Function at 0x40bc00
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9b8
mov eax, dword [0x456fc0]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45569c]
mov esi, eax
mov eax, 0x59da2e6b
imul ecx
mov ecx, dword [0x455690]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x9cbd99d5
imul ecx
mov eax, dword [0x4556a8]
sar edx, 0xb
imul eax, eax, 0xaef
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x140f
mov ebx, ecx
mov ecx, dword [0x455694]
sub ebx, edi
add ebx, edx
add ebx, eax
mov eax, 0x4700d503
imul ecx
sar edx, 9
mov ecx, edx
add ebx, edx
lea edx, [esp + 0x98]
shr ecx, 0x1f
push edx
add ecx, ebx
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xa0], 0x128
mov dword [str._r_____r____], ecx
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40bcd0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b4]
call fcn.0042904d
add esp, 0x9b8
ret
mov ecx, dword [0x45568c]
mov esi, dword [0x4556a0]
mov ebx, dword [0x455690]
imul esi, esi, 0x140f
mov eax, 0x903bb8bb
imul ecx
add edx, ecx
sar edx, 0xb
add esi, edx
mov ecx, edx
mov edx, dword [0x4556a8]
imul edx, edx, 0xaef
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
mov eax, 0x4700d503
imul ebx
sar edx, 9
mov esi, edx
shr esi, 0x1f
add ecx, edx
add esi, ecx
sub esi, dword [0x455694]
add esi, 0x11d7
mov dword [0x45568c], esi
xor eax, eax
jmp 0x40bd40
mov cl, byte [esp + eax + 0xbc]
mov byte [esp + eax + 0x1c0], cl
inc eax
test cl, cl
jne 0x40bd40
mov eax, dword [0x455698]
mov ecx, dword [0x45569c]
imul eax, eax, 0x12b9
mov edi, esi
imul edi, edi, 0x140f
add edi, eax
mov eax, 0x903bb8bb
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x736
sub edi, eax
add edi, dword [0x4556a4]
lea eax, [edx + edi - 0x5cc]
push ebp
mov ebp, dword [esp + 0x9cc]
mov dword [0x455694], eax
lea edi, [esp + 0x1c4]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40bdd5
test al, al
je 0x40bdd1
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40bdd5
add edi, 2
add ebp, 2
test al, al
jne 0x40bdb0
xor eax, eax
jmp 0x40bdda
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40be2f
mov edi, dword [0x455694]
imul ebx, ebx, 0x16cb
mov eax, esi
imul eax, eax, 0x15c4
add ebx, eax
mov eax, 0x6342662b
imul edi
imul edi, edi, 0x5cc
sar edx, 0xb
add ebx, edx
mov ecx, edx
mov eax, 0x6d62dd3b
imul esi
sar edx, 0xb
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, ebx
add eax, edx
sub ecx, eax
add ecx, edi
mov dword [0x45569c], ecx
mov ebp, 1
jmp 0x40be33
mov ebp, dword [esp + 0x10]
mov eax, 0x59da2e6b
imul ecx
imul ecx, ecx, 0x736
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x9cbd99d5
imul dword [0x4556a4]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
imul edx, edx, 0xe33
mov ebx, eax
sub ebx, edi
add ebx, edx
mov eax, 0x4700d503
imul esi
sar edx, 9
mov eax, edx
add ebx, ecx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x9c]
push ecx
sub ebx, eax
push edx
mov dword [0x4556a4], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40c011
mov eax, ebp
shl eax, 6
lea ecx, [esp + eax + 0x1c4]
lea edx, [esp + 0xc0]
sub eax, edx
lea esi, [esp + eax + 0x1c4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
jmp 0x40bed2
mov esi, dword [esp + 0x10]
mov ebx, dword [0x4556a0]
mov eax, 0x5e17e411
imul dword [0x45569c]
sar edx, 0xb
mov ecx, ebx
imul ecx, ecx, 0x16cb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, ecx
mov ecx, dword [0x4556a4]
mov eax, 0x6d62dd3b
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455690]
imul edx, edx, 0x5cc
sub edi, ecx
mov ecx, dword [str._r_____r____]
sub edi, edx
add edi, ecx
mov ecx, dword [0x455688]
add ecx, edi
mov dword [0x455688], ecx
lea eax, [esp + 0xc0]
lea ecx, [ecx]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40bf40
mov edi, dword [esp + 0x9cc]
mov esi, dword [esp + 0x18]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40bf79
test al, al
je 0x40bf75
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40bf79
add esi, 2
add edi, 2
test al, al
jne 0x40bf55
xor eax, eax
jmp 0x40bf7e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40bff7
mov esi, dword [0x4556a8]
imul ecx, ecx, 0x12b9
mov eax, 0x6342662b
imul esi, esi, 0x14a2
imul dword [0x45569c]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1cb32649
imul dword [0x455690]
add esi, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0xa4]
sub esi, ecx
mov ecx, dword [esp + 0x10]
sub esi, ebx
mov dword [esp + ebp*4 + 0x1c], edx
mov edx, dword [esp + 0x18]
sub esi, 0x5cc
mov eax, 0x40
add edx, eax
inc ebp
add ecx, eax
mov dword [0x455690], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x9c]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40bece
mov ecx, dword [0x4556a8]
mov esi, dword [0x4556a0]
mov eax, 0xcc33a611
imul esi, esi, 0xe33
imul ecx
add edx, ecx
imul ecx, ecx, 0x5cc
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
sub esi, eax
mov eax, 0x5da803a9
imul edx
sar edx, 0xa
mov edi, edx
add esi, edx
mov edx, dword [0x455694]
mov eax, 0x4700d503
imul edx
sar edx, 9
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, esi
add eax, edx
sub edi, eax
sub edi, ecx
mov ecx, dword [esp + 0x14]
push ecx
mov dword [0x455698], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c4]
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
call fcn.0042904d
add esp, 0x9b8
ret