Function at 0x405f20
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe84
mov eax, dword [0x45f540]
mov ecx, dword [0x45dbdc]
xor eax, esp
mov dword [esp + 0xe80], eax
mov eax, dword [esp + 0xe88]
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [0x45dbe8]
mov eax, 0x4a4dc96f
imul edi, edi, 0x338
imul ecx
mov esi, dword [0x45dbd0]
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45dbd8]
mov edx, ecx
imul edx, edx, 0x372
add edi, edx
mov eax, 0xad602b59
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x221
mov esi, dword [0x45dbe4]
sub edi, eax
add edi, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, esi
push 0
sub eax, 0x92
push 2
mov dword [0x45dbd0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45dbd4]
mov edi, eax
mov esi, dword [0x45dbcc]
mov eax, 0x4a4dc96f
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4a4dc96f
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x365
mov ebp, eax
sub ebp, ebx
add ebp, edx
mov eax, 0xa33a575b
imul ecx
mov eax, dword [0x45dbe8]
add edx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
mov dword [esp + 0x18], edi
add ecx, ebp
imul eax, eax, 0x338
add ecx, eax
mov eax, 0xc152500d
imul esi
add edx, esi
mov esi, dword [0x45dbdc]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, esi
imul edx, edx, 0x221
add ecx, edx
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x544
mov eax, esi
imul eax, eax, 0x365
add ecx, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
add ecx, edx
mov ebp, edx
mov eax, 0x5e6ea9af
imul esi
shr ebp, 0x1f
add ebp, ecx
mov ecx, dword [0x45dbd8]
imul ecx, ecx, 0x221
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebp, ecx
mov ecx, dword [0x45dbe0]
sub ebp, eax
lea eax, [esp + 0xe8]
push eax
lea edx, [ecx + ebp - 0x92]
push edi
mov dword [esp + 0xf0], 0x128
xor ebx, ebx
mov dword [0x45dbd4], edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4060e2
or eax, 0xffffffff
jmp 0x406525
mov ecx, dword [0x45dbc8]
mov edi, dword [0x45dbe0]
lea esi, [edi + ecx]
mov ecx, dword [0x45dbd0]
imul esi, esi, 0x92
mov eax, 0x96d4b1f
imul ecx
sar edx, 5
add esi, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, esi
mov esi, dword [0x45dbe4]
mov eax, 0xf07fc3e1
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x57d990d1
imul ecx
sar edx, 7
add ebp, edx
mov esi, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
shr esi, 0x1f
sar edx, 7
add esi, ebp
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
mov dword [0x45dbc8], ecx
xor esi, esi
jmp 0x406160
mov al, byte [esp + esi + 0x10c]
mov byte [esp + esi + 0x210], al
inc esi
test al, al
jne 0x406160
mov esi, dword [0x45dbe8]
imul ecx, ecx, 0x323
mov eax, 0x96d4b1f
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbd4]
mov ebp, eax
mov eax, 0x5cc5a8a5
imul edx
sub edx, dword [0x45dbd4]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
mov dword [esp + 0x10], eax
mov eax, 0x13e22cbd
imul esi
imul esi, esi, 0x92
mov eax, dword [esp + 0x10]
sar edx, 6
mov ebp, edx
add eax, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0x5e6ea9af
imul edi
imul edi, edi, 0x15b
add ebp, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
mov edx, dword [esp + 0x1c]
add ecx, ebp
add ecx, edi
push edx
lea eax, [esp + 0x214]
sub ecx, esi
push eax
mov dword [0x45dbd8], ecx
call fcn.0043aeee
mov esi, dword [0x45dbe4]
mov edi, dword [0x45dbe0]
add esp, 8
test eax, eax
jne 0x4062a0
mov ecx, dword [0x45dbd4]
mov eax, 0xa33a575b
imul ecx
add edx, ecx
mov ebx, edi
imul ebx, ebx, 0x365
sar edx, 9
