Function at 0x406160
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe80
mov eax, dword [0x460640]
mov ecx, dword [0x45ebe8]
xor eax, esp
mov dword [esp + 0xe7c], eax
mov eax, dword [esp + 0xe84]
mov dword [esp + 8], eax
push ebx
push ebp
push esi
mov esi, dword [0x45ebd0]
push edi
mov edi, dword [0x45ebc4]
mov eax, 0x7a5789fb
imul edi, edi, 0xff7a148d
imul ecx
imul ecx, ecx, 0x450d9b
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xc83bcf21
imul esi
add edx, esi
mov esi, dword [0x45ebd8]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov ebx, dword [0x45ebe0]
mov eax, 0x8c4682e9
imul esi
add edx, esi
sar edx, 0x16
mov eax, edx
add edi, edx
mov edx, dword [0x45ebe4]
imul edx, edx, 0x88c9aa
shr eax, 0x1f
add eax, edi
add edx, ebx
add edx, eax
push 0
lea eax, [ecx + edx - 0x74cc7d]
push 2
mov dword [0x45ebd0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45ebcc]
mov ebx, eax
mov eax, 0x7a5789fb
imul ecx
mov ecx, dword [0x45ebd8]
sar edx, 0x16
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x7a5789fb
imul ecx
sar edx, 0x16
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45ebdc]
mov ecx, esi
imul ecx, ecx, 0xcdd745
add edi, ecx
mov ecx, dword [0x45ebd4]
mov eax, 0x312cd50d
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ebe0]
imul edx, edx, 0x533e66
sub edi, eax
mov dword [esp + 0x14], ebx
sub edi, edx
mov eax, 0xa16eca11
imul ecx
add edx, ecx
mov ebp, dword [0x45ebc8]
sar edx, 0x16
imul ebp, ebp, 0x533e66
add edi, edx
mov ecx, edx
mov eax, 0x7791c573
imul esi
shr ecx, 0x1f
add ecx, edi
mov dword [0x45ebc4], ecx
imul ecx, ecx, 0x1119354
sub edx, esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
add eax, ecx
mov ebp, eax
mov eax, 0xa16eca11
imul esi
add edx, esi
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, dword [0x45ebe4]
mov edx, dword [0x45ebe8]
imul edx, edx, 0x657dbd
add ecx, ebp
lea eax, [edx + ecx + 0x74cc7d]
lea ecx, [esp + 0xe4]
push ecx
push ebx
mov dword [esp + 0xec], 0x128
xor edi, edi
mov dword [0x45ebd4], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40631c
or eax, 0xffffffff
jmp 0x4067c4
mov ecx, dword [0x45ebdc]
mov eax, 0x6cf6585f
imul ecx
mov ecx, dword [0x45ebe4]
sar edx, 0x16
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x8c4682e9
imul ecx
add edx, ecx
sar edx, 0x16
add esi, edx
mov ebx, edx
mov edx, dword [0x45ebd8]
imul edx, edx, 0x74cc7d
mov ecx, dword [0x45ebd0]
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45ebe0]
add ebx, edx
mov eax, 0xef8db9b
imul esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xc4d1d103
imul ecx
add edx, ecx
sar edx, 0x16
add ebx, edx
mov ecx, edx
mov edx, esi
imul edx, edx, 0xe3db2
shr ecx, 0x1f
add ecx, ebx
sub ecx, edx
mov dword [0x45ebc8], ecx
xor eax, eax
jmp 0x4063b0
mov dl, byte [esp + eax + 0x108]
mov byte [esp + eax + 0x20c], dl
inc eax
test dl, dl
jne 0x4063b0
mov ebx, dword [0x45ebe8]
mov eax, 0xc4d1d103
imul ebx
add edx, ebx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ebcc]
mov ebp, ebx
imul edx, edx, 0x781723
mov ebx, eax
imul ebp, ebp, 0x74cc7d
sub ebx, ebp
sub ebx, edx
mov eax, 0x886e3a8d
imul esi
add edx, esi
sar edx, 0x16
add ebx, edx
mov esi, edx
mov edx, dword [0x45ebc4]
mov eax, 0x76a21d75
imul edx
sar edx, 0x15
shr esi, 0x1f
add esi, ebx
mov ebx, edx
add esi, edx
mov eax, 0xa16eca11
imul ecx
add edx, ecx
imul ecx, ecx, 0x657dbd
sar edx, 0x16
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add eax, edx
add ebx, esi
sub ebx, eax
add ebx, ecx
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x210]
push edx
mov dword [0x45ebd8], ebx
call fcn.0043c7be
mov ebp, dword [0x45ebd0]
mov esi, dword [0x45ebd8]
mov ecx, dword [0x45ebe0]
mov ebx, dword [0x45ebdc]
add esp, 8
test eax, eax
jne 0x40651f
mov edx, dword [0x45ebc8]
mov eax, 0x7a5789fb
imul edx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x7a5789fb
