Function at 0x405f80
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe84
mov eax, dword [0x45f540]
mov ecx, dword [0x45dbdc]
xor eax, esp
mov dword [esp + 0xe80], eax
mov eax, dword [esp + 0xe88]
mov dword [esp + 0xc], eax
mov eax, 0x77668d35
imul ecx
sar edx, 0xc
push ebx
mov ecx, edx
push ebp
push esi
mov esi, dword [0x45dbd8]
push edi
mov edi, dword [0x45dbe8]
shr ecx, 0x1f
imul edi, edi, 0x2214
add ecx, edx
mov edx, esi
imul edx, edx, 0x224e
sub edi, ecx
mov ecx, dword [0x45dbd0]
add edi, edx
mov eax, 0x8e8c0a95
imul ecx
add edx, ecx
mov ecx, dword [0x45dbc8]
sar edx, 0xc
imul ecx, ecx, 0x147d
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x6931b881
imul esi
sar edx, 9
mov eax, edx
add edi, ecx
shr eax, 0x1f
add edi, edx
mov edx, dword [0x45dbe4]
add eax, edi
sub eax, edx
push 0
sub eax, 0x4de
push 2
mov dword [0x45dbd0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45dbd4]
mov ebp, eax
mov eax, 0x771da23
imul ecx
sar edx, 8
mov esi, dword [0x45dbcc]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x77668d35
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x77668d35
imul esi
sub edi, ecx
sar edx, 0xc
add edi, edx
mov ecx, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x2214
mov eax, esi
imul eax, eax, 0x2179
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add ecx, eax
mov dword [esp + 0x18], ebp
mov eax, 0x98742075
imul esi
add edx, esi
mov esi, dword [0x45dbdc]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, esi
imul edx, edx, 0x147d
add ecx, edx
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x36e0
mov eax, 0x771da23
imul esi
sar edx, 8
mov eax, esi
imul eax, eax, 0x2179
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x45dbd8]
add edi, eax
imul ecx, ecx, 0x147d
mov eax, 0x49e7e4dd
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, ecx
mov ecx, dword [0x45dbe0]
sub edi, eax
lea eax, [esp + 0xe8]
push eax
lea edx, [edi + ecx - 0x4de]
push ebp
mov dword [esp + 0xf0], 0x128
xor ebx, ebx
mov dword [0x45dbd4], edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40613b
or eax, 0xffffffff
jmp 0x406590
mov ecx, dword [0x45dbd0]
mov esi, dword [0x45dbe4]
mov eax, 0x3d2f2c3f
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xc7eb4e25
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x92bc6f7d
imul ecx
mov eax, dword [0x45dbc8]
add edx, ecx
imul eax, eax, 0x4de
sar edx, 0xb
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
mov edi, dword [0x45dbe0]
mov edx, edi
imul edx, edx, 0x736
add esi, edx
add esi, eax
mov eax, 0x6931b881
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
mov dword [0x45dbc8], ecx
xor esi, esi
lea esp, [esp]
mov al, byte [esp + esi + 0x10c]
mov byte [esp + esi + 0x210], al
inc esi
test al, al
jne 0x4061c0
mov edx, dword [0x45dbd4]
imul ecx, ecx, 0x2263
mov esi, dword [0x45dbe8]
mov eax, 0x771da23
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x1e0c7127
imul esi
sar edx, 0xa
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov dword [esp + 0x10], eax
mov eax, 0x3d2f2c3f
imul esi
imul esi, esi, 0x4de
mov eax, dword [esp + 0x10]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov ecx, eax
mov eax, 0x49e7e4dd
imul edi
imul edi, edi, 0xddb
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
mov ecx, dword [esp + 0x1c]
add eax, edi
push ecx
lea edx, [esp + 0x214]
sub eax, esi
push edx
mov dword [0x45dbd8], eax
call fcn.0043af6e
mov edi, dword [0x45dbe4]
mov esi, dword [0x45dbe0]
add esp, 8
test eax, eax
jne 0x4062fb
mov ecx, dword [0x45dbd4]
mov eax, 0x771da23
