Function at 0x402f70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x451944]
mov ecx, dword [0x4508e8]
mov dword [esp + 0x938], eax
mov eax, 0xa61fcc17
imul ecx
add edx, ecx
mov ecx, dword [0x4508f4]
imul ecx, ecx, 0x185
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4508dc]
push ebx
sub ecx, eax
push esi
sub ecx, dword [0x4508d8]
lea eax, [ecx + edx + 0xd7]
push edi
mov dword [str._r_____r_____n], eax
mov byte [esp + 0x140], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
push ecx
stosw word es:[edi], ax
lea edx, [esp + 0x144]
push 0x440ff0
push edx
stosb byte es:[edi], al
call fcn.0042478a
mov ecx, dword [0x4508f0]
mov esi, dword [0x4508e8]
mov eax, 0x49e28fbb
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov edi, dword [0x4508ec]
mov eax, 0x73d0e82d
imul esi
sub edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4508d4]
sub eax, ecx
mov ecx, edi
imul ecx, ecx, 0x315
sub eax, ecx
add eax, dword [str._r_____r_____n]
mov ecx, dword [0x4508dc]
lea eax, [edx + eax - 0x30e]
mov dword [0x4508d4], eax
mov eax, 0x97012e03
imul ecx
mov ebx, edi
imul ebx, ebx, 0x1a8
add edx, ecx
sar edx, 8
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, dword [0x4508f4]
mov edx, ebx
imul edx, edx, 0x185
sub eax, edx
sub eax, dword [0x4508e0]
add esp, 0xc
add eax, 0x4f2
mov dword [0x4508d8], eax
mov dword [esp + 0x10], 0
mov eax, 0x197b05f9
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x21d814d3
imul ecx
sub edx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ecx, esi
sub ecx, edi
push 0
lea edx, [ecx + ebx - 0x30e]
push 2
mov dword [0x4508dc], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
jne 0x403158
mov ecx, dword [0x4508e8]
mov esi, dword [0x4508e4]
mov eax, 0x60f25deb
imul esi, esi, 0x377
imul ecx
mov ecx, dword [0x4508d8]
sar edx, 8
imul ecx, ecx, 0x1a8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4508f0]
sub esi, eax
add esi, edx
lea edx, [ecx + esi - 0x15c]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x4508e0], edx
call fcn.00424e6d
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.00424061
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4508e0]
mov esi, dword [0x4508f4]
mov eax, 0x68fed1fd
imul esi, esi, 0x30f
imul ecx
sub edx, ecx
mov ecx, dword [0x4508e4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xa8791709
imul ecx
add edx, ecx
sar edx, 8
mov ecx, edx
sub edi, esi
lea eax, [esp + 0x18]
shr ecx, 0x1f
add edi, edx
push eax
lea edx, [ecx + edi + 0x456]
push ebx
mov dword [0x4508e4], edx
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x403220
mov ecx, dword [0x4508d8]
mov esi, dword [0x4508e0]
mov edx, ecx
imul esi, esi, 0x30f
imul edx, edx, 0x3a7
sub esi, edx
mov eax, 0x49e28fbb
imul ecx
mov ecx, dword [0x4508dc]
sar edx, 8
imul ecx, ecx, 0x315
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
push ebx
mov dword [0x4508e8], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.00424061
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4508d8]
mov esi, dword [0x4508e4]
mov eax, 0xde27eb2d
imul esi, esi, 0x222
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 9
imul ecx, ecx, 0x24e
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea edx, [esi + ecx - 0x30e]
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0x40]
push ecx
mov dword [0x4508ec], edx
call fcn.0042eafe
add esp, 8
test eax, eax
je 0x40356d
mov ecx, dword [str._r_____r_____n]
mov eax, 0x8c2f17d3
imul ecx
add edx, ecx
mov ecx, dword [0x4508e4]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x60f25deb