imul esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xc83bcf21
imul ebx
add edx, ebx
sar edx, 0x16
add edi, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, edi
mov edi, dword [0x45ebd4]
mov eax, 0x8c4682e9
imul edi
add edx, edi
sar edx, 0x16
add ebp, edx
mov edi, edx
mov eax, 0x312cd50d
imul ecx
sar edx, 0x14
shr edi, 0x1f
add edi, ebp
mov ebp, dword [0x45ebd0]
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0xef8db9b
imul ebp
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ebc4]
imul edx, edx, 0x450d9b
sub edi, eax
add edi, edx
mov dword [0x45ebcc], edi
mov edi, 1
mov eax, 0x6cf6585f
imul esi, esi, 0x74cc7d
imul ebx
sar edx, 0x16
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45ebe4]
mov eax, 0x8c4682e9
imul edx
add edx, dword [0x45ebe4]
sar edx, 0x16
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, esi
mov ebx, eax
mov eax, 0xef8db9b
imul ecx
imul ecx, ecx, 0xe3db2
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xc4d1d103
imul ebp
add edx, ebp
mov ebp, dword [esp + 0x14]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, ecx
lea ecx, [esp + 0xe4]
push ecx
push ebp
mov dword [0x45ebc8], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406748
mov eax, edi
shl eax, 6
lea edx, [esp + 0x108]
lea esi, [esp + eax + 0x20c]
sub eax, edx
lea ebx, [esp + eax + 0x20c]
lea eax, [esp + 0x108]
jmp 0x4065d0
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x4065d0
mov ecx, dword [0x45ebc8]
mov eax, 0x7a5789fb
imul ecx
mov ecx, dword [0x45ebd8]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x7a5789fb
imul ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebp, ecx
mov ecx, dword [0x45ebdc]
mov eax, 0xc83bcf21
imul ecx
add edx, ecx
mov ecx, dword [0x45ebd4]
sar edx, 0x16
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov dword [esp + 0x10], eax
mov eax, 0x8c4682e9
imul ecx
mov eax, dword [esp + 0x10]
add edx, ecx
mov ecx, dword [0x45ebe0]
sar edx, 0x16
add eax, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0x312cd50d
imul ecx
mov ecx, dword [0x45ebd0]
sar edx, 0x14
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0xef8db9b
imul ecx
mov ecx, dword [0x45ebc4]
sar edx, 0x13
imul ecx, ecx, 0x450d9b
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
sub ebp, eax
push edx
add ebp, ecx
push esi
mov dword [0x45ebcc], ebp
call fcn.0043c7be
add esp, 8
test eax, eax
jne 0x40672e
mov ecx, dword [0x45ebd0]
mov eax, 0x7a5789fb
imul ecx
mov eax, dword [0x45ebc8]
mov ecx, dword [0x45ebc4]
imul eax, eax, 0x965d2c
sar edx, 0x16
imul ecx, ecx, 0x74cc7d
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
add ebp, eax
add ebp, ecx
mov ecx, dword [0x45ebcc]
mov eax, 0xef8db9b
imul ecx
imul ecx, ecx, 0xa6969a
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov ecx, dword [0x45ebe4]
mov eax, 0xa16eca11
imul ecx
add edx, ecx
sar edx, 0x16
add ebp, edx
mov ecx, edx
mov edx, dword [esp + 0xec]
shr ecx, 0x1f
add ecx, ebp
mov dword [esp + edi*4 + 0x1c], edx
inc edi
add esi, 0x40
mov dword [0x45ebdc], ecx
add ebx, 0x40
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0xe4]
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4065c4
mov ecx, dword [0x45ebd0]
mov edx, dword [0x45ebd4]
mov esi, ecx
sub esi, edx
mov edx, dword [0x45ebd8]
imul esi, esi, 0x51d30d
imul edx, edx, 0x965d2c
add esi, edx
mov eax, 0xc83bcf21
imul ecx
add edx, ecx
mov ecx, dword [0x45ebcc]
imul ecx, ecx, 0x74cc7d
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45ebe8]
mov eax, 0x312cd50d
imul ecx
mov ecx, dword [0x45ebc8]
imul ecx, ecx, 0x450d9b
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
add eax, ecx
push ebp
mov dword [0x45ebe0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0xe8c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00431cad
add esp, 0xe80
ret