Function at 0x40ba20
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9b8
mov eax, dword [0x457000]
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45569c]
mov edi, dword [0x4556a8]
mov esi, eax
imul edi, edi, 0x212c
mov eax, 0x73b2d479
imul ecx
mov ecx, dword [0x455690]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x27e98ca1
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x455694]
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [0x45568c]
imul ecx, ecx, 0x11be
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edi, edx
lea edx, [esp + 0x94]
add eax, edi
push edx
add eax, ecx
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x9c], 0x128
mov dword [str._r_____r____], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40baea
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x9b4]
call fcn.00429441
add esp, 0x9b8
ret
mov ecx, dword [0x4556a8]
mov eax, 0x5d0a95d5
imul ecx, ecx, 0x212c
imul dword [0x455690]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, ecx
mov ecx, dword [0x4556a0]
imul ecx, ecx, 0x11be
add edi, ecx
mov ecx, dword [0x45568c]
mov eax, 0x4b438bdf
imul ecx
mov ecx, dword [0x455694]
sar edx, 0xa
mov esi, edx
shr esi, 0x1f
add edi, edx
add esi, edi
sub esi, ecx
add esi, 0x1e03
mov dword [0x45568c], esi
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0xb8]
mov byte [esp + eax + 0x1bc], cl
inc eax
test cl, cl
jne 0x40bb50
mov edi, dword [str._r_____r____]
mov eax, dword [0x455698]
imul edi, edi, 0x1603
mov ecx, dword [0x45569c]
imul eax, eax, 0xe0e
mov edx, esi
imul edx, edx, 0x11be
add edi, edx
add edi, eax
mov eax, 0x4b438bdf
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub edi, eax
push ebx
lea ebx, [edi + edx - 0x544]
push ebp
mov ebp, dword [esp + 0x9cc]
mov dword [0x455694], ebx
lea edi, [esp + 0x1c4]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40bbe7
test al, al
je 0x40bbe3
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40bbe7
add edi, 2
add ebp, 2
test al, al
jne 0x40bbc2
xor eax, eax
jmp 0x40bbec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40bc41
mov edi, dword [0x455690]
mov eax, 0x27e98ca1
imul edi, edi, 0x2367
imul ebx
imul ebx, ebx, 0x544
mov eax, esi
imul eax, eax, 0x15e3
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
add ecx, eax
mov eax, 0x48dbb693
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, ebx
mov dword [0x45569c], ecx
mov ebp, 1
jmp 0x40bc45
mov ebp, dword [esp + 0x10]
mov eax, 0x73b2d479
imul ecx
imul ecx, ecx, 0x1603
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xd816735f
imul dword [0x4556a4]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x5d0a95d5
imul esi
sar edx, 0xb
sub ebx, edi
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455688]
imul edx, edx, 0xd9b
sub ebx, ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x9c]
push eax
add ebx, edx
push ecx
mov dword [0x4556a4], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40be21
mov eax, ebp
shl eax, 6
lea edx, [esp + eax + 0x1c4]
lea ecx, [esp + 0xc0]
sub eax, ecx
lea esi, [esp + eax + 0x1c4]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], esi
jmp 0x40bce4
mov esi, dword [esp + 0x10]
mov ebx, dword [0x4556a0]
mov eax, 0x5d929e5d
imul dword [0x45569c]
sar edx, 0xb
mov ecx, ebx
imul ecx, ecx, 0x2367
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, ecx
mov ecx, dword [0x4556a4]
mov eax, 0x48dbb693
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455690]
imul edx, edx, 0x544
sub edi, ecx
mov ecx, dword [str._r_____r____]
sub edi, edx
add edi, ecx
mov ecx, dword [0x455688]
add ecx, edi
mov dword [0x455688], ecx
lea eax, [esp + 0xc0]
nop
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40bd50
mov edi, dword [esp + 0x9cc]
mov esi, dword [esp + 0x18]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40bd89
test al, al
je 0x40bd85
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40bd89
add esi, 2
add edi, 2
test al, al
jne 0x40bd65
xor eax, eax
jmp 0x40bd8e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40be07
mov esi, dword [0x4556a8]
imul ecx, ecx, 0xe0e
mov eax, 0x443d7153
imul esi, esi, 0x19a8
imul dword [0x455690]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x27e98ca1
imul dword [0x45569c]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
sub esi, eax
add esi, ecx
mov ecx, dword [esp + 0xa4]
sub esi, ebx
mov dword [esp + ebp*4 + 0x1c], ecx
mov ecx, dword [esp + 0x10]
sub esi, 0x544
mov eax, 0x40
add edx, eax
inc ebp
add ecx, eax
mov dword [0x455690], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x9c]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40bce0
mov ecx, dword [0x455698]
mov eax, 0x3dbd3249
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x455694]
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [0x4556a8]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x736e5bc3
imul ecx
imul ecx, ecx, 0x544
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a0]
imul edx, edx, 0xd9b
sub esi, eax
mov eax, dword [esp + 0x14]
add esi, edx
sub esi, ecx
push eax
mov dword [0x455698], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c4]
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
call fcn.00429441
add esp, 0x9b8
ret