Function at 0x40af40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x457000]
mov dword [esp + 0x938], eax
push ebx
push esi
push edi
mov ecx, dword [0x45569c]
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x4556a8]
mov edx, eax
shl edx, 4
add edx, eax
mov esi, edx
sub esi, ecx
mov ecx, dword [0x455690]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [0x455694]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
add esi, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x34
shr ecx, 0x1f
add ecx, esi
add ecx, edx
mov dword [str._r_____r____], ecx
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0x144]
push 0x445fc4
push ecx
call fcn.004290b1
mov ecx, dword [0x4556a4]
mov esi, dword [0x4556a0]
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov ecx, esi
imul ecx, ecx, 0xffffffcf
mov edi, dword [0x455690]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x151d07eb
imul dword [0x45569c]
sar edx, 3
add ecx, edx
mov eax, edx
mov edx, dword [str._r_____r____]
shr eax, 0x1f
add eax, ecx
mov ecx, edi
imul ecx, ecx, 0x39
sub eax, ecx
mov ecx, dword [0x455688]
add eax, edx
add esp, 0xc
add ecx, eax
mov dword [0x455688], ecx
mov ebx, esi
mov ecx, dword [0x4556a8]
imul ebx, ebx, 0x34
mov edx, ecx
shl edx, 4
add edx, ecx
sub ebx, edx
mov edx, dword [0x45568c]
mov eax, 0x30c30c31
imul edx
sar edx, 3
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, dword [0x455694]
add eax, 0x37
mov dword [0x45568c], eax
mov eax, dword [0x455688]
lea edx, [eax + eax*8]
lea eax, [ecx + ecx*2]
shl eax, 4
lea ecx, [eax + edx*4]
mov eax, 0x2aaaaaab
imul dword [0x45569c]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x94f2095
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, esi
push 0
sub ecx, 0x39
push 2
mov dword [esp + 0x18], 0
mov dword [0x455690], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
jne 0x40b176
mov eax, dword [0x455698]
lea ecx, [eax + eax*8]
mov ebx, dword [0x4556a4]
shl ecx, 2
mov esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0x30c30c31
imul ecx
mov ecx, dword [0x45568c]
imul ecx, ecx, 0x34
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [str._r_____r____]
add ecx, ebx
lea edx, [eax + eax*4]
add ecx, esi
lea eax, [ecx + edx*2 - 0x39]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x455694], eax
call fcn.00429c15
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.00428ee1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x455698]
mov eax, 0x78787879
imul ecx
mov ecx, dword [0x4556a0]
sar edx, 3
imul ecx, ecx, 0x2a
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, ecx
mov ecx, dword [0x4556a8]
mov edx, ecx
imul edx, edx, 0x39
sub esi, edx
mov eax, 0x4ec4ec4f
imul ecx
mov ecx, dword [0x455694]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x18]
push edx
sub esi, ecx
push ebx
mov dword [0x455698], esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40b260
mov ecx, dword [0x455694]
mov esi, ecx
mov eax, 0x2aaaaaab
imul esi, esi, 0x39
imul ecx
mov ecx, dword [0x45568c]
sar edx, 3
mov edi, edx
add esi, edx
mov edx, dword [0x455690]
mov eax, ecx
imul edx, edx, 0x31
imul eax, eax, 0x61
shr edi, 0x1f
add edi, esi
add edi, eax
add edi, edx
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push ebx
mov dword [0x45569c], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.00428ee1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45568c]
mov esi, dword [0x455698]
mov eax, 0x94f2095
imul esi, esi, 0x17
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x37
sub esi, ecx
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0x40]
add esi, edx
push ecx
mov dword [0x4556a0], esi
call fcn.0043396e
add esp, 8
test eax, eax
je 0x40b606
mov ecx, dword [0x455698]
mov eax, 0x30c30c31
imul ecx
mov ecx, dword [0x4556a0]
sar edx, 3
imul ecx, ecx, 0x43
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [str._r_____r____]
mov eax, 0x151d07eb
imul ecx
mov ecx, dword [0x455690]
sar edx, 3
imul ecx, ecx, 0x34
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
