Function at 0x40dd30
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x45b4b0]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9cc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x459b3c]
mov esi, dword [0x459b44]
mov edi, eax
mov eax, dword [0x459b58]
imul eax, eax, 0x171ed6e
mov ebx, ecx
imul ebx, ebx, 0x1a0fa8c
add ebx, eax
mov eax, 0x5e407cd
imul esi
sar edx, 0x14
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
shl eax, 1
mov ebx, eax
mov eax, 0x702fe9a3
imul esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x565ef47
imul ecx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x9c]
push edx
sub ebx, ecx
push edi
mov dword [esp + 0x20], edi
mov dword [esp + 0xa4], 0x128
mov dword [str._r_____r____], ebx
mov dword [esp + 0x1c], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40ddf6
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b8]
call fcn.0042cf11
add esp, 0x9bc
ret
mov ecx, dword [0x459b44]
mov ebx, dword [0x459b50]
mov eax, 0x5e407cd
imul ecx
sar edx, 0x14
mov edi, dword [str._r_____r____]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x459b3c]
mov eax, 0x545b9e19
imul edx
mov esi, ebx
imul esi, esi, 0x1a0fa8c
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, ecx
lea edx, [eax + esi*2 + 0x3409364]
sub edx, edi
mov dword [0x459b3c], edx
xor esi, esi
jmp 0x40de50
mov al, byte [esp + esi + 0xc0]
mov byte [esp + esi + 0x1c4], al
inc esi
test al, al
jne 0x40de50
mov eax, edi
mov edi, dword [0x459b4c]
imul eax, eax, 0x2b75400
mov esi, dword [0x459b58]
mov dword [esp + 0xc], eax
imul esi, esi, 0x171ed6e
mov eax, 0x545b9e19
imul edi
sar edx, 0x17
push ebp
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b48]
mov ebp, edi
imul edx, edx, 0xd0a84b
imul ebp, ebp, 0x341f518
sub ebp, eax
add ebp, dword [esp + 0x10]
add edx, ebp
add edx, ecx
add edx, esi
lea eax, [edx + ebx - 0x53d33c3]
mov dword [0x459b44], eax
mov eax, dword [esp + 0x9d0]
lea ebp, [esp + 0x1c8]
lea ecx, [ecx]
mov dl, byte [ebp]
mov cl, dl
cmp dl, byte [eax]
jne 0x40def5
test cl, cl
je 0x40def1
mov dl, byte [ebp + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x40def5
add ebp, 2
add eax, 2
test cl, cl
jne 0x40ded0
xor eax, eax
jmp 0x40defa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov ecx, dword [0x459b54]
jne 0x40df73
mov eax, 0x5e407cd
imul ebx, ebx, 0x185d014
imul edi, edi, 0x53d33c3
imul dword [0x459b44]
sar edx, 0x14
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x702fe9a3
imul ecx
sar edx, 0x19
add ebp, edx
mov eax, edx
mov edx, dword [0x459b40]
shr eax, 0x1f
imul edx, edx, 0xbdb188
add eax, ebp
add eax, ebx
add eax, edi
add eax, edx
mov ebp, eax
mov eax, 0x2742b221
imul dword [0x459b3c]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, esi
mov dword [0x459b4c], ebp
mov dword [esp + 0x18], 1
mov edi, dword [0x459b38]
mov eax, 0x5e407cd
imul edi, edi, 0x18470b7
imul dword [0x459b44]
sar edx, 0x14
mov ebx, edx
add edi, edx
mov eax, 0x702fe9a3
imul ecx
sar edx, 0x19
mov ecx, edx
shr ebx, 0x1f
shr ecx, 0x1f
add ecx, edx
add ebx, edi
sub ebx, ecx
mov ecx, dword [0x459b48]
mov eax, 0x5e407cd
imul ecx
sar edx, 0x14
mov eax, edx
mov ebp, dword [esp + 0x10]
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x565ef47
imul ecx
mov eax, dword [esp + 0x1c]
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
lea edx, [esp + 0xa0]
add ebx, ebp
push edx
add ebx, esi
push eax
mov dword [0x459b54], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40e1a4
mov eax, dword [esp + 0x18]
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea esi, [esp + eax + 0x1c8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
jmp 0x40e030
mov esi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [0x459b44]
mov edi, dword [0x459b58]
mov ebx, dword [0x459b40]
imul edi, edi, 0x171ed6e
mov eax, 0x5e407cd
imul ecx
sar edx, 0x14
add edi, edx
mov ecx, dword [0x459b38]
mov eax, edx
imul ecx, ecx, 0x53d33c3
shr eax, 0x1f
lea ebp, [eax + edi]
mov eax, 0x540f9495
imul ebx
sar edx, 0x17
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x186e8b3d
imul ebx
add edi, ecx
sar edx, 0x17
add edi, edx
mov ecx, edx
mov edx, dword [0x459b50]
imul edx, edx, 0xbdb188
shr ecx, 0x1f
add ecx, edi
sub ecx, edx
mov eax, 0x2742b221
imul dword [0x459b54]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, ebp
mov dword [0x459b38], ecx
lea eax, [esp + 0xc4]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40e0c2
mov edi, dword [esp + 0x9d0]
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40e0fb
test al, al
je 0x40e0f7
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40e0fb
add esi, 2
add edi, 2
test al, al
jne 0x40e0d7
xor eax, eax
jmp 0x40e100
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e18a
mov edx, dword [0x459b4c]
imul ecx, ecx, 0xd0a84b
mov esi, dword [0x459b48]
mov eax, 0x702fe9a3
imul esi, esi, 0x4905557
imul edx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, dword [0x459b54]
sub esi, eax
mov eax, 0x4eb6fa85
imul ebx
mov eax, dword [esp + 0x18]
add esi, ecx
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [esp + 0xa8]
sub esi, edi
mov dword [esp + eax*4 + 0x20], ecx
mov ecx, dword [esp + 0x10]
inc eax
lea edx, [esi + ebp - 0x53d33c3]
mov dword [0x459b40], edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0xa0]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40e025
mov ecx, dword [0x459b44]
mov esi, dword [0x459b50]
mov eax, 0x5e407cd
imul esi, esi, 0x18470b7
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [0x459b58]
mov eax, 0x9d2b2fed
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x58945bfd
imul ecx
imul ecx, ecx, 0x3cb4655
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [0x459b48], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
mov eax, dword [esp + 0x18]
pop ebp
pop edi
pop esi
pop ebx
call fcn.0042cf11
add esp, 0x9bc
ret