
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.00429441
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x455698]
mov eax, 0x3dbd3249
imul ecx
mov ecx, dword [0x455694]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x5d0a95d5
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x4556a8]
mov eax, 0x736e5bc3
imul ecx
imul ecx, ecx, 0x544
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a0]
imul edx, edx, 0xd9b
sub esi, eax
lea eax, [esp + 0x18]
add esi, edx
push eax
sub esi, ecx
push ebx
mov dword [0x455698], esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40b051
mov ecx, dword [0x455694]
mov esi, dword [0x455690]
mov eax, 0x27e98ca1
imul esi, esi, 0x2367
imul ecx
imul ecx, ecx, 0x544
sar edx, 0xa
mov edi, edx
add esi, edx
mov edx, dword [0x45568c]
mov eax, edx
imul eax, eax, 0x15e3
shr edi, 0x1f
add edi, esi
add edi, eax
mov eax, 0x48dbb693
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push ebx
mov dword [0x45569c], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.00429441
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45568c]
mov eax, 0x443d7153
imul ecx
mov eax, dword [0x455698]
sar edx, 0xb
imul eax, eax, 0x108d
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x1e03
sub edx, ecx
sub edx, eax
lea ecx, [esp + 0x140]
mov dword [0x4556a0], edx
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00433ece
add esp, 8
test eax, eax
je 0x40b433
mov ecx, dword [str._r_____r____]
mov esi, dword [0x4556a0]
mov eax, 0xa26d61a3
imul esi, esi, 0x1b47
imul ecx
mov ecx, dword [0x455690]
sar edx, 0xb
imul ecx, ecx, 0x11be
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
add edi, ecx
mov ecx, dword [0x455698]
mov eax, 0x4b438bdf
imul ecx
mov ecx, dword [esp + 0x20]
sar edx, 0xa
mov eax, edx
push ecx
shr eax, 0x1f
add edi, edx
push 0
add eax, edi
push 0x1f0fff
mov dword [0x4556a8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x4556a8]
mov edi, eax
imul ecx, ecx, 0x212c
mov esi, dword [0x455690]
mov eax, 0x73b2d479
imul dword [0x45569c]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x27e98ca1
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [esp + 0xc], ecx
mov ecx, dword [0x455694]
mov eax, 0x5d0a95d5
imul ecx
mov eax, dword [esp + 0xc]
sar edx, 0xb
add eax, edx
mov ecx, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x11be
shr ecx, 0x1f
add ecx, eax
add ecx, edx
test edi, edi
mov dword [str._r_____r____], ecx
jne 0x40b191
push 0x445f58
call fcn.0042a146
add esp, 4
jmp 0x40b20a
mov ebx, dword [0x4556a0]
imul esi, esi, 0x544
mov eax, 0x5d929e5d
imul ebx, ebx, 0x2367
imul dword [0x45569c]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub eax, ebx
mov ebx, eax
mov eax, 0x48dbb693
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, esi
mov esi, dword [0x455688]
add ebx, ecx
add esi, ebx
push edi
mov dword [0x455688], esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40b1ff
push 0x445f44
call fcn.0042a146
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
mov ecx, dword [0x455690]
mov esi, dword [0x4556a8]
mov eax, 0x5d0a95d5
imul esi, esi, 0x212c
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4556a0]
imul edx, edx, 0x11be
mov edi, ecx
mov ecx, dword [0x45568c]
sub edi, esi
add edi, edx
mov eax, 0x4b438bdf
imul ecx
mov ecx, dword [0x455694]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
lea ecx, [esp + 0x18]
push ecx
add eax, 0x1e03
push ebx
mov dword [0x45568c], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40b051
mov esi, dword [0x45569c]
mov ecx, dword [0x455688]
mov edi, dword [esp + 0x10]
mov edx, dword [0x455690]
imul ecx, ecx, 0xe0e
mov eax, 0x443d7153
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a8]
imul edx, edx, 0x19a8
sub edx, eax
mov dword [esp + 0x10], edx
mov eax, 0x27e98ca1
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
mov eax, dword [0x4556a0]
add edx, ecx
sub edx, eax
sub edx, 0x544
push ebx
mov dword [0x455690], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40af4c
mov esi, dword [str._r_____r____]
mov ecx, dword [0x45568c]
imul esi, esi, 0x1603
mov edx, dword [0x455698]
imul ecx, ecx, 0x11be
imul edx, edx, 0xe0e
add esi, ecx
mov ecx, dword [0x45569c]
add esi, edx
mov eax, 0x4b438bdf
imul ecx
mov ecx, dword [0x4556a4]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [esp + 0x20]
push eax
push 0
lea edx, [esi + ecx - 0x544]
push 0x1f0fff
mov dword [0x455694], edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x455694]
mov edi, eax
mov esi, dword [0x4556a8]
mov eax, 0x5d0a95d5
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45569c]
mov eax, 0x73b2d479
imul edx
sar edx, 0xc
mov ebx, esi
imul ebx, ebx, 0x212c
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455690]
sub ebx, eax
mov eax, 0x27e98ca1
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x11be
sub ebx, eax
add ebx, ecx
add edx, ebx
test edi, edi
mov dword [str._r_____r____], edx
je 0x40af4c
mov edx, dword [0x455698]
mov eax, 0x3dbd3249
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x736e5bc3
imul esi
imul esi, esi, 0x544
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a0]
imul edx, edx, 0xd9b
sub ebx, eax
add ebx, edx
sub ebx, esi
sub ebx, ecx
mov ecx, dword [esp + 0x944]
mov dword [0x455698], ebx
mov eax, edi
call fcn.00429441
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x45569c]
mov ecx, dword [0x4556a4]
mov eax, 0x73b2d479
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xd816735f
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, esi
imul edx, edx, 0x1603
mov eax, ecx
mov ecx, dword [0x45568c]
sub eax, edi
add eax, edx
mov edi, eax
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [0x455688]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0xd9b
sub edi, eax
add edi, edx
mov dword [0x4556a4], edi
mov edi, dword [esp + 0x20]
jmp 0x40b28d