Function at 0x40e810
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x45f540]
xor eax, ebp
mov dword [esp + 0x938], eax
mov ecx, dword [0x45dbcc]
push ebx
push esi
mov esi, dword [0x45dbd4]
mov eax, 0x4a4dc96f
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
mov edi, eax
mov eax, 0x4a4dc96f
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
mov edx, ecx
imul edx, edx, 0x365
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x338
add eax, edx
mov edi, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
add edi, edx
mov esi, edx
mov eax, 0xc152500d
imul ecx
mov ebx, dword [ebp + 8]
add edx, ecx
mov ecx, dword [0x45dbdc]
imul ecx, ecx, 0x221
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
shr esi, 0x1f
add esi, edi
sub esi, eax
add esi, ecx
mov byte [esp + 0x140], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
lea edx, [esp + 0x144]
push 0x44e064
push edx
mov dword [str._r_____r____], esi
stosb byte es:[edi], al
call fcn.004305b1
mov eax, dword [0x45dbc8]
mov edi, dword [0x45dbe0]
mov esi, dword [0x45dbd0]
lea ecx, [edi + eax]
mov eax, 0x96d4b1f
imul ecx, ecx, 0x92
imul esi
sar edx, 5
mov ebx, edx
add ecx, edx
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x45dbe4]
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
add esp, 0xc
sar edx, 9
mov eax, edx
imul edi, edi, 0x365
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x57d990d1
imul esi
sar edx, 7
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xe070381d
imul esi
add edx, esi
sar edx, 7
add ebx, edx
mov ecx, edx
mov eax, 0xa33a575b
imul dword [0x45dbd4]
add edx, dword [0x45dbd4]
sar edx, 9
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [esp + 0xc], eax
mov eax, 0xf07fc3e1
imul dword [0x45dbd4]
add edx, dword [0x45dbd4]
mov eax, dword [esp + 0xc]
sar edx, 9
add eax, edx
mov edi, edx
mov edx, dword [0x45dbcc]
shr edi, 0x1f
add edi, eax
mov eax, 0x5e6ea9af
imul edx
sar edx, 7
add edi, edx
mov eax, edx
mov edx, dword [0x45dbe4]
shr eax, 0x1f
imul edx, edx, 0x92
add eax, edi
mov edi, dword [str._r_____r____]
add eax, edx
mov edx, dword [0x45dbdc]
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [0x45dbe8]
imul ebx, ebx, 0x338
sub eax, ebx
sub eax, edi
mov edi, dword [0x45dbd8]
add eax, 0x2f4
imul edi, edi, 0x372
mov dword [0x45dbcc], eax
mov eax, 0x4a4dc96f
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xad602b59
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x45dbc8], ecx
sub edi, eax
imul ecx, ecx, 0x221
mov dword [esp + 0xc], 0
mov esi, dword [0x45dbe4]
add edi, ecx
mov ecx, dword [0x45dbd8]
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
sub ecx, esi
push 0
lea edx, [ecx + ebx - 0x92]
push 2
mov dword [0x45dbd0], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x40eb0f
mov esi, dword [0x45dbdc]
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45dbd8]
lea edi, [eax + ecx]
imul ecx, ecx, 0x323
mov edx, esi
imul edi, edi, 0x221
imul edx, edx, 0x365
add edi, edx
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov ebx, edx
add edi, edx
mov eax, 0x5e6ea9af
imul esi
sar edx, 7
shr ebx, 0x1f
mov eax, edx
add ebx, edi
shr eax, 0x1f
add ebx, ecx
mov ecx, dword [0x45dbe0]
add eax, edx
sub ebx, eax
lea edx, [ebx + ecx - 0x92]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45dbd4], edx
call fcn.004310b6
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x938]
xor ecx, ebp
call fcn.004303dd
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45dbe8]
mov edi, dword [0x45dbc8]
mov eax, 0x96d4b1f
imul edi, edi, 0x323
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x13e22cbd
imul ecx
imul ecx, ecx, 0x92
sar edx, 6
add edi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45dbd4]
