Function at 0x40e7f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x45e640]
mov ecx, dword [0x45cccc]
xor eax, ebp
mov dword [esp + 0x938], eax
mov eax, 0x4227fdad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
mov ebx, eax
push esi
push edi
mov edi, dword [0x45ccd4]
mov eax, 0xbb03c5cb
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov dword [esp + 0x10], eax
mov eax, 0x44fc3a35
imul ecx
imul ecx, ecx, 0x1865
mov eax, dword [esp + 0x10]
sar edx, 0xb
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x5c9900d1
imul edi
mov eax, dword [0x45cce8]
add ebx, ecx
imul eax, eax, 0xa74
mov esi, dword [ebp + 8]
sar edx, 0xb
mov ecx, edx
add ebx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x1545
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
add ecx, eax
mov dword [str._r_____r____], ecx
mov byte [esp + 0x140], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea ecx, [esp + 0x144]
push 0x44cffc
push ecx
stosb byte es:[edi], al
call fcn.00430051
mov ebx, dword [0x45ccd0]
mov ecx, dword [0x45cce4]
mov eax, 0x53f407b5
imul ebx
sar edx, 0xb
mov eax, edx
mov esi, dword [0x45cce0]
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xc09370e3
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, esi
add esp, 0xc
sub edi, ecx
imul edx, edx, 0x1481
mov ecx, dword [0x45ccc8]
imul esi, esi, 0x1865
sub edi, edx
imul ecx, ecx, 0x1259
mov eax, 0x6f9f33f1
imul ebx
sar edx, 0xb
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
add eax, ecx
mov edi, eax
mov eax, 0x2f1d432d
imul ebx
sar edx, 9
add edi, edx
mov ecx, edx
mov eax, 0x5c9900d1
imul dword [0x45ccd4]
sar edx, 0xb
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov dword [esp + 0x10], eax
mov eax, 0xc09370e3
imul dword [0x45ccd4]
add edx, dword [0x45ccd4]
mov eax, dword [esp + 0x10]
sar edx, 0xc
add eax, edx
mov esi, edx
mov edx, dword [0x45cce4]
imul edx, edx, 0x1259
shr esi, 0x1f
add esi, eax
add esi, edx
mov edx, dword [0x45cccc]
shr ecx, 0x1f
add ecx, edi
mov edi, dword [0x45cce8]
mov eax, 0x6614bc37
imul edi, edi, 0xa74
imul edx
sar edx, 0xa
add esi, edx
mov eax, edx
mov edx, dword [0x45ccdc]
shr eax, 0x1f
add eax, esi
mov esi, dword [str._r_____r____]
sub eax, edi
sub eax, esi
mov esi, dword [0x45ccd8]
add eax, 0xae6
imul esi, esi, 0x1db0
mov dword [0x45cccc], eax
mov eax, 0x44fc3a35
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x45ccc8], ecx
imul ecx, ecx, 0x1545
mov eax, 0x6f9f33f1
imul dword [0x45ccd8]
add esi, ecx
sar edx, 0xb
mov ecx, edx
add esi, edx
mov eax, 0x5df55b35
imul ebx
shr ecx, 0x1f
add ecx, esi
mov dword [esp + 0x10], 0
sar edx, 0xa
mov esi, dword [0x45cce4]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, esi
push 0
lea ecx, [ecx + edi - 0x1259]
push 2
mov dword [0x45ccd0], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0xc], esi
jne 0x40eae8
mov esi, dword [0x45ccdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ccd8]
lea edi, [edx + ecx]
imul ecx, ecx, 0x161e
mov eax, esi
imul edi, edi, 0x1545
imul eax, eax, 0x1865
add edi, eax
mov eax, 0x5c9900d1
imul esi
sar edx, 0xb
mov ebx, edx
add edi, edx
mov eax, 0x6614bc37
imul esi
shr ebx, 0x1f
sar edx, 0xa
add ebx, edi
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cce0]
sub ebx, ecx
lea eax, [ebx + edx - 0x1259]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45ccd4], eax
call fcn.00430b56
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x938]
xor ecx, ebp
call fcn.0042fe7d
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cce8]
mov edi, dword [0x45ccc8]
mov eax, 0x53f407b5
imul edi, edi, 0x161e
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd4]
sub edi, eax
mov eax, 0x5c9900d1
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x1259
