Function at 0x4100c0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x460640]
xor eax, esp
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9cc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45ebd8]
mov esi, eax
mov eax, 0x7a5789fb
imul ecx
mov ecx, dword [0x45ebcc]
sar edx, 0x16
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x7a5789fb
imul ecx
mov eax, dword [0x45ebdc]
mov ecx, dword [0x45ebd4]
imul eax, eax, 0xcdd745
sar edx, 0x16
mov ebx, edx
add edi, edx
shr ebx, 0x1f
add ebx, edi
add ebx, eax
mov eax, 0x312cd50d
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ebe0]
imul edx, edx, 0x533e66
sub ebx, eax
sub ebx, edx
mov eax, 0xa16eca11
imul ecx
add edx, ecx
sar edx, 0x16
mov eax, edx
lea ecx, [esp + 0x9c]
shr eax, 0x1f
add ebx, edx
push ecx
add eax, ebx
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xa4], 0x128
mov dword [0x45ebc4], eax
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4101a4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b8]
xor ecx, esp
call fcn.00431cad
add esp, 0x9bc
ret
push ebp
mov ebp, dword [0x45ebc8]
mov eax, 0x7a5789fb
imul ebp
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov esi, dword [0x45ebdc]
mov eax, 0x7a5789fb
imul dword [0x45ebd8]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xc83bcf21
imul esi
add edx, esi
sar edx, 0x16
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x45ebd4]
mov eax, 0x8c4682e9
imul ecx
add edx, ecx
mov ecx, dword [0x45ebe0]
sar edx, 0x16
add edi, edx
mov ebx, edx
mov eax, 0x312cd50d
imul ecx
sar edx, 0x14
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45ebc4]
add ebx, edx
mov ecx, edx
mov eax, 0xef8db9b
imul dword [0x45ebd0]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x450d9b
shr ecx, 0x1f
add ecx, ebx
sub ecx, eax
add ecx, edx
mov dword [0x45ebcc], ecx
xor eax, eax
jmp 0x410260
mov dl, byte [esp + eax + 0xc4]
mov byte [esp + eax + 0x1c8], dl
inc eax
test dl, dl
jne 0x410260
mov eax, 0x7791c573
imul ebp, ebp, 0x533e66
imul esi
sub edx, esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ebp
mov ebp, dword [0x45ebe8]
mov edx, edi
imul ebp, ebp, 0x657dbd
imul edx, edx, 0x1119354
add ebx, edx
add ebp, dword [0x45ebe4]
mov eax, 0xa16eca11
imul esi
add edx, esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebp, ebx
lea ebp, [eax + ebp + 0x74cc7d]
mov eax, dword [esp + 0x9d0]
mov dword [0x45ebd4], ebp
lea esi, [esp + 0x1c8]
lea esp, [esp]
mov bl, byte [esi]
mov dl, bl
cmp bl, byte [eax]
jne 0x410304
test dl, dl
je 0x410300
mov bl, byte [esi + 1]
mov dl, bl
cmp bl, byte [eax + 1]
jne 0x410304
add esi, 2
add eax, 2
test dl, dl
jne 0x4102e0
xor eax, eax
jmp 0x410309
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov esi, dword [0x45ebe4]
jne 0x41037e
mov eax, 0x7a5789fb
imul dword [0x45ebd0]
mov eax, dword [0x45ebc8]
sar edx, 0x16
imul eax, eax, 0x965d2c
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, eax
mov edx, edi
imul edx, edx, 0x74cc7d
add ebx, edx
mov eax, 0xef8db9b
imul ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0xa6969a
sub ebx, eax
add ebx, edx
mov eax, 0xa16eca11
imul esi
add edx, esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x45ebdc], eax
mov dword [esp + 0x10], 1
mov eax, 0x7a5789fb
imul ebp, ebp, 0xf02e46
imul esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xc83bcf21
imul edi
add edx, edi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x312cd50d
imul dword [0x45ebd0]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, esi
sub edi, eax
mov eax, dword [0x45ebd8]
imul eax, eax, 0x657dbd
add edi, ebp
sub edi, eax
mov eax, 0xa16eca11
imul ecx
mov eax, dword [esp + 0x14]
add edx, ecx
sar edx, 0x16
mov ecx, edx
add edi, edx
lea edx, [esp + 0xa0]
shr ecx, 0x1f
push edx
add ecx, edi
push eax
mov dword [0x45ebe4], ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4105c0
mov eax, dword [esp + 0x10]
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea eax, [esp + eax + 0x1c8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
nop
mov ecx, dword [0x45ebdc]
mov eax, 0x6cf6585f
imul ecx
mov ecx, dword [0x45ebe4]
sar edx, 0x16
mov ebx, dword [0x45ebd8]
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x8c4682e9
imul ecx
add edx, ecx
sar edx, 0x16
add esi, edx
mov ebp, edx
mov edx, ebx
imul edx, edx, 0x74cc7d
mov edi, dword [0x45ebd0]
shr ebp, 0x1f
add ebp, esi
mov esi, dword [0x45ebe0]
add ebp, edx
mov eax, 0xef8db9b
imul esi
imul esi, esi, 0xe3db2
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0xc4d1d103
imul edi
add edx, edi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
sub eax, esi
mov esi, dword [esp + 0x18]
mov dword [0x45ebc8], eax
lea eax, [esp + 0xc4]
mov edi, edi
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x4104c0
mov ebp, dword [esp + 0x9d0]
mov esi, dword [esp + 0x1c]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [ebp]
jne 0x4104fa
test al, al
je 0x4104f6
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x4104fa
add esi, 2
add ebp, 2
test al, al
jne 0x4104d5
xor eax, eax
jmp 0x4104ff
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4105a6
mov esi, dword [0x45ebe8]
imul ecx, ecx, 0x88c9aa
mov ebp, dword [0x45ebc4]
mov eax, 0x7a5789fb
imul ebp, ebp, 0xff7a148d
imul esi
imul esi, esi, 0x450d9b
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0xc83bcf21
imul edi
add edx, edi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x8c4682e9
imul ebx
add edx, ebx
mov ebx, dword [0x45ebe0]
sar edx, 0x16
mov eax, edx
add ebp, edx
mov edx, dword [esp + 0xa8]
shr eax, 0x1f
add eax, ebp
add ecx, ebx
add ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
inc eax
lea ecx, [esi + ecx - 0x74cc7d]
mov dword [0x45ebd0], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xa0]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x410430
mov ecx, dword [0x45ebe8]
mov eax, 0xc4d1d103
imul ecx
add edx, ecx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov esi, ecx
mov ecx, dword [0x45ebe0]
imul esi, esi, 0x74cc7d
mov eax, 0x886e3a8d
imul ecx
add edx, ecx
mov ecx, dword [0x45ebcc]
sub edi, esi
imul ecx, ecx, 0x781723
sar edx, 0x16
add edi, edx
mov esi, edx
shr esi, 0x1f
add esi, edi
sub esi, ecx
mov ecx, dword [0x45ebc4]
mov eax, 0x76a21d75
imul ecx
mov ecx, dword [0x45ebc8]
sar edx, 0x15
mov edi, edx
add esi, edx
mov eax, 0xa16eca11
imul ecx
add edx, ecx
imul ecx, ecx, 0x657dbd
sar edx, 0x16
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, esi
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [esp + 0x14]
push ecx
mov dword [0x45ebd8], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00431cad
add esp, 0x9bc
ret