Function at 0x404d80
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe80
mov eax, dword [0x458190]
mov dword [esp + 0xe7c], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45682c]
mov eax, 0x7f3171f
imul ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0xde454f
mov esi, dword [str._r_____r____]
imul esi, esi, 0x4067eec
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x456820]
mov eax, 0x31a5bd5f
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456834]
sub esi, eax
sub esi, edx
push 0
sub esi, 0x5305094
push 2
mov dword [0x456820], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x456824]
mov ebp, eax
mov esi, dword [0x456838]
mov ebx, dword [0x456830]
imul esi, esi, 0x372f5c1
mov eax, 0x7f3171f
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov edx, ebx
imul edx, edx, 0x293deaa
add esi, edx
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
add esi, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45681c]
mov eax, 0x979d1eb7
imul esi
add edx, esi
mov esi, dword [0x456818]
sar edx, 0x19
imul esi, esi, 0x293deaa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
imul edx, edx, 0xde454f
sub ecx, eax
add esi, edx
mov edx, dword [0x45682c]
mov eax, 0x13a45601
imul edx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
xor edi, edi
mov dword [esp + 0x14], ebp
mov dword [str._r_____r____], ecx
mov dword [esp + 0xe4], 0x128
add eax, edx
imul ecx, ecx, 0x53d1950
sub esi, eax
lea edx, [esp + 0xe4]
add esi, ebx
push edx
lea ecx, [ecx + esi - 0x5305094]
push ebp
mov dword [0x456824], ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x404eef
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe7c]
call fcn.0042a171
add esp, 0xe80
ret
mov ecx, dword [0x456820]
mov eax, 0x3ac7f767
imul ecx
mov ecx, dword [0x456834]
sar edx, 0x17
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x62ace781
imul ecx
mov eax, dword [0x456818]
sar edx, 0x19
imul eax, eax, 0x5305094
mov ebx, edx
add esi, edx
shr ebx, 0x1f
add ebx, esi
add ebx, eax
mov eax, 0x936c7f27
imul ecx
add edx, ecx
sar edx, 0x17
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456830]
imul edx, edx, 0x360833b
sub ebx, ecx
sub ebx, edx
mov dword [0x456818], ebx
xor eax, eax
jmp 0x404f60
mov cl, byte [esp + eax + 0x108]
mov byte [esp + eax + 0x20c], cl
inc eax
test cl, cl
jne 0x404f60
mov ecx, dword [0x456838]
mov eax, 0x94723637
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x63510a67
imul ecx
imul ecx, ecx, 0x5305094
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45681c]
imul ecx, ecx, 0x3422234
add esi, ecx
mov ecx, dword [0x456824]
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [esp + 0xe94]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
push ecx
lea edx, [esp + 0x210]
sub esi, eax
push edx
mov dword [0x456828], esi
call fcn.00434bee
mov ecx, dword [0x456830]
add esp, 8
test eax, eax
jne 0x405053
mov esi, dword [0x456838]
mov edx, dword [0x45681c]
mov eax, esi
imul eax, eax, 0x372f5c1
mov edi, ecx
imul edi, edi, 0x293deaa
sub edi, eax
mov eax, 0x13a45601
imul edx
sar edx, 0x16
add edi, edx
mov ebx, edx
mov eax, 0x61bc1a5d
imul esi
mov esi, dword [str._r_____r____]
shr ebx, 0x1f
sar edx, 0x19
add ebx, edi
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
add eax, 0x294039f
mov dword [0x45681c], eax
mov edi, 1
mov edx, dword [0x456820]
imul ecx, ecx, 0x360833b
mov esi, dword [0x456834]
mov eax, 0x3ac7f767
imul edx
sar edx, 0x17
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x62ace781
imul esi
sar edx, 0x19
add ebx, edx
mov eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x5305094
shr eax, 0x1f
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x936c7f27
imul esi
add edx, esi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, ecx
lea ecx, [esp + 0xe4]
push ecx
push ebp
mov dword [0x456818], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405201
mov eax, edi
shl eax, 6
lea edx, [esp + 0x108]
lea ebx, [esp + eax + 0x20c]
sub eax, edx
lea esi, [esp + eax + 0x20c]
mov dword [esp + 0x10], esi
lea esp, [esp]
lea eax, [esp + 0x108]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x4050f7
mov ecx, dword [0x456838]
mov ebp, dword [0x456830]
mov edx, dword [0x45681c]
imul ebp, ebp, 0x293deaa
mov eax, ecx
imul eax, eax, 0x372f5c1
sub ebp, eax
mov eax, 0x13a45601
imul edx
sar edx, 0x16
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
mov edx, dword [esp + 0xe94]
add ecx, ebp
sub ecx, dword [str._r_____r____]
push edx
add ecx, 0x294039f
push ebx
mov dword [0x45681c], ecx
call fcn.00434bee
add esp, 8
test eax, eax
jne 0x4051e7
mov ecx, dword [0x456820]
mov esi, dword [0x45681c]
mov eax, 0x7f3171f
imul ecx
imul ecx, ecx, 0x360833b
mov eax, dword [0x456830]
sar edx, 0x15
imul eax, eax, 0x22d753a
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x45682c]
imul edx, edx, 0x5305094
add ebp, eax
add ebp, edx
mov eax, 0x936c7f27
imul esi
add edx, esi
mov esi, dword [esp + 0x10]
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov ecx, dword [esp + 0xec]
mov dword [esp + edi*4 + 0x1c], ecx
inc edi
add ebx, 0x40
add esi, 0x40
mov dword [0x45682c], ebp
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0xe4]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4050f0
mov esi, dword [0x456828]
mov eax, dword [0x456824]
imul esi, esi, 0x22d753a
mov ecx, dword [0x45682c]
imul eax, eax, 0xdef222
imul ecx, ecx, 0x5305094
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45681c]
mov eax, 0x31a5bd5f
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push ebp
mov dword [0x456830], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe8c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.0042a171
add esp, 0xe80
ret