sub edi, eax
sub edi, edx
mov eax, 0x61f60d03
imul ecx
mov ecx, dword [0x45cce0]
sar edx, 0xa
mov ebx, edx
add edi, edx
mov eax, 0x6614bc37
imul ecx
imul ecx, ecx, 0xa08
sar edx, 0xa
shr ebx, 0x1f
mov eax, edx
add ebx, edi
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [0x45ccd8], eax
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40ec20
mov ecx, dword [0x45cccc]
mov edx, dword [0x45ccd0]
mov edi, dword [0x45cce4]
lea ebx, [edx + ecx]
mov eax, 0x44fc3a35
imul ebx, ebx, 0x1ef5
imul edi
sar edx, 0xb
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x5c9900d1
imul edi
sar edx, 0xb
mov edi, edx
add ebx, edx
mov eax, 0xc09370e3
imul ecx
add edx, ecx
mov ecx, dword [0x45ccdc]
sar edx, 0xc
imul ecx, ecx, 0x1259
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0xade
shr edi, 0x1f
add edi, ebx
sub edi, eax
add edi, ecx
add edi, edx
push esi
mov dword [0x45ccdc], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x938]
xor ecx, ebp
call fcn.0042fe7d
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cce8]
mov eax, dword [0x45ccd0]
lea edi, [eax + ecx]
mov eax, 0x4227fdad
imul edi, edi, 0xae6
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 0xb
imul ecx, ecx, 0x1259
mov ebx, edx
add edi, edx
mov edx, dword [0x45ccd8]
imul edx, edx, 0xade
shr ebx, 0x1f
add ebx, edi
sub ebx, ecx
mov ecx, dword [0x45cccc]
add ebx, edx
mov eax, 0x5df55b35
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0xa
imul ecx, ecx, 0xa74
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
sub ebx, ecx
push eax
mov dword [0x45cce0], ebx
call fcn.0043a98e
add esp, 8
test eax, eax
je 0x40f12a
mov eax, dword [0x45ccd0]
mov ecx, dword [0x45ccd8]
lea esi, [ecx + eax]
imul eax, eax, 0x161e
mov ecx, dword [0x45ccc8]
imul esi, esi, 0x1865
sub esi, eax
mov eax, 0x5c9900d1
imul ecx
sar edx, 0xb
mov edi, edx
add esi, edx
mov edx, dword [0x45cce4]
imul edx, edx, 0x1259
shr edi, 0x1f
add edi, esi
sub edi, edx
mov edx, dword [str._r_____r____]
mov eax, 0x2f1d432d
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x6614bc37
imul ecx
sar edx, 0xa
mov ecx, edx
add edi, edx
mov edx, dword [esp + 0x20]
push edx
shr ecx, 0x1f
push 0
add ecx, edi
push 0x1f0fff
mov dword [0x45cce8], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45cccc]
mov esi, eax
mov edi, dword [0x45ccd4]
mov eax, 0x4227fdad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xbb03c5cb
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov dword [esp + 0x14], eax
mov eax, 0x44fc3a35
imul ecx
imul ecx, ecx, 0x1865
mov eax, dword [esp + 0x14]
sar edx, 0xb
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x5c9900d1
imul edi
mov eax, dword [0x45cce8]
add ebx, ecx
imul eax, eax, 0xa74
sar edx, 0xb
add ebx, edx
mov ecx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x1545
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
add ecx, eax
mov dword [str._r_____r____], ecx
test esi, esi
jne 0x40edd5
push 0x44cfc8
call fcn.00430b56
add esp, 4
jmp 0x40ee6f
mov ecx, dword [0x45ccd0]
mov edi, dword [0x45cce4]
mov eax, 0x53f407b5
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xc09370e3
imul edi
add edx, edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1481
sub ebx, eax
sub ebx, edx
mov eax, 0x6f9f33f1
imul ecx
mov eax, dword [0x45ccc8]
imul eax, eax, 0x1259
sar edx, 0xb
mov edi, edx
add ebx, edx
shr edi, 0x1f
add edi, ebx
add edi, eax
mov eax, 0x2f1d432d
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
push esi
mov dword [0x45ccc8], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40ee68
push 0x44cfb4
call fcn.00430b56
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x45ccd4]
mov esi, dword [0x45cce0]
imul esi, esi, 0x1865
