Function at 0x40f3a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x964
mov eax, dword [0x460640]
xor eax, ebp
mov dword [esp + 0x960], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [0x45ecd4]
push esi
mov esi, dword [0x45eccc]
cdq
push edi
mov edi, eax
push 2
mov ebx, edx
mov eax, esi
cdq
push 0xb57eb16
push edx
push eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
call fcn.004319f0
push 2
push 0xb57eb16
push ebx
push edi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
push 1
push 0xeae0c6d3
mov edx, ebx
push edx
sub ecx, eax
push edi
mov dword [esp + 0x20], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push 1
add ecx, eax
mov eax, dword [esp + 0x28]
push 0x86050f76
push eax
push edx
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul esi, esi, 0x140cef57
mov ecx, dword [esp + 0x10]
mov edx, dword [0x45ecdc]
sub ecx, eax
imul edx, edx, 0x5295f78d
mov eax, dword [0x45ece8]
imul eax, eax, 0x6b66a94
sub ecx, esi
add ecx, eax
add ecx, edx
mov dword [str._r_____r____], ecx
xor eax, eax
mov byte [esp + 0x168], 0
mov ecx, 0x1ff
lea edi, [esp + 0x169]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x16c]
push 0x44effc
push ecx
call fcn.00431a9a
mov esi, dword [0x45ecd0]
mov eax, esi
cdq
mov edi, eax
mov eax, dword [0x45ece4]
mov ebx, edx
add esp, 0xc
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
push 1
push 0xebf310a9
push ebx
push edi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, eax
mov eax, dword [esp + 0x10]
sub ecx, eax
mov eax, 0x4d7937c3
mul esi
shr edx, 0x1e
add ecx, edx
mov edx, dword [0x45ece0]
imul edx, edx, 0x7f4ea4e2
mov edi, dword [0x45ece8]
sub ecx, edx
imul edi, edi, 0x6b66a94
mov eax, 0x2a01e433
imul esi
mov eax, dword [0x45ecc8]
imul eax, eax, 0x6181b446
sar edx, 0x1c
mov esi, edx
add ecx, edx
shr esi, 0x1f
add esi, ecx
add esi, eax
mov eax, dword [0x45ecd4]
push 1
cdq
push 0xeae0c6d3
mov ebx, eax
push edx
push ebx
mov dword [0x45ecc8], esi
mov dword [esp + 0x3c], edx
call fcn.004319f0
mov ecx, dword [esp + 0x2c]
push 1
push 0x5295f78d
push ecx
push ebx
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
add ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [0x45eccc]
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [esp + 0x10]
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece4]
shr ecx, 0x1f
imul edx, edx, 0x6181b446
add eax, ecx
mov ecx, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0x140cef57
sub ecx, eax
mov eax, dword [0x45ecdc]
add ecx, edx
mov edx, dword [str._r_____r____]
sub ecx, edi
sub ecx, edx
sub ecx, 0x4f64023c
push 2
mov dword [0x45eccc], ecx
mov dword [esp + 0x18], 0
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov ecx, dword [esp + 0x18]
push 0xfffffffffffffffe
mov ebx, eax
mov eax, dword [esp + 0x20]
push 0x4f64023c
push eax
push ecx
call fcn.004319f0
imul esi, esi, 0x5295f78d
mov ecx, dword [0x45ecd8]
mov edx, ecx
imul edx, edx, 0xb57eb16
sub eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x2a01e433
imul ecx
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
sub eax, dword [0x45ece4]
push 0
lea ecx, [eax + edi - 0x6181b446]
push 2
mov dword [0x45ecd0], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
push 1
mov dword [esp + 0x1c], edi
push 0xeae0c6d3
jne 0x40f6d1
mov esi, dword [0x45ecdc]
mov eax, esi
cdq
push edx
push eax
call fcn.004319f0
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ecd8]
add edx, ecx
imul ecx, ecx, 0x151f392d
imul edx, edx, 0x5295f78d
mov edi, eax
add edi, edx
mov eax, 0x2a215c6f
mul esi
mov eax, esi
imul esi, esi, 0x140cef57
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
sub edi, eax
sub edi, esi
sub edi, ecx
mov ecx, dword [0x45ece0]
lea edx, [edi + ecx - 0x6181b446]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45ecd4], edx
call fcn.004325a6
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x960]
xor ecx, ebp
call fcn.0043180d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45ece8]
cdq
mov ebx, eax
mov eax, dword [0x45ecd4]
mov esi, edx
cdq
push edx
push eax
mov dword [esp + 0x44], esi
call fcn.004319f0
push 2
push 0x6b66a94
push esi
push ebx
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov esi, dword [0x45ece0]
sub eax, ecx
mov ecx, eax
mov eax, 0x2a215c6f
