Function at 0x403ab0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x452944]
push ebx
push esi
push 0
push 2
mov dword [esp + 0x9c8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x4518e8]
mov ebx, dword [0x4518d8]
mov esi, eax
mov eax, 0x6614bc37
imul ecx
mov ecx, dword [0x4518f4]
imul ecx, ecx, 0x926
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518dc]
sub ecx, eax
sub ecx, ebx
lea eax, [ecx + edx + 0x1503]
lea ecx, [esp + 0x98]
push ecx
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xa0], 0x128
mov dword [str._r_____r_____n], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x403b4f
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b8]
call fcn.004249c1
add esp, 0x9bc
ret
mov ebx, dword [0x4518dc]
mov eax, 0x8c03f71d
imul ebx
mov eax, dword [0x4518f4]
add edx, ebx
imul eax, eax, 0x926
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518ec]
imul edx, edx, 0x1538
add ecx, edx
mov edx, dword [0x4518e0]
sub ecx, eax
sub ecx, edx
add ecx, 0x2044
mov dword [0x4518d8], ecx
xor esi, esi
lea esp, [esp]
mov al, byte [esp + esi + 0xbc]
mov byte [esp + esi + 0x1c0], al
inc esi
test al, al
jne 0x403ba0
mov esi, dword [0x4518e8]
mov eax, 0x61dea4df
imul esi
sar edx, 0xb
push ebp
mov ebp, dword [esp + 0x9cc]
push edi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
mov edi, ecx
imul edx, edx, 0x4cf
imul edi, edi, 0x1538
sub edi, eax
add edi, dword [0x4518f0]
lea eax, [edx + edi + 0x14d5]
mov dword [0x4518e0], eax
lea edi, [esp + 0x1c8]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x403c27
test al, al
je 0x403c23
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x403c27
add edi, 2
add ebp, 2
test al, al
jne 0x403c02
xor eax, eax
jmp 0x403c2c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403c6f
mov eax, ecx
imul ebx, ebx, 0xa08
imul eax, eax, 0xfad
sub ebx, eax
mov eax, dword [0x4518e0]
imul eax, eax, 0x86d
add ebx, eax
mov eax, 0x6a79dd7b
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov esi, ebx
mov dword [0x4518e8], esi
mov ebp, 1
jmp 0x403c73
mov ebp, dword [esp + 0x10]
mov edi, dword [0x4518f0]
imul esi, esi, 0x1d41
mov eax, 0x8b081419
imul edi
add edx, edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d4]
imul edx, edx, 0x14ed
sub esi, eax
add esi, edx
sub esi, ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xa0]
push eax
add esi, 0x1339
push ecx
mov dword [0x4518f0], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x403e23
mov eax, ebp
shl eax, 6
lea edx, [esp + eax + 0x1c8]
lea ecx, [esp + 0xc4]
sub eax, ecx
lea esi, [esp + eax + 0x1c8]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
jmp 0x403cf4
mov esi, dword [esp + 0x10]
mov edi, dword [0x4518e8]
mov ebx, dword [0x4518ec]
mov eax, 0x4152dddf
imul edi
sar edx, 0xa
mov ecx, ebx
imul ecx, ecx, 0xfffff5f8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x4518f0]
mov eax, 0x6a79dd7b
imul ecx
mov eax, dword [esp + 0x1c]
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518d4]
sub eax, ecx
add eax, dword [str._r_____r_____n]
lea eax, [edx + eax - 0x86c]
mov dword [0x4518d4], eax
lea eax, [esp + 0xc4]
jmp 0x403d60
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x403d60
mov esi, dword [esp + 0x9d0]
mov eax, dword [esp + 0x14]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403d99
test cl, cl
je 0x403d95
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403d99
add eax, 2
add esi, 2
test cl, cl
jne 0x403d75
xor eax, eax
jmp 0x403d9e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403e09
mov ecx, dword [0x4518dc]
mov eax, 0x8b081419
imul edi
add edx, edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xa5b2ed37
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518f4]
sub ecx, esi
sub ecx, ebx
lea eax, [ecx + edx - 0x866]
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0x14]
mov dword [esp + ebp*4 + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov dword [0x4518dc], eax
mov eax, 0x40
add edx, eax
inc ebp
add ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xa0]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403cf0
mov ecx, dword [0x4518e0]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x4518e4]
mov eax, 0x1bfba0af
imul ecx
mov ecx, dword [0x4518f4]
sar edx, 8
imul ecx, ecx, 0x86d
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
sub eax, esi
sub eax, ecx
add eax, 0x322e
push edx
mov dword [0x4518e4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
call fcn.004249c1
add esp, 0x9bc
ret