push edx
sub esi, eax
push 0
add esi, ecx
push 0x1f0fff
mov dword [0x4556a8], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, 0x5397829d
imul dword [0x45569c]
mov edi, dword [0x455690]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x4556a8]
mov edx, eax
shl edx, 4
add eax, edx
sub eax, ecx
mov ecx, eax
mov eax, 0x2aaaaaab
imul edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [esp + 0xc], ecx
mov ecx, dword [0x455694]
mov eax, 0x66666667
imul ecx
mov eax, dword [esp + 0xc]
sar edx, 2
add eax, edx
mov ecx, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x34
shr ecx, 0x1f
add ecx, eax
add ecx, edx
test esi, esi
mov dword [str._r_____r____], ecx
jne 0x40b396
push 0x445f90
call fcn.00429c15
add esp, 4
jmp 0x40b407
mov edx, dword [0x4556a4]
imul edi, edi, 0x39
mov ebx, dword [0x4556a0]
mov eax, 0x38e38e39
imul ebx, ebx, 0xffffffcf
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x151d07eb
imul dword [0x45569c]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, edi
mov edi, dword [0x455688]
add eax, ecx
add edi, eax
push esi
mov dword [0x455688], edi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40b3fc
push 0x445f7c
call fcn.00429c15
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
mov esi, dword [0x4556a0]
mov eax, dword [0x4556a8]
imul esi, esi, 0x34
mov ecx, eax
shl ecx, 4
add ecx, eax
sub esi, ecx
mov ecx, dword [0x45568c]
mov eax, 0x30c30c31
imul ecx
mov ecx, dword [0x455690]
sar edx, 3
mov edi, edx
add esi, edx
mov eax, 0x66666667
imul ecx
mov ecx, dword [0x455694]
sar edx, 2
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, esi
add edi, edx
add eax, edi
sub eax, ecx
lea ecx, [esp + 0x18]
push ecx
add eax, 0x37
push ebx
mov dword [0x45568c], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40b260
mov ecx, dword [0x45569c]
mov esi, dword [0x455688]
mov edi, dword [esp + 0x10]
mov eax, dword [0x4556a8]
lea eax, [eax + eax*2]
shl eax, 4
lea edx, [esi + esi*8]
lea esi, [eax + edx*4]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x455690]
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, dword [0x4556a0]
sub esi, 0x39
push ebx
mov dword [0x455690], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40b161
mov eax, dword [0x455698]
lea ecx, [eax + eax*8]
mov ebx, dword [0x4556a4]
shl ecx, 2
mov esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0x30c30c31
imul ecx
mov ecx, dword [0x45568c]
imul ecx, ecx, 0x34
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [str._r_____r____]
add ecx, ebx
add ecx, esi
lea edx, [eax + eax*4]
lea eax, [ecx + edx*2 - 0x39]
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1f0fff
mov dword [0x455694], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x455694]
mov edi, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
mov esi, dword [0x4556a8]
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45569c]
mov eax, 0x5397829d
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
shl edx, 4
add edx, esi
mov ebx, edx
mov edx, dword [0x455690]
sub ebx, eax
mov eax, 0x2aaaaaab
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x34
sub ebx, eax
add ebx, ecx
add edx, ebx
test edi, edi
mov dword [str._r_____r____], edx
je 0x40b161
mov edx, dword [0x455698]
mov eax, 0x78787879
imul edx
mov eax, dword [0x4556a0]
sar edx, 3
imul eax, eax, 0x2a
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, esi
imul edx, edx, 0x39
add ebx, eax
sub ebx, edx
mov eax, 0x4ec4ec4f
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, ecx
mov ecx, dword [esp + 0x944]
mov dword [0x455698], ebx
mov eax, edi
call fcn.00428ee1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4556a4]
mov esi, dword [0x455688]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [0x45569c]
sar edx, 3
mov edi, esi
imul edi, edi, 0x2a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
lea edx, [ecx + ecx*4]
lea edi, [edi + edx*2]
mov edx, dword [0x45568c]
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [0x4556a4], edi
mov edi, dword [esp + 0x20]
jmp 0x40b483