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
push 1
add eax, edx
mov edx, dword [esp + 0x38]
push 0xebf310a9
shr eax, 0x1f
push edx
add ecx, eax
push ebx
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul esi, esi, 0x242d3a05
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x6181b446
sub ecx, eax
mov eax, dword [0x45ecc8]
imul eax, eax, 0x151f392d
sub ecx, eax
sub ecx, esi
mov dword [0x45ecd8], ecx
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x48], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40f830
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
mov esi, eax
push 0xfffffffffffffffe
mov dword [esp + 0x38], edx
mov eax, ebx
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd0]
mov ecx, dword [esp + 0x34]
add edx, ebx
imul edx, edx, 0x79faf08a
push 2
push 0xb57eb16
push ecx
sub eax, edx
push esi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
push 1
push 0xeae0c6d3
push edx
add ecx, eax
push esi
mov dword [esp + 0x20], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [0x45ecdc]
add ecx, eax
imul edx, edx, 0x6181b446
mov eax, dword [0x45ece0]
imul eax, eax, 0x2c857103
sub ecx, eax
add ecx, edx
push edi
mov dword [0x45ecdc], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x960]
xor ecx, ebp
call fcn.0043180d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45ecd0]
mov esi, dword [0x45ece8]
lea ebx, [eax + esi]
mov eax, dword [0x45eccc]
imul ebx, ebx, 0x4f64023c
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
sub eax, ebx
mov ebx, eax
push 1
mov eax, esi
cdq
push 0x86050f76
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd4]
imul ecx, ecx, 0x6b66a94
mov edx, dword [0x45ecd8]
add ebx, eax
imul edx, edx, 0x2c857103
mov eax, dword [0x45ecdc]
imul eax, eax, 0x6181b446
sub ebx, ecx
sub ebx, edx
lea ecx, [esp + 0x168]
push ecx
lea edx, [esp + 0x68]
sub ebx, eax
push edx
mov dword [0x45ece0], ebx
call fcn.0043c32e
add esp, 8
test eax, eax
je 0x40fd7b
mov esi, dword [0x45ecc8]
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
mov edi, eax
mov eax, dword [0x45ecd8]
add eax, ecx
imul ecx, ecx, 0x151f392d
imul eax, eax, 0x140cef57
sub edi, eax
mov eax, 0x4d7937c3
mul dword [str._r_____r____]
shr edx, 0x1e
sub edi, edx
mov eax, 0x2a215c6f
mul esi
mov eax, dword [esp + 0x48]
sub esi, edx
shr esi, 1
add esi, edx
mov edx, dword [0x45ece4]
imul edx, edx, 0x6181b446
shr esi, 0x1f
add edi, esi
push eax
sub edi, edx
push 0
add edi, ecx
push 0x1f0fff
mov dword [0x45ece8], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45eccc]
mov dword [esp + 0x3c], eax
mov eax, dword [0x45ecd4]
cdq
mov edi, eax
push 2
mov ebx, edx
mov eax, esi
cdq
push 0xb57eb16
push edx
push eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
call fcn.004319f0
push 2
push 0xb57eb16
push ebx
push edi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
push 1
push 0xeae0c6d3
mov edx, ebx
push edx
sub ecx, eax
push edi
mov dword [esp + 0x20], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push 1
add ecx, eax
mov eax, dword [esp + 0x28]
push 0x86050f76
push eax
push edx
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul esi, esi, 0x140cef57
mov ecx, dword [esp + 0x10]
sub ecx, eax
sub ecx, esi
mov eax, dword [0x45ece8]
mov edx, dword [0x45ecdc]
imul eax, eax, 0x6b66a94
mov esi, dword [esp + 0x3c]
imul edx, edx, 0x5295f78d
add ecx, eax
add ecx, edx
test esi, esi
mov dword [str._r_____r____], ecx
jne 0x40f9ff
push 0x44efc8
call fcn.004325a6
add esp, 4
jmp 0x40fa8d
mov edi, dword [0x45ecd0]
push 1
mov eax, edi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov ebx, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
sub ebx, eax
mov eax, 0x4d7937c3
mul edi
mov eax, dword [0x45ece0]
imul eax, eax, 0x7f4ea4e2
shr edx, 0x1e
add ebx, edx
sub ebx, eax
mov eax, 0x2a01e433
imul edi
sar edx, 0x1c
mov ecx, edx
add ebx, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x6181b446
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
push esi
mov dword [0x45ecc8], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40fa86
push 0x44efb4
call fcn.004325a6
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004319f0
push 1
push 0x5295f78d
push edi
push esi
mov ebx, eax
call fcn.004319f0
mov ecx, dword [0x45eccc]
add ebx, eax