imul ecx
mov eax, dword [0x4508dc]
sar edx, 8
imul eax, eax, 0x1a8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4508ec]
imul edx, edx, 0x1b2
sub ecx, esi
sub ecx, edx
mov edx, dword [esp + 0x20]
push edx
push 0
lea ecx, [ecx + eax - 0x30e]
push 0x1f0fff
mov dword [0x4508f4], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x4508e8]
mov esi, eax
mov eax, 0xa61fcc17
imul ecx
mov edi, dword [0x4508d8]
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4508f4]
imul edx, edx, 0x185
sub edx, eax
mov eax, dword [0x4508dc]
sub edx, edi
test esi, esi
lea edi, [edx + eax + 0xd7]
mov dword [str._r_____r_____n], edi
jne 0x40333f
push 0x440fbc
call fcn.00424e6d
add esp, 4
jmp 0x4033b2
mov edx, dword [0x4508f0]
mov eax, 0x49e28fbb
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x73d0e82d
imul ecx
sub edx, ecx
mov eax, dword [0x4508d4]
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4508ec]
imul edx, edx, 0x315
sub ecx, ebx
sub ecx, edx
add ecx, edi
lea ecx, [eax + ecx - 0x30e]
push esi
mov dword [0x4508d4], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x4033a7
push 0x440fa8
call fcn.00424e6d
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
mov ecx, dword [0x4508dc]
mov esi, dword [0x4508ec]
mov eax, 0x97012e03
imul esi, esi, 0x1a8
imul ecx
add edx, ecx
mov ecx, dword [0x4508f4]
imul ecx, ecx, 0x185
sar edx, 8
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
mov ecx, dword [0x4508e0]
lea edx, [esp + 0x18]
sub eax, ecx
push edx
add eax, 0x4f2
push ebx
mov dword [0x4508d8], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403220
mov esi, dword [esp + 0x10]
mov ecx, dword [0x4508dc]
mov eax, 0x197b05f9
imul dword [0x4508e8]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x21d814d3
imul ecx
sub edx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4508ec]
sub ecx, edi
sub ecx, edx
mov edx, dword [0x4508f4]
lea eax, [ecx + edx - 0x30e]
push ebx
mov dword [0x4508dc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x403143
mov ecx, dword [0x4508e8]
mov esi, dword [0x4508e4]
mov edi, dword [0x4508f0]
imul esi, esi, 0x377
mov eax, 0x60f25deb
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4508d8]
imul edx, edx, 0x1a8
sub esi, ecx
mov ecx, dword [esp + 0x20]
push ecx
add esi, edi
push 0
lea eax, [edx + esi - 0x15c]
push 0x1f0fff
mov dword [0x4508e0], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x4508e8]
mov esi, eax
mov eax, 0xa61fcc17
imul ecx
mov edi, dword [0x4508d8]
add edx, ecx
mov ecx, dword [0x4508f4]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x185
sub edx, eax
mov eax, dword [0x4508dc]
sub edx, edi
test esi, esi
lea edx, [edx + eax + 0xd7]
mov dword [str._r_____r_____n], edx
je 0x403143
mov edi, dword [0x4508e0]
imul ecx, ecx, 0x30f
mov eax, 0x68fed1fd
imul edi
sub edx, edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, ecx
mov ecx, dword [0x4508e4]
mov eax, 0xa8791709
imul ecx
add edx, ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add edi, edx
lea edx, [ecx + edi + 0x456]
mov ecx, dword [esp + 0x944]
mov dword [0x4508e4], edx
mov eax, esi
call fcn.00424061
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4508f0]
mov eax, 0x197b05f9
imul ecx
mov ecx, dword [0x4508d4]
sar edx, 6
imul ecx, ecx, 0x2a4
mov esi, dword [esp + 0x20]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4508e8]
imul edx, edx, 0x1b2
sub ecx, eax
add ecx, edx
sub ecx, dword [0x4508d8]
sub ecx, 0x163
mov dword [0x4508f0], ecx
jmp 0x403410