Function at 0x405ea0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe84
mov eax, dword [0x45e640]
mov ecx, dword [0x45ccdc]
xor eax, esp
mov dword [esp + 0xe80], eax
mov eax, dword [esp + 0xe88]
mov dword [esp + 0xc], eax
mov eax, 0x44fc3a35
imul ecx
mov eax, dword [0x45ccc8]
sar edx, 0xb
imul eax, eax, 0x1545
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [0x45ccd8]
push ebx
push ebp
push esi
mov esi, ecx
imul esi, esi, 0x1db0
sub esi, edx
add esi, eax
mov eax, 0x6f9f33f1
imul ecx
mov ecx, dword [0x45ccd0]
push edi
sar edx, 0xb
add esi, edx
mov edi, edx
mov eax, 0x5df55b35
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0xa74
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45cce4]
sub edi, ecx
add edi, edx
sub edi, esi
push 0
sub edi, 0x1259
push 2
mov dword [0x45ccd0], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45cccc]
mov ebx, eax
mov esi, dword [0x45ccd4]
mov eax, 0x4227fdad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xbb03c5cb
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x44fc3a35
imul ecx
imul ecx, ecx, 0x1865
sub ebp, edi
sar edx, 0xb
add ebp, edx
mov edi, edx
mov eax, 0x5c9900d1
imul esi
shr edi, 0x1f
add edi, ebp
sar edx, 0xb
add edi, ecx
mov ecx, edx
mov dword [esp + 0x18], ebx
shr ecx, 0x1f
mov esi, dword [0x45ccdc]
mov eax, dword [0x45cce8]
add edi, edx
imul eax, eax, 0xa74
mov edx, esi
imul edx, edx, 0x1545
add ecx, edi
add ecx, edx
add ecx, eax
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x2b63
mov edx, esi
imul edx, edx, 0x1865
add ecx, edx
mov eax, 0x5c9900d1
imul esi
mov eax, dword [0x45ccd8]
imul eax, eax, 0x1545
sar edx, 0xb
add ecx, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, ecx
add ebp, eax
mov eax, 0x6614bc37
imul esi
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cce0]
sub ebp, ecx
lea ecx, [esp + 0xe8]
push ecx
lea eax, [edx + ebp - 0x1259]
push ebx
mov dword [esp + 0xf0], 0x128
xor edi, edi
mov dword [0x45ccd4], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x406055
or eax, 0xffffffff
jmp 0x406495
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45cce4]
mov eax, 0x53f407b5
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xc09370e3
imul esi
add edx, esi
mov esi, dword [0x45cce0]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x45ccc8]
imul eax, eax, 0x1259
mov edx, esi
imul edx, edx, 0x1481
sub ebx, edx
add ebx, eax
mov eax, 0x6f9f33f1
imul ecx
sar edx, 0xb
add ebx, edx
mov ebp, edx
mov eax, 0x2f1d432d
imul ecx
shr ebp, 0x1f
sar edx, 9
add ebp, ebx
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov dword [0x45ccc8], ecx
xor eax, eax
jmp 0x4060e0
mov dl, byte [esp + eax + 0x10c]
mov byte [esp + eax + 0x210], dl
inc eax
test dl, dl
jne 0x4060e0
mov ebx, dword [0x45cce8]
imul ecx, ecx, 0x161e
mov eax, 0x53f407b5
imul ebx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd4]
mov ebp, eax
mov eax, 0xa366ff2f
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
add eax, ecx
mov ecx, ebx
imul ecx, ecx, 0x1259
sub eax, ecx
mov ebp, eax
mov eax, 0x61f60d03
imul ebx
sar edx, 0xa
mov ecx, edx
add ebp, edx
mov eax, 0x6614bc37
imul esi
imul esi, esi, 0xa08
shr ecx, 0x1f
sar edx, 0xa
add ecx, ebp
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x214]
add eax, esi
push edx
mov dword [0x45ccd8], eax
call fcn.0043a98e
mov ebx, dword [0x45cce4]
mov ecx, dword [0x45cce0]
add esp, 8
test eax, eax
jne 0x40620d
mov esi, dword [0x45ccd4]
mov eax, 0x5c9900d1
imul esi
mov edi, ecx
imul edi, edi, 0x1865
sar edx, 0xb
add edi, edx
