Function at 0x404cf0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe7c
mov eax, dword [0x458190]
mov ecx, dword [0x45682c]
mov dword [esp + 0xe78], eax
mov eax, 0x637bce79
imul ecx
mov ecx, dword [0x456818]
push ebp
imul ecx, ecx, 0x23d2f
push esi
mov esi, dword [str._r_____r____]
imul esi, esi, 0xa4b0c
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x456820]
mov eax, 0x2681eb59
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456834]
sub esi, eax
push edi
sub esi, edx
push 0
sub esi, 0xd5bac
push 2
mov dword [0x456820], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x456824]
mov ebp, eax
mov eax, 0x1315e2c9
imul esi
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456838]
imul edx, edx, 0x8cc35
add ecx, edx
mov edi, dword [0x456830]
mov eax, 0x637bce79
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, edi
imul edx, edx, 0x6a41a
add ecx, edx
mov edx, dword [0x45681c]
mov eax, 0x3b50a35b
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub ecx, eax
mov eax, 0x3d63c959
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0xd69d0
imul edx, edx, 0x23d2f
sub ecx, eax
mov eax, dword [0x456818]
xor esi, esi
add edx, edi
imul eax, eax, 0x6a41a
mov dword [esp + 0x10], ebp
mov dword [esp + 0xdc], 0x128
add edx, ecx
lea ecx, [eax + edx - 0xd5bac]
lea edx, [esp + 0xdc]
push edx
push ebp
mov dword [0x456824], ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x404e5a
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0xe78]
call fcn.00429d61
add esp, 0xe7c
ret
mov ecx, dword [0x456834]
mov eax, 0x4ca85b91
imul ecx
mov eax, dword [0x456818]
imul eax, eax, 0xd5bac
sar edx, 0x12
mov edi, edx
shr edi, 0x1f
add edi, edx
add edi, eax
mov eax, 0x72563b0d
imul ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8a1c3
sub edi, ecx
mov ecx, dword [0x456820]
sub edi, edx
mov eax, 0x2e259371
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [0x456818], eax
xor eax, eax
nop
mov cl, byte [esp + eax + 0x100]
mov byte [esp + eax + 0x204], cl
inc eax
test cl, cl
jne 0x404ec0
mov ecx, dword [0x456824]
mov eax, 0x1315e2c9
imul ecx
mov eax, dword [0x45681c]
sar edx, 0x10
imul eax, eax, 0x85714
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [0x456838]
mov edi, ecx
imul edi, edi, 0xfff2a454
sub edi, edx
add edi, eax
mov eax, 0x7464ef13
imul ecx
sar edx, 0x12
push ebx
mov ebx, edx
add edi, edx
mov eax, 0x4d18b8d9
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0xe90]
shr ebx, 0x1f
add ebx, edi
push edx
lea eax, [esp + 0x20c]
sub ebx, ecx
push eax
mov dword [0x456828], ebx
call fcn.004347de
mov ecx, dword [0x456830]
add esp, 8
test eax, eax
jne 0x404faf
mov esi, dword [0x456838]
mov eax, 0x1315e2c9
imul esi
imul esi, esi, 0x8cc35
sar edx, 0x10
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45681c]
mov eax, 0x3d63c959
imul edx
sar edx, 0x11
add edi, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x6a41a
shr eax, 0x1f
add eax, edi
sub eax, esi
mov esi, dword [str._r_____r____]
add eax, edx
sub eax, esi
add eax, 0x6a5e7
mov dword [0x45681c], eax
mov esi, 1
mov edi, dword [0x456834]
imul ecx, ecx, 0x8a1c3
mov eax, 0x4ca85b91
imul edi
mov eax, dword [0x456818]
imul eax, eax, 0xd5bac
sar edx, 0x12
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, eax
mov eax, 0x72563b0d
imul edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, ecx
mov ecx, dword [0x456820]
mov eax, 0x2e259371
imul ecx
sar edx, 0x10
mov ecx, edx
add ebx, edx
lea edx, [esp + 0xe0]
shr ecx, 0x1f
push edx
add ecx, ebx
push ebp
mov dword [0x456818], ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405146
mov eax, esi
shl eax, 6
lea ecx, [esp + 0x104]
lea edi, [esp + eax + 0x208]
sub eax, ecx
lea ebx, [esp + eax + 0x208]
nop
lea eax, [esp + 0x104]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x405047
mov ecx, dword [0x456838]
mov eax, 0x1315e2c9
imul ecx
imul ecx, ecx, 0x8cc35
sar edx, 0x10
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x45681c]
mov eax, 0x3d63c959
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [str._r_____r____]
add eax, ebp
sub eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x6a41a
add eax, ecx
sub eax, edx
mov edx, dword [esp + 0xe90]
push edx
add eax, 0x6a5e7
push edi
mov dword [0x45681c], eax
call fcn.004347de
add esp, 8
test eax, eax
jne 0x40512c
mov ecx, dword [0x456820]
mov ebp, dword [0x45682c]
imul ebp, ebp, 0xd5bac
mov eax, 0x637bce79
imul ecx
imul ecx, ecx, 0x8a1c3
sar edx, 0x12
add ebp, edx
mov eax, edx
mov edx, dword [0x45681c]
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x72563b0d
imul edx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xe8]
sub ebp, eax
add ebp, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x58c2a
add ebp, ecx
mov dword [esp + esi*4 + 0x18], edx
inc esi
add edi, 0x40
mov dword [0x45682c], ebp
add ebx, 0x40
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0xe0]
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405040
mov ecx, dword [0x45682c]
mov edi, dword [0x456824]
imul ecx, ecx, 0xd5bac
imul edi, edi, 0xfffdd9b2
sub edi, ecx
mov ecx, dword [0x45681c]
mov eax, 0x2681eb59
imul ecx
mov ecx, dword [0x456828]
sar edx, 0x10
imul ecx, ecx, 0x58c2a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push ebp
mov dword [0x456830], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe88]
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
call fcn.00429d61
add esp, 0xe7c
ret