Function at 0x40f610
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x45e640]
push ebx
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45cccc]
mov edi, eax
mov esi, dword [0x45ccd4]
mov eax, 0x3b87af8d
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xe0e0bbb3
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x1f1f444d
imul ecx
imul ecx, ecx, 0x530e8f
sar edx, 0x14
sub ebp, ebx
mov ebx, edx
add ebp, edx
mov eax, 0x61fd3f09
imul esi
sar edx, 0x15
shr ebx, 0x1f
mov eax, edx
add ebx, ebp
add ebx, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x569052
shr eax, 0x1f
add eax, ebx
add eax, edx
add eax, ecx
mov ecx, dword [0x45ccdc]
imul ecx, ecx, 0x5184aa
lea edx, [esp + 0xa4]
push edx
add eax, ecx
push edi
mov dword [esp + 0x24], edi
mov dword [esp + 0xac], 0x128
mov dword [str._r_____r____], eax
mov dword [esp + 0x20], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40f6f7
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9bc]
call fcn.0042fa01
add esp, 0x9c0
ret
mov ecx, dword [0x45cccc]
mov esi, dword [0x45cce4]
mov ebp, dword [0x45cce0]
imul esi, esi, 0x273a49
mov eax, 0x54a93351
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0x13
add esi, edx
mov edi, edx
mov eax, 0x61fd3f09
imul ecx
mov eax, dword [0x45cce8]
sar edx, 0x15
imul eax, eax, 0x569052
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov edx, ebp
imul edx, edx, 0x530e8f
shr esi, 0x1f
add esi, edi
sub esi, eax
add esi, edx
mov eax, 0x647e2ce7
imul ecx
mov eax, dword [str._r_____r____]
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, eax
add ecx, 0x34e0fb
mov dword [0x45cccc], ecx
xor esi, esi
lea ebx, [ebx]
mov dl, byte [esp + esi + 0xc8]
mov byte [esp + esi + 0x1cc], dl
inc esi
test dl, dl
jne 0x40f780
mov edx, dword [0x45ccd8]
mov esi, dword [0x45ccdc]
lea ebx, [edx + eax]
mov edi, eax
imul ebx, ebx, 0x5184aa
mov eax, 0x54a93351
imul edi, edi, 0x5399dc
imul esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x61fd3f09
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x530e8f
add eax, edi
add eax, ebx
add edx, eax
lea eax, [edx + ebp - 0x273a49]
mov edx, dword [esp + 0x9d4]
mov dword [0x45ccd4], eax
mov dword [esp + 0x14], edx
lea eax, [esp + 0x1cc]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x40f830
test dl, dl
je 0x40f82c
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x40f830
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x40f800
xor eax, eax
jmp 0x40f835
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f8ab
mov eax, dword [0x45ccd0]
imul esi, esi, 0x273a49
imul ebp, ebp, 0x6489e9
lea ebx, [eax + ecx]
imul ebx, ebx, 0x44ce3d
add ebx, esi
mov esi, dword [0x45cce4]
mov eax, 0x1f1f444d
imul esi
sar edx, 0x14
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, 0x61fd3f09
imul esi
mov eax, dword [esp + 0x18]
sar edx, 0x15
mov ebx, edx
add eax, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x647e2ce7
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ebx, ebp
add ecx, edx
sub ebx, ecx
mov dword [0x45ccdc], ebx
mov ebx, 1
jmp 0x40f8b5
mov ebx, dword [esp + 0x18]
mov esi, dword [0x45cce4]
mov edx, dword [0x45ccc8]
mov eax, dword [0x45ccd4]
lea ecx, [edx + eax]
mov eax, 0x26bae4e5
imul ecx, ecx, 0x1830cc
imul dword [str._r_____r____]
sar edx, 0x13
add ecx, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, ecx
mov ecx, dword [0x45ccd8]
mov eax, 0x3b87af8d
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x1f1f444d
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x61fd3f09
imul ecx
mov eax, dword [esp + 0x1c]
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0xa4]
sub ebp, ecx
push edx
add ebp, edi
push eax
mov dword [0x45cce4], ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40faf3
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea edi, [esp + eax + 0x1cc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
jmp 0x40f970
mov edi, dword [esp + 0x18]
jmp 0x40f970
mov edx, dword [0x45ccc8]
mov ecx, dword [0x45cce0]
imul edx, edx, 0x273a49
mov esi, dword [0x45ccd0]
imul ecx, ecx, 0x11c215
add ecx, edx
mov eax, 0xd0d507c9
imul esi
add edx, esi
sar edx, 0x15
add ecx, edx
mov ebp, edx
mov eax, 0xc5432eb
imul esi
sar edx, 0x12
shr ebp, 0x1f
add ebp, ecx
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0xa2f64c79
imul esi
add edx, esi
sar edx, 0x16
add ebp, edx
mov ecx, edx
mov eax, 0x647e2ce7
imul dword [0x45cce4]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
shr ecx, 0x1f
add eax, edx
add ecx, ebp
sub ecx, eax
mov dword [0x45ccc8], ecx
lea eax, [esp + 0xc8]
mov dl, byte [eax]
mov byte [edi + eax], dl
inc eax
test dl, dl
jne 0x40f9f3
mov ebp, dword [esp + 0x9d4]
mov edi, dword [esp + 0x14]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40fa2d
test al, al
je 0x40fa29
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40fa2d
add edi, 2
add ebp, 2
test al, al
jne 0x40fa08
xor eax, eax
jmp 0x40fa32
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fad9
mov eax, 0x26bae4e5
imul ecx, ecx, 0x5184aa
imul esi
mov esi, dword [0x45ccd8]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xd0d507c9
imul esi
add edx, esi
imul esi, esi, 0x839c4a
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
mov ebp, eax
mov eax, 0x1f1f444d
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x569052
sub ebp, edi
add ebp, esi
sub ebp, eax
mov eax, dword [0x45cce4]
add ebp, edx
mov edx, dword [esp + 0x14]
add ebp, ecx
mov ecx, dword [esp + 0x18]
sub ebp, eax
mov eax, dword [esp + 0xac]
mov dword [esp + ebx*4 + 0x24], eax
sub ebp, 0x273a49
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [0x45ccd0], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xa4]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40f967
mov esi, dword [0x45cce0]
mov ecx, dword [0x45cce8]
mov eax, 0x54a93351
imul esi
imul esi, esi, 0x1830cc
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
mov edi, ecx
imul edx, edx, 0x5399dc
mov ebp, eax
imul edi, edi, 0x273a49
sub ebp, edi
add ebp, esi
add ebp, edx
mov edx, dword [0x45ccd4]
mov eax, 0x61fd3f09
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0xbd455a63
imul ecx
add edx, ecx
sar edx, 0x16
mov esi, edx
add ebp, edx
mov eax, 0xc5432eb
imul ecx
sar edx, 0x12
mov ecx, edx
shr esi, 0x1f
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x1c]
add esi, ebp
sub esi, ecx
push edx
mov dword [0x45ccd8], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9cc]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
call fcn.0042fa01
add esp, 0x9c0
ret