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
mov ebx, eax
imul edx, edx, 0x2214
sub ebx, edx
mov eax, esi
imul eax, eax, 0x2179
add ebx, eax
mov eax, 0xc7eb4e25
imul ecx
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 0xc
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x49e7e4dd
imul ecx
sar edx, 0xa
add ebx, edx
mov ecx, edx
mov edx, edi
imul edx, edx, 0x4de
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
sub ecx, dword [str._r_____r____]
add ecx, 0x1cbc
mov dword [0x45dbcc], ecx
mov ebx, 1
mov ecx, dword [0x45dbd0]
imul esi, esi, 0x736
mov eax, 0x3d2f2c3f
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0xc7eb4e25
imul edi
add edx, dword [0x45dbe4]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
mov dword [esp + 0x10], edx
mov eax, 0x92bc6f7d
imul ecx
mov eax, dword [esp + 0x10]
add edx, ecx
sar edx, 0xb
add eax, edx
mov edi, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x4de
shr edi, 0x1f
add edi, eax
add edi, esi
add edi, edx
mov eax, 0x6931b881
imul ecx
sar edx, 9
mov eax, edx
lea ecx, [esp + 0xe8]
shr eax, 0x1f
add edi, edx
push ecx
add eax, edi
push ebp
mov dword [0x45dbc8], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406514
mov eax, ebx
shl eax, 6
lea edx, [esp + 0x10c]
lea edi, [esp + eax + 0x210]
sub eax, edx
lea esi, [esp + eax + 0x210]
mov dword [esp + 0x10], esi
lea eax, [esp + 0x10c]
jmp 0x4063c0
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x4063c0
mov ecx, dword [0x45dbd4]
mov eax, 0x771da23
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
mov ebp, eax
imul edx, edx, 0x2214
mov eax, dword [0x45dbe0]
imul eax, eax, 0x2179
sub ebp, edx
add ebp, eax
mov eax, 0xc7eb4e25
imul ecx
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 0xc
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x49e7e4dd
imul ecx
mov eax, dword [esp + 0x1c]
sar edx, 0xa
add ebp, edx
mov ecx, edx
mov edx, dword [0x45dbe4]
imul edx, edx, 0x4de
shr ecx, 0x1f
add ecx, ebp
mov ebp, dword [str._r_____r____]
add ecx, edx
sub ecx, ebp
push eax
add ecx, 0x1cbc
push edi
mov dword [0x45dbcc], ecx
call fcn.0043af6e
add esp, 8
test eax, eax
jne 0x4064fa
mov ecx, dword [0x45dbcc]
mov edx, dword [0x45dbd0]
mov esi, dword [0x45dbe4]
lea ebp, [ecx + edx]
mov eax, 0x771da23
imul ebp, ebp, 0x1ade
imul esi
sar edx, 8
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x77668d35
imul esi
sar edx, 0xc
add ebp, edx
mov esi, edx
mov eax, 0xc7eb4e25
imul ecx
add edx, ecx
mov ecx, dword [0x45dbe0]
sar edx, 0xc
imul ecx, ecx, 0xdf5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbdc]
shr esi, 0x1f
imul edx, edx, 0x4de
add esi, ebp
sub esi, eax
mov eax, dword [esp + 0xf0]
add esi, ecx
add esi, edx
mov dword [0x45dbdc], esi
mov esi, dword [esp + 0x10]
mov dword [esp + ebx*4 + 0x20], eax
inc ebx
add edi, 0x40
add esi, 0x40
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0xe8]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4063b4
mov ecx, dword [0x45dbe8]
mov edx, dword [0x45dbd0]
mov eax, dword [0x45dbd4]
mov esi, dword [0x45dbcc]
imul eax, eax, 0x2214
lea edi, [ecx + edx]
imul edi, edi, 0x1cbc
sub edi, eax
mov eax, 0x8e8c0a95
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x98742075
imul ecx
mov eax, dword [0x45dbdc]
add edx, ecx
imul eax, eax, 0x4de
sar edx, 0xc
mov ecx, edx
add edi, edx
mov edx, dword [0x45dbd8]
imul edx, edx, 0xdf5
shr ecx, 0x1f
add ecx, edi
add ecx, edx
sub ecx, eax
push ebp
mov dword [0x45dbe0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [esp + 0xe90]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043045d
add esp, 0xe84
ret