mov ebp, edx
mov eax, 0xc09370e3
imul esi
add edx, esi
sar edx, 0xc
shr ebp, 0x1f
mov esi, edx
add ebp, edi
add ebp, edx
mov edx, dword [0x45cce8]
mov eax, ebx
imul edx, edx, 0xa74
imul eax, eax, 0x1259
shr esi, 0x1f
add esi, ebp
add esi, eax
sub esi, edx
mov edx, dword [0x45cccc]
mov eax, 0x6614bc37
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, dword [str._r_____r____]
add eax, 0xae6
mov dword [0x45cccc], eax
mov edi, 1
mov esi, dword [0x45ccd0]
imul ecx, ecx, 0x1481
mov eax, 0x53f407b5
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0xc09370e3
imul ebx
add edx, ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
sub ebp, ecx
mov ecx, dword [0x45ccc8]
imul ecx, ecx, 0x1259
mov eax, 0x6f9f33f1
imul esi
add ebp, ecx
sar edx, 0xb
add ebp, edx
mov ecx, edx
mov eax, 0x2f1d432d
imul esi
shr ecx, 0x1f
sar edx, 9
add ecx, ebp
mov ebp, dword [esp + 0x18]
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
lea ecx, [esp + 0xe8]
push ecx
push ebp
mov dword [0x45ccc8], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40641d
mov eax, edi
shl eax, 6
lea edx, [esp + 0x10c]
lea ebx, [esp + eax + 0x210]
sub eax, edx
lea esi, [esp + eax + 0x210]
mov dword [esp + 0x10], esi
jmp 0x4062c0
lea eax, [esp + 0x10c]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x4062c7
mov ecx, dword [0x45ccd4]
mov ebp, dword [0x45cce0]
imul ebp, ebp, 0x1865
mov eax, 0x5c9900d1
imul ecx
sar edx, 0xb
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov dword [esp + 0x14], eax
mov eax, 0xc09370e3
imul ecx
mov eax, dword [esp + 0x14]
add edx, ecx
mov ecx, dword [0x45cce8]
sar edx, 0xc
imul ecx, ecx, 0xa74
add eax, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, eax
mov eax, dword [0x45cce4]
imul eax, eax, 0x1259
add ebp, eax
sub ebp, ecx
mov ecx, dword [0x45cccc]
mov eax, 0x6614bc37
imul ecx
mov ecx, dword [esp + 0x1c]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [str._r_____r____]
add eax, ebp
sub eax, edx
push ecx
add eax, 0xae6
push ebx
mov dword [0x45cccc], eax
call fcn.0043a98e
add esp, 8
test eax, eax
jne 0x406403
mov ecx, dword [0x45cccc]
mov edx, dword [0x45ccd0]
mov esi, dword [0x45cce4]
lea ebp, [ecx + edx]
mov eax, 0x44fc3a35
imul ebp, ebp, 0x1ef5
imul esi
sar edx, 0xb
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x5c9900d1
imul esi
sar edx, 0xb
add ebp, edx
mov esi, edx
mov eax, 0xc09370e3
imul ecx
add edx, ecx
mov ecx, dword [0x45ccdc]
sar edx, 0xc
imul ecx, ecx, 0x1259
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
shr esi, 0x1f
imul edx, edx, 0xade
add esi, ebp
sub esi, eax
mov eax, dword [esp + 0xf0]
add esi, ecx
add esi, edx
mov dword [0x45ccdc], esi
mov esi, dword [esp + 0x10]
mov dword [esp + edi*4 + 0x20], eax
inc edi
add ebx, 0x40
add esi, 0x40
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0xe8]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4062c0
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
lea esi, [ecx + edx]
mov eax, 0x4227fdad
imul esi, esi, 0xae6
imul ecx
mov eax, dword [0x45ccdc]
mov ecx, dword [0x45cccc]
imul eax, eax, 0x1259
sar edx, 0xb
mov ebx, edx
shr ebx, 0x1f
add esi, edx
add ebx, esi
sub ebx, eax
mov eax, 0x5df55b35
imul ecx
mov eax, dword [0x45ccd8]
sar edx, 0xa
imul eax, eax, 0xade
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccd4]
imul edx, edx, 0xa74
sub ebx, ecx
sub ebx, edx
add ebx, eax
push ebp
mov dword [0x45cce0], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0xe90]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042fe7d
add esp, 0xe84
ret