Function at 0x404920
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x455e64]
push esi
push 0
push 2
mov dword [esp + 0x9c4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x454e08]
mov esi, eax
mov eax, 0x9a96bd3d
imul ecx
add edx, ecx
mov ecx, dword [0x454dfc]
sar edx, 0xc
imul ecx, ecx, 0x1628
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e14]
sub ecx, eax
imul edx, edx, 0x10a2
mov eax, dword [0x454df8]
imul eax, eax, 0x9f1
add ecx, edx
lea edx, [esp + 0x94]
push edx
lea ecx, [ecx + eax + 0x20a4]
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x9c], 0x128
mov dword [str._r_____r_____n], ecx
mov dword [esp + 0xc], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4049cb
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x9b8]
call fcn.004274c1
add esp, 0x9bc
ret
mov ecx, dword [0x454e00]
mov eax, 0x1f5f3801
imul ecx, ecx, 0x16c0
imul dword [0x454dfc]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e14]
sub eax, ecx
imul edx, edx, 0x10a2
mov ecx, dword [0x454e0c]
imul ecx, ecx, 0x9f1
push ebx
sub eax, edx
lea ebx, [eax + ecx + 0x1697]
push ebp
push edi
mov dword [0x454df8], ebx
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0xc4]
mov byte [esp + eax + 0x1c8], cl
inc eax
test cl, cl
jne 0x404a20
mov ecx, dword [0x454e08]
mov esi, dword [0x454e10]
mov eax, 0xb40b40b5
imul esi, esi, 0x1b7b
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
mov ebp, dword [esp + 0x9d0]
imul edx, edx, 0x108a
sub esi, eax
add esi, edx
mov eax, ebx
imul eax, eax, 0x9f1
lea esi, [esi + eax + 0x20a4]
mov dword [0x454e00], esi
lea edi, [esp + 0x1c8]
jmp 0x404a90
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x404ab5
test al, al
je 0x404ab1
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x404ab5
add edi, 2
add ebp, 2
test al, al
jne 0x404a90
xor eax, eax
jmp 0x404aba
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x404afd
mov eax, dword [0x454dfc]
imul esi, esi, 0x1b7c
imul eax, eax, 0x1a7f
add esi, eax
mov eax, ebx
imul eax, eax, 0x1988
sub esi, eax
mov eax, 0x3de9fdd3
imul ebx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, esi
mov dword [0x454e08], ecx
mov ebp, 1
jmp 0x404b01
mov ebp, dword [esp + 0x10]
mov edx, dword [0x454df4]
imul ecx, ecx, 0x20a4
imul edx, edx, 0x16c0
add ecx, edx
mov eax, 0x5c6f35cd
imul dword [0x454e10]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
sub ecx, eax
sub ecx, ebx
add ecx, 0x625
mov dword [0x454e10], ecx
lea ecx, [esp + 0xa0]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x404ce9
mov eax, ebp
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea esi, [esp + eax + 0x1c8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], esi
jmp 0x404b80
mov esi, dword [esp + 0x10]
mov edi, edi
mov ecx, dword [0x454df4]
mov ebx, dword [0x454e0c]
mov edi, dword [0x454e08]
mov eax, 0x950d22f9
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, ebx
imul ecx, ecx, 0x1a7f
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, eax
mov eax, 0xa06e4bd5
imul edi
add edx, edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [0x454e10]
mov eax, 0x3de9fdd3
imul ecx
mov eax, dword [esp + 0x14]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
add eax, dword [str._r_____r_____n]
mov dword [0x454df4], eax
lea eax, [esp + 0xc4]
lea esp, [esp]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x404c00
mov esi, dword [esp + 0x9d0]
mov eax, dword [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x404c39
test cl, cl
je 0x404c35
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x404c39
add eax, 2
add esi, 2
test cl, cl
jne 0x404c15
xor eax, eax
jmp 0x404c3e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x404ccf
mov ecx, dword [0x454dfc]
mov eax, 0x2d5481cb
imul ecx
mov ecx, dword [0x454e14]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x5c6f35cd
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x5c6f35cd
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, esi
sub ecx, eax
mov eax, 0x3de9fdd3
imul ebx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x1c]
sub ecx, eax
sub ecx, 0x1b7b
mov dword [0x454dfc], ecx
mov ecx, dword [esp + 0xa8]
mov dword [esp + ebp*4 + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov eax, 0x40
add edx, eax
inc ebp
add ecx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xa0]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404b7a
mov ecx, dword [0x454e00]
mov eax, 0x1f5f3801
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x454e14]
mov eax, 0x1f5f3801
imul ecx
imul ecx, ecx, 0x1b7b
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
sub edi, ecx
mov ecx, dword [0x454e04]
mov eax, 0x7b214ec3
imul ecx
mov eax, dword [esp + 0x18]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add edi, edx
lea edx, [ecx + edi + 0x16c0]
push eax
mov dword [0x454e04], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
pop edi
mov eax, ebp
pop ebp
pop ebx
pop esi
call fcn.004274c1
add esp, 0x9bc
ret