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [0x45ece0]
sub ecx, edx
imul eax, eax, 0x140cef57
mov edi, dword [esp + 0x18]
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece4]
shr ecx, 0x1f
imul edx, edx, 0x6181b446
add ebx, ecx
mov ecx, dword [0x45ece8]
imul ecx, ecx, 0x6b66a94
sub ebx, eax
mov eax, dword [str._r_____r____]
sub ebx, ecx
add ebx, edx
sub ebx, eax
lea eax, [esp + 0x40]
push eax
sub ebx, 0x4f64023c
push edi
mov dword [0x45eccc], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40f830
mov esi, dword [0x45ece4]
mov eax, dword [0x45ecdc]
push 2
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov ebx, eax
mov eax, dword [0x45ecd0]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ece8]
mov ecx, dword [0x45ecd8]
imul edx, edx, 0x6b66a94
sub eax, ebx
add eax, edx
mov edx, ecx
imul edx, edx, 0xb57eb16
add eax, edx
mov ebx, eax
mov eax, 0x2a01e433
imul ecx
mov eax, dword [0x45ecc8]
imul eax, eax, 0x5295f78d
sar edx, 0x1c
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
add ecx, eax
sub ecx, esi
sub ecx, 0x6181b446
push edi
mov dword [0x45ecd0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40f6ba
mov esi, dword [0x45ecdc]
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ecd8]
add edx, ecx
imul ecx, ecx, 0x151f392d
imul edx, edx, 0x5295f78d
mov edi, eax
add edi, edx
mov eax, 0x2a215c6f
mul esi
mov eax, esi
imul esi, esi, 0x140cef57
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
sub edi, eax
mov eax, dword [esp + 0x48]
sub edi, esi
sub edi, ecx
mov ecx, dword [0x45ece0]
push eax
push 0
lea edx, [edi + ecx - 0x6181b446]
push 0x1f0fff
mov dword [0x45ecd4], edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45eccc]
mov dword [esp + 0x10], eax
mov eax, dword [0x45ecd4]
cdq
push 1
mov edi, eax
mov ebx, edx
push 0xeae0c6d3
mov eax, esi
cdq
push ebx
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
call fcn.004319f0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 2
push 0xb57eb16
push ecx
push edx
mov dword [esp + 0x24], eax
call fcn.004319f0
push 2
push 0xb57eb16
push ebx
push edi
mov dword [esp + 0x28], eax
call fcn.004319f0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push 1
sub ecx, eax
mov eax, dword [esp + 0x28]
push 0x86050f76
push eax
push edx
mov dword [esp + 0x28], ecx
call fcn.004319f0
imul esi, esi, 0x140cef57
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
sub ecx, eax
sub ecx, esi
mov esi, dword [0x45ece8]
mov eax, esi
imul eax, eax, 0x6b66a94
mov edx, dword [0x45ecdc]
imul edx, edx, 0x5295f78d
add eax, ebx
add eax, ecx
add edx, eax
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [str._r_____r____], edx
je 0x40f6ba
push 2
mov eax, esi
cdq
push 0x6b66a94
mov ebx, eax
push edx
push ebx
mov dword [esp + 0x44], edx
call fcn.004319f0
mov edi, dword [0x45ece0]
mov ecx, eax
mov eax, 0x2a215c6f
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
push 1
add eax, edx
mov edx, dword [esp + 0x38]
push 0xebf310a9
shr eax, 0x1f
push edx
add ecx, eax
push ebx
mov dword [esp + 0x28], ecx
call fcn.004319f0
imul esi, esi, 0x6181b446
imul edi, edi, 0x242d3a05
mov ecx, dword [esp + 0x18]
sub ecx, eax
mov eax, dword [0x45ecc8]
imul eax, eax, 0x151f392d
sub ecx, esi
sub ecx, eax
mov eax, dword [esp + 0x14]
sub ecx, edi
sub ecx, eax
mov eax, dword [esp + 0x10]
mov dword [0x45ecd8], ecx
mov ecx, dword [esp + 0x96c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043180d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45ecd8]
cdq
mov dword [esp + 0x28], eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov dword [esp + 0x30], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd4]
mov edx, dword [0x45ecc8]
mov ebx, dword [str._r_____r____]
add edx, ecx
imul edx, edx, 0x242d3a05
mov esi, eax
push 1
sub esi, edx
mov eax, ebx
cdq
push 0xb09bfdc4
push edx
push eax
call fcn.004319f0
mov ecx, dword [esp + 0x28]
push 1
add esi, eax
mov eax, dword [esp + 0x30]
push 0xeae0c6d3
push eax
push ecx
call fcn.004319f0
mov edx, dword [esp + 0x2c]
push 1
push 0x86050f76
sub esi, eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.004319f0
imul ebx, ebx, 0x151f392d
mov ecx, dword [esp + 0x48]
sub esi, eax
sub esi, ebx
mov dword [0x45ece4], esi
mov dword [esp + 0x14], ecx
jmp 0x40fb28