add ebx, edx
mov ebp, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x338
shr ebp, 0x1f
add ebp, ebx
sub ebp, edx
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 9
add ebp, edx
mov ebx, edx
mov eax, 0x5e6ea9af
imul ecx
mov ecx, esi
imul ecx, ecx, 0x92
shr ebx, 0x1f
sar edx, 7
add ebx, ebp
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [str._r_____r____]
add eax, ebx
add eax, ecx
sub eax, edx
add eax, 0x2f4
mov dword [0x45dbcc], eax
mov ebx, 1
mov ecx, dword [0x45dbd0]
mov edx, dword [0x45dbc8]
add edi, edx
mov eax, 0x96d4b1f
imul edi, edi, 0x92
imul ecx
sar edx, 5
mov ebp, edx
add edi, edx
mov eax, 0xf07fc3e1
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebp, 0x1f
add ebp, edi
sub ebp, eax
mov eax, 0x57d990d1
imul ecx
sar edx, 7
add ebp, edx
mov esi, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
shr esi, 0x1f
sar edx, 7
add esi, ebp
mov ebp, dword [esp + 0x18]
mov ecx, edx
add esi, edx
lea edx, [esp + 0xe8]
shr ecx, 0x1f
push edx
add ecx, esi
push ebp
mov dword [0x45dbc8], ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4064a9
mov eax, ebx
shl eax, 6
lea ecx, [esp + 0x10c]
lea edi, [esp + eax + 0x210]
sub eax, ecx
lea esi, [esp + eax + 0x210]
mov dword [esp + 0x10], esi
lea eax, [esp + 0x10c]
jmp 0x406350
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x406350
mov ecx, dword [0x45dbd4]
mov ebp, dword [0x45dbe0]
mov eax, 0xa33a575b
imul ebp, ebp, 0x365
imul ecx
add edx, ecx
sar edx, 9
add ebp, edx
mov eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x338
shr eax, 0x1f
add eax, ebp
sub eax, edx
mov dword [esp + 0x14], eax
mov eax, 0xf07fc3e1
imul ecx
mov eax, dword [esp + 0x14]
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 9
add eax, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0x5e6ea9af
imul ecx
mov ecx, dword [0x45dbe4]
sar edx, 7
imul ecx, ecx, 0x92
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [str._r_____r____]
add eax, ebp
add eax, ecx
sub eax, edx
mov edx, dword [esp + 0x1c]
push edx
add eax, 0x2f4
push edi
mov dword [0x45dbcc], eax
call fcn.0043aeee
add esp, 8
test eax, eax
jne 0x40648f
mov ecx, dword [0x45dbcc]
mov eax, dword [0x45dbd0]
mov esi, dword [0x45dbe4]
lea ebp, [ecx + eax]
mov eax, 0x4a4dc96f
imul ebp, ebp, 0x2a6
imul esi
sar edx, 8
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
add ebp, edx
mov esi, edx
mov eax, 0xf07fc3e1
imul ecx
mov eax, dword [0x45dbdc]
add edx, ecx
imul eax, eax, 0x92
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x175
shr esi, 0x1f
add esi, ebp
sub esi, ecx
mov ecx, dword [esp + 0xf0]
add esi, edx
add esi, eax
mov dword [0x45dbdc], esi
mov esi, dword [esp + 0x10]
mov dword [esp + ebx*4 + 0x20], ecx
inc ebx
add edi, 0x40
add esi, 0x40
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x18]
lea edx, [esp + 0xe8]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x406344
mov ecx, dword [0x45dbe8]
mov eax, dword [0x45dbd0]
mov edx, dword [0x45dbd4]
mov esi, dword [0x45dbcc]
imul edx, edx, 0x338
lea edi, [ecx + eax]
imul edi, edi, 0x2f4
sub edi, edx
mov eax, 0xad602b59
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xc152500d
imul ecx
mov eax, dword [0x45dbdc]
add edx, ecx
imul eax, eax, 0x92
sar edx, 9
mov ecx, edx
add edi, edx
mov edx, dword [0x45dbd8]
imul edx, edx, 0x175
shr ecx, 0x1f
add ecx, edi
add ecx, edx
sub ecx, eax
push ebp
mov dword [0x45dbe0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [esp + 0xe90]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004303dd
add esp, 0xe84
ret