mov eax, 0xa33a575b
imul edi
add edx, edi
mov edi, dword [0x45dbe0]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x5e6ea9af
imul edi
imul edi, edi, 0x15b
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, edi
sub eax, ecx
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [0x45dbd8], eax
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40ec45
mov ecx, dword [0x45dbcc]
mov edi, dword [0x45dbe4]
mov edx, dword [0x45dbd0]
lea ebx, [edx + ecx]
mov eax, 0x4a4dc96f
imul ebx, ebx, 0x2a6
imul edi
sar edx, 8
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xa33a575b
imul edi
add edx, edi
sar edx, 9
mov edi, edx
add ebx, edx
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
mov ecx, dword [0x45dbe0]
sar edx, 9
imul ecx, ecx, 0x175
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbdc]
imul edx, edx, 0x92
shr edi, 0x1f
add edi, ebx
sub edi, eax
add edi, ecx
add edi, edx
push esi
mov dword [0x45dbdc], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x938]
xor ecx, ebp
call fcn.004303dd
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45dbe8]
mov eax, dword [0x45dbd0]
mov edx, dword [0x45dbd4]
mov edi, dword [0x45dbcc]
imul edx, edx, 0x338
lea ebx, [eax + ecx]
imul ebx, ebx, 0x2f4
sub ebx, edx
mov eax, 0xad602b59
imul edi
add edx, edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xc152500d
imul ecx
mov eax, dword [0x45dbdc]
add edx, ecx
imul eax, eax, 0x92
sar edx, 9
mov ecx, edx
add ebx, edx
mov edx, dword [0x45dbd8]
imul edx, edx, 0x175
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
sub ecx, eax
mov dword [0x45dbe0], ecx
lea ecx, [esp + 0x140]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.0043aeee
add esp, 8
test eax, eax
je 0x40f15c
mov eax, dword [0x45dbd0]
mov ecx, dword [0x45dbd8]
lea esi, [ecx + eax]
imul eax, eax, 0x323
mov ecx, dword [0x45dbc8]
imul esi, esi, 0x365
sub esi, eax
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
add esi, edx
mov edi, edx
mov eax, 0x5e6ea9af
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 7
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
mov eax, 0x57d990d1
imul ecx
mov ecx, dword [0x45dbe4]
sar edx, 7
imul ecx, ecx, 0x92
mov eax, edx
shr eax, 0x1f
shr esi, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
add esi, edi
push edx
sub esi, eax
push 0
sub esi, ecx
push 0x1f0fff
mov dword [0x45dbe8], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45dbd4]
mov edi, eax
mov ecx, dword [0x45dbcc]
mov eax, 0x4a4dc96f
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4a4dc96f
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x365
sub eax, ebx
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x338
add eax, edx
mov ebx, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
add ebx, edx
mov esi, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
mov ecx, dword [0x45dbdc]
sar edx, 9
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add esi, ebx
add eax, edx
sub esi, eax
imul ecx, ecx, 0x221
add esi, ecx
test edi, edi
mov dword [str._r_____r____], esi
jne 0x40ee00
push 0x44e030
call fcn.004310b6
add esp, 4
jmp 0x40ee95
mov edx, dword [0x45dbc8]
mov eax, dword [0x45dbe0]
mov ecx, dword [0x45dbd0]
lea esi, [eax + edx]
mov eax, 0x96d4b1f
imul esi, esi, 0x92
imul ecx
sar edx, 5
add esi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45dbe4]
mov eax, 0xf07fc3e1
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x57d990d1
imul ecx
sar edx, 7
mov esi, edx
add ebx, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
shr esi, 0x1f
mov ecx, edx
add esi, ebx
shr ecx, 0x1f
add esi, edx
add ecx, esi
push edi
mov dword [0x45dbc8], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40ee8e
push 0x44e01c
call fcn.004310b6
