Function at 0x405ee0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe84
mov eax, dword [0x45e540]
xor eax, esp
mov dword [esp + 0xe80], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45cbdc]
mov eax, dword [esp + 0xe98]
mov dword [esp + 0x14], eax
mov eax, 0x315a5211
imul ecx
mov eax, dword [0x45cbc8]
sar edx, 0x18
imul eax, eax, 0x3575d9d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [0x45cbd8]
mov esi, ecx
imul esi, esi, 0x52fe876
sub esi, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x5335ef4
add esi, eax
add esi, edx
mov edx, dword [0x45cbd0]
mov eax, 0x3b012ec7
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x206151bf
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, dword [0x45cbe4]
push 0
sub ecx, 0xfcfe96
push 2
mov dword [0x45cbd0], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45cbd4]
mov ebp, eax
mov esi, dword [0x45cbcc]
mov eax, 0x315a5211
imul ecx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x315a5211
imul esi
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [0x45cbe8]
sub ebx, edi
imul eax, eax, 0x5335ef4
mov edi, dword [0x45cbdc]
mov edx, edi
imul edx, edx, 0x3575d9d
add ebx, edx
add ebx, eax
mov eax, 0x680c7cd1
imul ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
mov dword [esp + 0x18], ebp
add ecx, ebx
mov edx, esi
imul edx, edx, 0x4e899b9
add ecx, edx
mov eax, 0x83740ec5
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbd8]
sub ecx, eax
lea esi, [ecx + edx]
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x4ebb783
imul esi, esi, 0x3575d9d
mov eax, 0x680c7cd1
imul edi
add esi, ecx
sar edx, 0x19
mov ecx, edx
add esi, edx
mov edx, edi
imul edx, edx, 0x4e899b9
shr ecx, 0x1f
add ecx, esi
add ecx, edx
mov eax, 0x74b32761
imul edi
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe0]
sub ecx, eax
lea eax, [ecx + edx - 0xfcfe96]
lea ecx, [esp + 0xe8]
push ecx
push ebp
mov dword [esp + 0xf0], 0x128
xor ebx, ebx
mov dword [0x45cbd4], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40609b
or eax, 0xffffffff
jmp 0x4064dd
mov ecx, dword [0x45cbe4]
mov eax, 0x993c2c11
imul ecx
add edx, ecx
mov ecx, dword [0x45cbd0]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, dword [0x45cbe0]
mov esi, eax
mov eax, 0x3bfa58a9
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x14e459e
mov ebp, eax
sub ebp, esi
add ebp, edx
mov eax, 0x342745e1
imul ecx
mov eax, dword [0x45cbc8]
imul eax, eax, 0xfcfe96
sar edx, 0x18
mov esi, edx
shr esi, 0x1f
add ebp, edx
add esi, ebp
add esi, eax
mov eax, 0x206151bf
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
mov dword [0x45cbc8], ecx
xor esi, esi
lea esp, [esp]
mov al, byte [esp + esi + 0x10c]
mov byte [esp + esi + 0x210], al
inc esi
test al, al
jne 0x406120
mov esi, dword [0x45cbe8]
imul ecx, ecx, 0x4ebb783
mov eax, 0xc4e5d61
imul esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbd4]
mov ebp, eax
mov eax, 0x680c7cd1
imul edx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x342745e1
imul esi
imul esi, esi, 0xfcfe96
add ebp, ecx
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x74b32761
imul edi
imul edi, edi, 0x23193db
sar edx, 0x18
sub ebp, ecx
mov ecx, dword [esp + 0x14]
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
add eax, edi
push ecx
lea edx, [esp + 0x214]
sub eax, esi
push edx
mov dword [0x45cbd8], eax
call fcn.0043ac7e
mov edi, dword [0x45cbe4]
mov ecx, dword [0x45cbe0]
add esp, 8
test eax, eax
jne 0x406251
mov esi, dword [0x45cbd4]
mov eax, 0x993c2c11
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x5335ef4
mov ebx, eax
sub ebx, edx
