Function at 0x404ef0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe7c
mov eax, dword [0x457000]
mov dword [esp + 0xe78], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x455690]
mov eax, 0x443d7153
imul ecx
mov ecx, dword [0x45569c]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xd816735f
imul ecx
mov eax, dword [0x455688]
mov ebx, dword [0x4556a0]
imul eax, eax, 0xe0e
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4556a8]
imul edx, edx, 0x19a8
sub ecx, esi
add ecx, edx
add ecx, eax
sub ecx, ebx
push 0
sub ecx, 0x544
push 2
mov dword [0x455690], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [0x45569c]
mov ebx, dword [0x4556a8]
mov ebp, eax
imul ebx, ebx, 0x212c
mov eax, 0x73b2d479
imul edi
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x455690]
mov esi, dword [0x45568c]
mov eax, 0x27e98ca1
imul esi, esi, 0x11be
imul ecx
mov ecx, dword [0x455694]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x5d0a95d5
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455698]
add ebx, esi
imul edx, edx, 0xe0e
add ecx, ebx
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x1603
add ecx, edx
mov eax, 0x4b438bdf
imul edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
xor ebx, ebx
mov dword [esp + 0x14], ebp
mov dword [esp + 0xe0], 0x128
add ecx, esi
mov edx, dword [0x4556a4]
lea eax, [ecx + edx - 0x544]
lea ecx, [esp + 0xe0]
push ecx
push ebp
mov dword [0x455694], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x405055
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe78]
call fcn.00429441
add esp, 0xe7c
ret
mov ecx, dword [0x45569c]
mov esi, dword [0x4556a0]
mov eax, 0x5d929e5d
imul ecx
mov ecx, dword [0x4556a4]
sar edx, 0xb
mov edi, esi
imul edi, edi, 0x2367
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
mov edi, eax
mov eax, 0x48dbb693
imul ecx
mov eax, dword [0x455688]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455690]
imul edx, edx, 0x544
sub edi, ecx
mov ecx, dword [str._r_____r____]
sub edi, edx
add edi, ecx
add eax, edi
mov dword [0x455688], eax
xor eax, eax
jmp 0x4050c0
mov cl, byte [esp + eax + 0x104]
mov byte [esp + eax + 0x208], cl
inc eax
test cl, cl
jne 0x4050c0
mov ecx, dword [0x455698]
imul esi, esi, 0xd9b
mov eax, 0x3dbd3249
imul ecx
mov ecx, dword [0x455694]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x5d0a95d5
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x4556a8]
mov eax, 0x736e5bc3
imul ecx
imul ecx, ecx, 0x544
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, esi
sub edi, ecx
mov ecx, dword [esp + 0xe90]
push ecx
lea edx, [esp + 0x20c]
push edx
mov dword [0x455698], edi
call fcn.00433ece
mov ecx, dword [0x455690]
mov esi, dword [0x4556a0]
add esp, 8
test eax, eax
jne 0x4051b7
mov edi, dword [0x4556a8]
mov eax, 0x5d0a95d5
imul edi, edi, 0x212c
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x11be
mov ebx, eax
sub ebx, edi
mov edi, dword [0x455694]
add ebx, edx
mov edx, dword [0x45568c]
mov eax, 0x4b438bdf
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, edi
add eax, 0x1e03
mov dword [0x45568c], eax
mov ebx, 1
mov edx, dword [0x45569c]
imul esi, esi, 0x2367
imul ecx, ecx, 0x544
mov eax, 0x5d929e5d
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov edi, eax
mov eax, 0x48dbb693
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, esi
sub edi, eax
mov eax, dword [0x455688]
sub edi, ecx
add edi, dword [str._r_____r____]
lea ecx, [esp + 0xe0]
push ecx
add eax, edi
push ebp
mov dword [0x455688], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405357
mov eax, ebx
shl eax, 6
lea edx, [esp + 0x104]
lea esi, [esp + eax + 0x208]
sub eax, edx
lea edi, [esp + eax + 0x208]
lea ecx, [ecx]
lea eax, [esp + 0x104]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x405247
mov eax, dword [0x4556a8]
mov ecx, dword [0x455690]
imul eax, eax, 0x212c
mov dword [esp + 0x10], eax
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x4556a0]
imul ecx, ecx, 0x11be
add eax, ecx
mov ecx, dword [0x45568c]
mov dword [esp + 0x10], eax
mov eax, 0x4b438bdf
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add ecx, edx
mov edx, dword [0x455694]
add eax, ecx
mov ecx, dword [esp + 0xe90]
sub eax, edx
push ecx
add eax, 0x1e03
push esi
mov dword [0x45568c], eax
call fcn.00433ece
add esp, 8
test eax, eax
jne 0x405341
mov ecx, dword [0x455694]
mov ebp, dword [0x455690]
imul ebp, ebp, 0x2367
mov eax, 0x27e98ca1
imul ecx
imul ecx, ecx, 0x544
sar edx, 0xa
add ebp, edx
mov eax, edx
mov edx, dword [0x45568c]
shr eax, 0x1f
add eax, ebp
mov ebp, edx
imul ebp, ebp, 0x15e3
add eax, ebp
mov ebp, eax
mov eax, 0x48dbb693
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov ecx, dword [esp + 0xe8]
mov dword [esp + ebx*4 + 0x18], ecx
mov dword [0x45569c], ebp
mov ebp, dword [esp + 0x14]
inc ebx
add esi, 0x40
add edi, 0x40
lea edx, [esp + 0xe0]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405240
mov ecx, dword [0x45568c]
mov eax, 0x443d7153
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xb
imul ecx, ecx, 0x1e03
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
imul edx, edx, 0x108d
sub ecx, eax
sub ecx, edx
push ebp
mov dword [0x4556a0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe88]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
call fcn.00429441
add esp, 0xe7c
ret