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x45dbe0]
mov edx, dword [0x45dbe8]
imul esi, esi, 0x365
mov ecx, dword [0x45dbd4]
imul edx, edx, 0x338
sub esi, edx
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
add esi, edx
mov edi, edx
mov eax, 0xf07fc3e1
imul ecx
mov ebx, dword [str._r_____r____]
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 9
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
mov eax, 0x5e6ea9af
imul ecx
mov ecx, dword [0x45dbe4]
imul ecx, ecx, 0x92
sar edx, 7
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, edi
add esi, edx
add eax, esi
mov esi, dword [esp + 0x10]
add eax, ecx
lea edx, [esp + 0x18]
sub eax, ebx
push edx
add eax, 0x2f4
push esi
mov dword [0x45dbcc], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40ec45
mov edi, dword [0x45dbe4]
mov ecx, dword [0x45dbd8]
mov edx, dword [0x45dbdc]
mov eax, 0x4a4dc96f
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
mov ebx, ecx
imul edx, edx, 0x338
imul ebx, ebx, 0x372
sub ebx, eax
add ebx, edx
mov edx, dword [0x45dbd0]
mov eax, 0xad602b59
imul edx
add edx, dword [0x45dbd0]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x45dbc8]
imul eax, eax, 0x221
add ebx, eax
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
sub ecx, edi
sub ecx, 0x92
push esi
mov dword [0x45dbd0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40eaf8
mov esi, dword [0x45dbdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45dbd8]
lea edi, [edx + ecx]
imul ecx, ecx, 0x323
mov eax, esi
imul edi, edi, 0x221
imul eax, eax, 0x365
add edi, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov ebx, edx
add edi, edx
mov eax, 0x5e6ea9af
imul esi
shr ebx, 0x1f
sar edx, 7
add ebx, edi
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe0]
sub ebx, ecx
mov ecx, dword [esp + 0x20]
push ecx
push 0
lea eax, [ebx + edx - 0x92]
push 0x1f0fff
mov dword [0x45dbd4], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45dbd4]
mov dword [esp + 0xc], eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x4a4dc96f
imul esi
mov esi, dword [0x45dbcc]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x4a4dc96f
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, edi
mov edi, dword [0x45dbe8]
mov edx, esi
imul edx, edx, 0x365
mov eax, edi
imul eax, eax, 0x338
add ebx, edx
add ebx, eax
mov eax, 0xc152500d
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbdc]
imul edx, edx, 0x221
sub ebx, eax
mov eax, dword [esp + 0xc]
add ebx, ecx
add edx, ebx
test eax, eax
mov dword [str._r_____r____], edx
je 0x40eaf8
mov esi, dword [0x45dbc8]
mov eax, 0x96d4b1f
imul esi, esi, 0x323
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x13e22cbd
imul edi
imul edi, edi, 0x92
sar edx, 6
add esi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45dbe0]
mov eax, 0x5e6ea9af
imul esi
imul esi, esi, 0x15b
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
sub eax, edi
sub eax, ecx
mov ecx, dword [esp + 0x944]
pop edi
pop esi
mov dword [0x45dbd8], eax
mov eax, dword [esp + 4]
xor ecx, ebp
pop ebx
call fcn.004303dd
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45dbd4]
mov ecx, dword [0x45dbc8]
lea ebx, [ecx + eax]
mov ecx, dword [0x45dbe4]
imul ebx, ebx, 0x15b
mov eax, 0x4a4dc96f
imul ecx
mov ecx, dword [0x45dbd8]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
mov edi, dword [str._r_____r____]
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xc152500d
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x323
sub ebx, eax
add ebx, edx
mov eax, 0xad602b59
imul edi
mov eax, dword [esp + 0x20]
add edx, edi
sar edx, 9
mov edi, edx
shr edi, 0x1f
add ebx, edx
add edi, ebx
mov dword [0x45dbe4], edi
mov dword [esp + 0xc], eax
jmp 0x40ef3b