mov eax, 0x680c7cd1
imul esi
sar edx, 0x19
mov eax, ecx
imul eax, eax, 0x4e899b9
mov esi, edx
add ebx, edx
mov edx, dword [0x45cbcc]
shr esi, 0x1f
add esi, ebx
add esi, eax
mov eax, 0x74b32761
imul edx
sar edx, 0x18
add esi, edx
mov eax, edx
mov edx, edi
imul edx, edx, 0xfcfe96
shr eax, 0x1f
add eax, esi
mov esi, dword [str._r_____r____]
add eax, edx
sub eax, esi
add eax, 0x456b154
mov dword [0x45cbcc], eax
mov ebx, 1
mov esi, dword [0x45cbd0]
imul ecx, ecx, 0x14e459e
mov eax, 0x993c2c11
imul edi
add edx, edi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x3bfa58a9
imul esi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x342745e1
imul esi
sar edx, 0x18
sub ebp, edi
add ebp, ecx
add ebp, edx
mov ecx, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0xfcfe96
shr ecx, 0x1f
add ecx, ebp
mov ebp, dword [esp + 0x18]
add ecx, edx
mov eax, 0x206151bf
imul esi
sar edx, 0x15
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
lea ecx, [esp + 0xe8]
push ecx
push ebp
mov dword [0x45cbc8], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406462
mov eax, ebx
shl eax, 6
lea edx, [esp + 0x10c]
lea edi, [esp + eax + 0x210]
sub eax, edx
lea esi, [esp + eax + 0x210]
mov dword [esp + 0x1c], esi
lea esp, [esp]
lea eax, [esp + 0x10c]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x406307
mov ecx, dword [0x45cbd4]
mov eax, 0x993c2c11
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x5335ef4
sub eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x680c7cd1
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0x19
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x45cbe0]
imul ecx, ecx, 0x4e899b9
add eax, ecx
mov ecx, dword [0x45cbcc]
mov dword [esp + 0x10], eax
mov eax, 0x74b32761
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0x18
add ecx, edx
mov eax, edx
mov edx, dword [esp + 0x14]
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x45cbe4]
imul ecx, ecx, 0xfcfe96
add eax, ecx
sub eax, dword [str._r_____r____]
push edx
add eax, 0x456b154
push edi
mov dword [0x45cbcc], eax
call fcn.0043ac7e
add esp, 8
test eax, eax
jne 0x40644c
mov ecx, dword [0x45cbcc]
mov eax, dword [0x45cbd0]
mov esi, dword [0x45cbe4]
lea ebp, [ecx + eax]
imul ebp, ebp, 0x3e51956
mov eax, 0x315a5211
imul esi
sar edx, 0x18
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x993c2c11
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x222559d
sub ebp, ecx
mov ecx, dword [0x45cbdc]
add ebp, edx
imul ecx, ecx, 0xfcfe96
mov eax, 0x680c7cd1
imul esi
mov esi, dword [esp + 0x1c]
sar edx, 0x19
add ebp, edx
mov eax, edx
mov edx, dword [esp + 0xf0]
shr eax, 0x1f
add eax, ebp
mov ebp, dword [esp + 0x18]
add eax, ecx
mov dword [esp + ebx*4 + 0x20], edx
inc ebx
add edi, 0x40
add esi, 0x40
mov dword [0x45cbdc], eax
mov dword [esp + 0x1c], esi
lea eax, [esp + 0xe8]
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x406300
mov ecx, dword [0x45cbe8]
mov edx, dword [0x45cbd0]
mov eax, dword [0x45cbd4]
lea esi, [ecx + edx]
imul eax, eax, 0x5335ef4
mov edx, dword [0x45cbd8]
imul esi, esi, 0x456b154
imul edx, edx, 0x222559d
sub esi, eax
add esi, edx
mov edx, dword [0x45cbcc]
mov eax, 0x3b012ec7
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x83740ec5
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
add esi, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0xfcfe96
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
push ebp
mov dword [0x45cbe0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [esp + 0xe90]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043016d
add esp, 0xe84
ret