mov eax, 0x5c9900d1
imul ecx
sar edx, 0xb
add esi, edx
mov edi, edx
mov eax, 0xc09370e3
imul ecx
mov eax, dword [0x45cce8]
add edx, ecx
imul eax, eax, 0xa74
mov ecx, dword [0x45cccc]
sar edx, 0xc
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
mov edx, dword [0x45cce4]
imul edx, edx, 0x1259
mov ebx, dword [str._r_____r____]
shr esi, 0x1f
add esi, edi
add esi, edx
sub esi, eax
mov eax, 0x6614bc37
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
mov esi, dword [esp + 0xc]
lea edx, [esp + 0x18]
sub ecx, ebx
push edx
add ecx, 0xae6
push esi
mov dword [0x45cccc], ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40ec20
mov edi, dword [0x45ccc8]
mov ecx, dword [0x45cce4]
mov ebx, dword [0x45ccd8]
mov edx, dword [0x45ccdc]
imul ebx, ebx, 0x1db0
imul edi, edi, 0x1545
mov eax, 0x44fc3a35
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x6f9f33f1
imul dword [0x45ccd8]
add ebx, edi
sar edx, 0xb
mov edi, edx
add ebx, edx
mov edx, dword [0x45ccd0]
mov eax, 0x5df55b35
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0xa74
shr edi, 0x1f
add edi, ebx
sub edi, eax
add edi, edx
sub edi, ecx
sub edi, 0x1259
push esi
mov dword [0x45ccd0], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40ead1
mov esi, dword [0x45ccdc]
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45ccd8]
lea edi, [eax + ecx]
imul ecx, ecx, 0x161e
mov edx, esi
imul edi, edi, 0x1545
imul edx, edx, 0x1865
add edi, edx
mov eax, 0x5c9900d1
imul esi
sar edx, 0xb
mov ebx, edx
add edi, edx
mov eax, 0x6614bc37
imul esi
sar edx, 0xa
shr ebx, 0x1f
mov eax, edx
shr eax, 0x1f
add ebx, edi
add eax, edx
add ebx, ecx
mov ecx, dword [0x45cce0]
sub ebx, eax
mov eax, dword [esp + 0x20]
push eax
push 0
lea edx, [ebx + ecx - 0x1259]
push 0x1f0fff
mov dword [0x45ccd4], edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [0x45ccd4]
mov edi, eax
mov esi, dword [0x45cccc]
mov eax, 0x5c9900d1
imul ebx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x4227fdad
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0xbb03c5cb
imul ebx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [esp + 0xc]
sub ebx, eax
mov eax, 0x44fc3a35
imul esi
imul esi, esi, 0x1865
sar edx, 0xb
add ebx, edx
mov eax, edx
mov edx, dword [0x45ccdc]
shr eax, 0x1f
imul edx, edx, 0x1545
add eax, ebx
add eax, esi
mov esi, dword [0x45cce8]
mov ebx, esi
imul ebx, ebx, 0xa74
add edx, ecx
add edx, eax
add ebx, edx
test edi, edi
mov dword [str._r_____r____], ebx
je 0x40ead1
mov ebx, dword [0x45ccc8]
mov eax, 0x53f407b5
imul ebx, ebx, 0x161e
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, esi
imul edx, edx, 0x1259
sub ebx, edx
mov eax, 0x61f60d03
imul esi
mov esi, dword [0x45cce0]
sar edx, 0xa
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x6614bc37
imul esi
imul esi, esi, 0xa08
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x944]
mov dword [0x45ccd8], eax
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042fe7d
mov esp, ebp
pop ebp
ret
mov edi, dword [0x45ccc8]
mov eax, dword [0x45ccd4]
add eax, edi
imul eax, eax, 0xa08
mov ebx, dword [0x45ccd8]
mov dword [esp + 0xc], eax
mov eax, 0x4227fdad
imul ebx
mov eax, dword [esp + 0xc]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov ecx, dword [0x45cce4]
mov dword [esp + 0xc], eax
mov eax, 0x44fc3a35
imul ecx
mov ecx, dword [esp + 0xc]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x5c9900d1
imul ebx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x161e
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x5df55b35
imul ecx
mov eax, dword [esp + 0xc]
sar edx, 0xa
mov ecx, edx
add eax, edx
shr ecx, 0x1f
add ecx, eax
mov eax, dword [esp + 0x20]
mov dword [0x45cce4], ecx
mov dword [esp + 0x10], eax
jmp 0x40ef1a