Function at 0x405e10
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe80
mov eax, dword [0x45e640]
mov dword [esp + 0xe7c], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45ccdc]
mov eax, 0x4f576647
imul ecx
mov ecx, dword [0x45ccd8]
mov esi, ecx
sar edx, 8
imul esi, esi, 0x33a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce8]
sub esi, eax
imul edx, edx, 0x21e
mov eax, dword [0x45ccc8]
imul eax, eax, 0x242
add esi, edx
mov edx, dword [0x45ccd0]
add esi, eax
mov eax, 0x59493e15
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, dword [0x45cce4]
push 0
sub ecx, 0xe1
push 2
mov dword [0x45ccd0], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45ccd4]
mov ebp, eax
mov edi, dword [0x45cccc]
mov eax, 0x4f576647
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x4f576647
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 7
sub ebx, esi
mov esi, dword [0x45ccdc]
mov ecx, edx
add ebx, edx
mov edx, esi
imul edx, edx, 0x242
mov eax, edi
imul eax, eax, 0x203
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
mov edx, dword [0x45cce8]
add ecx, eax
imul edx, edx, 0x21e
mov dword [esp + 0x18], ebp
add ecx, edx
mov eax, 0x93459be7
imul edi
add edx, edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x482
mov eax, 0x38e38e39
imul esi
sar edx, 7
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x45ccd8]
imul ecx, ecx, 0x242
mov edx, esi
imul edx, edx, 0x203
add edi, ecx
mov ecx, dword [0x45cce0]
add edi, edx
mov eax, 0xd20d20d3
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
lea eax, [esp + 0xe4]
push eax
lea edx, [edi + ecx - 0xe1]
push ebp
mov dword [esp + 0xec], 0x128
xor ebx, ebx
mov dword [0x45ccd4], edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x405fd3
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe7c]
call fcn.0042fb01
add esp, 0xe80
ret
mov ecx, dword [0x45cce4]
mov esi, dword [0x45ccd0]
mov eax, 0x71625345
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xd8a5df
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x7f411e53
imul esi
sub edi, ecx
mov ecx, dword [0x45ccc8]
sar edx, 8
imul ecx, ecx, 0xe1
mov ebp, edx
add edi, edx
shr ebp, 0x1f
add ebp, edi
add ebp, ecx
mov ecx, dword [0x45cce0]
mov edx, ecx
imul edx, edx, 0x61
add ebp, edx
mov eax, 0x91a2b3c5
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add ebp, edx
add esi, ebp
mov dword [0x45ccc8], esi
xor edi, edi
nop
mov al, byte [esp + edi + 0x108]
mov byte [esp + edi + 0x20c], al
inc edi
test al, al
jne 0x406050
mov edx, dword [0x45ccd4]
mov edi, dword [0x45cce8]
mov eax, 0x38e38e39
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0xf1d48bd
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
lea edx, [esi + esi*8]
shl edx, 6
add eax, edx
mov ebp, eax
mov eax, 0x7f411e53
imul edi
imul edi, edi, 0xe1
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
imul ecx, ecx, 0x9c
sar edx, 7
mov eax, edx
sub ebp, edi
shr eax, 0x1f
add ebp, edx
add eax, ebp
add eax, ecx
mov ecx, dword [esp + 0xe94]
push ecx
lea edx, [esp + 0x210]
push edx
mov dword [0x45ccd8], eax
call fcn.0043a56e
mov edi, dword [0x45cce4]
mov esi, dword [0x45cce0]
add esp, 8
test eax, eax
jne 0x406182
mov ecx, dword [0x45ccd4]
mov eax, 0x71625345
imul ecx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x45cce8]
sar edx, 7
imul ecx, ecx, 0x21e
add ebx, edx
mov ebp, edx
mov eax, esi
imul eax, eax, 0x203
shr ebp, 0x1f
mov edx, edi
imul edx, edx, 0xe1
add ebp, ebx
add ebp, eax
sub ebp, ecx
mov ecx, dword [0x45cccc]
add ebp, edx
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [str._r_____r____]
add eax, ebp
sub eax, edx
add eax, 0x16f
mov dword [0x45cccc], eax
mov ebx, 1
mov eax, 0x71625345
imul esi, esi, 0x61
imul edi
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x45ccd0]
mov eax, 0xd8a5df
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x7f411e53
imul ecx
sub ebp, edi
sar edx, 8
add ebp, edx
mov edi, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0xe1
shr edi, 0x1f
add edi, ebp
mov ebp, dword [esp + 0x18]
add edi, edx
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
add edi, esi
lea ecx, [esp + 0xe4]
shr eax, 0x1f
add edi, edx
push ecx
add eax, edi
push ebp
mov dword [0x45ccc8], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406389
mov eax, ebx
shl eax, 6
lea edx, [esp + 0x108]
lea edi, [esp + eax + 0x20c]
sub eax, edx
lea esi, [esp + eax + 0x20c]
mov dword [esp + 0x10], esi
lea esp, [esp]
lea eax, [esp + 0x108]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x406237
mov ecx, dword [0x45ccd4]
mov eax, 0x71625345
imul ecx
sar edx, 8
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x45cce0]
sar edx, 7
imul ecx, ecx, 0x203
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [0x45cce8]
add eax, ebp
imul edx, edx, 0x21e
add eax, ecx
mov ecx, dword [0x45cce4]
imul ecx, ecx, 0xe1
sub eax, edx
add eax, ecx
mov ecx, dword [0x45cccc]
mov ebp, eax
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
mov ecx, dword [esp + 0xe94]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [str._r_____r____]
add eax, ebp
sub eax, edx
push ecx
add eax, 0x16f
push edi
mov dword [0x45cccc], eax
call fcn.0043a56e
add esp, 8
test eax, eax
jne 0x40636f
mov ecx, dword [0x45cccc]
mov edx, dword [0x45ccd0]
mov esi, dword [0x45cce4]
lea ebp, [ecx + edx]
imul ebp, ebp, 0x1bd
mov eax, 0x4f576647
imul esi
sar edx, 8
add ebp, edx
mov eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x25d
shr eax, 0x1f
add eax, ebp
add eax, edx
mov ebp, eax
mov eax, 0x71625345
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x38e38e39
imul esi
mov eax, dword [esp + 0xec]
mov esi, dword [esp + 0x10]
sar edx, 7
add ebp, edx
mov ecx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0xe1
shr ecx, 0x1f
add ecx, ebp
add ecx, edx
mov dword [esp + ebx*4 + 0x1c], eax
inc ebx
add edi, 0x40
add esi, 0x40
mov dword [0x45ccdc], ecx
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0xe4]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x406230
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccd4]
lea esi, [ecx + edx]
imul eax, eax, 0x21e
mov edx, dword [0x45ccd8]
imul esi, esi, 0x16f
imul edx, edx, 0x25d
sub esi, eax
add esi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sar edx, 8
mov edi, edx
add esi, edx
mov eax, 0x59493e15
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 7
imul ecx, ecx, 0xe1
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, esi
add eax, edx
sub edi, eax
sub edi, ecx
push ebp
mov dword [0x45cce0], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe8c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
call fcn.0042fb01
add esp, 0xe80
ret