Function at 0x40ddb0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x45b4b0]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x459b3c]
mov ebx, dword [0x459b58]
mov edi, dword [0x459b44]
imul ebx, ebx, 0x3b76e
mov esi, eax
mov eax, ecx
imul eax, eax, 0x426f4
add ebx, eax
mov eax, 0x491979d9
imul edi
sar edx, 0x11
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
shl eax, 1
mov ebx, eax
mov eax, 0x89cc5bfb
imul ecx
add edx, ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x5764ae1b
imul edi
sar edx, 0x12
mov eax, edx
sub ebx, ecx
shr eax, 0x1f
lea ecx, [esp + 0xa0]
add eax, edx
push ecx
sub ebx, eax
push esi
mov dword [esp + 0x24], esi
mov dword [esp + 0xa8], 0x128
mov dword [str._r_____r____], ebx
mov dword [esp + 0x1c], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40de79
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9bc]
call fcn.0042d001
add esp, 0x9c0
ret
mov ecx, dword [0x459b44]
mov eax, 0x491979d9
imul ecx
mov ecx, dword [0x459b50]
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x459b3c]
mov eax, 0x415373e5
imul edx
mov edi, ecx
imul edi, edi, 0x426f4
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, esi
push ebp
mov ebp, dword [str._r_____r____]
lea eax, [eax + edi*2 + 0x84bc4]
sub eax, ebp
mov dword [0x459b3c], eax
xor eax, eax
mov edi, edi
mov dl, byte [esp + eax + 0xc8]
mov byte [esp + eax + 0x1cc], dl
inc eax
test dl, dl
jne 0x40ded0
mov ebx, ebp
mov ebp, dword [0x459b4c]
imul ebx, ebx, 0x70110
mov eax, 0x415373e5
imul ebp
mov edi, dword [0x459b58]
sar edx, 0x10
imul edi, edi, 0x3b76e
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebp
imul edx, edx, 0x84de8
sub edx, eax
mov eax, dword [0x459b48]
imul eax, eax, 0x20dab
add edx, ebx
add eax, edx
add eax, esi
add eax, edi
lea edx, [eax + ecx - 0xd61e3]
mov eax, dword [esp + 0x9d4]
mov dword [0x459b44], edx
mov dword [esp + 0x14], eax
lea esi, [esp + 0x1cc]
lea ebx, [ebx]
mov dl, byte [esi]
mov eax, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [eax]
jne 0x40df8c
mov al, dl
test al, al
je 0x40df88
mov dl, byte [esi + 1]
mov eax, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [eax + 1]
jne 0x40df8c
mov edx, eax
mov al, byte [esp + 0x13]
add edx, 2
add esi, 2
test al, al
mov dword [esp + 0x14], edx
jne 0x40df50
xor eax, eax
jmp 0x40df91
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov esi, dword [0x459b54]
jne 0x40e008
mov edx, dword [0x459b40]
imul ecx, ecx, 0x3eb04
imul ebp, ebp, 0xd61e3
imul edx, edx, 0x1db98
add ecx, ebp
add ecx, edx
mov eax, 0x5764ae1b
imul esi
sar edx, 0x12
add ecx, edx
mov ebp, edx
mov eax, 0xf957fd3
imul dword [0x459b3c]
sar edx, 0xd
mov eax, edx
shr ebp, 0x1f
add ebp, ecx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x491979d9
imul dword [0x459b44]
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ebp, edi
add ecx, ebp
mov dword [0x459b4c], ecx
mov dword [esp + 0x18], 1
mov ecx, dword [0x459b48]
mov ebp, dword [0x459b38]
mov eax, 0x89cc5bfb
imul ebp, ebp, 0x3eb37
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x5764ae1b
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x491979d9
imul ecx
mov esi, dword [esp + 0x20]
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x491979d9
imul dword [0x459b44]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
sub ebp, ecx
add eax, edx
add ebp, ebx
lea ecx, [esp + 0xa4]
add eax, ebp
push ecx
add eax, edi
push esi
mov dword [0x459b54], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40e238
mov eax, dword [esp + 0x18]
shl eax, 6
lea edx, [esp + eax + 0x1cc]
lea ecx, [esp + 0xc8]
sub eax, ecx
lea ebx, [esp + eax + 0x1cc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebx
jmp 0x40e0c0
mov ebx, dword [esp + 0x1c]
jmp 0x40e0c0
mov ecx, dword [0x459b44]
mov eax, 0x491979d9
imul ecx
mov ecx, dword [0x459b40]
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x20ab631d
imul ecx
sar edx, 0xf
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x459b38]
imul edx, edx, 0xd61e3
add ebp, edx
mov eax, 0x4c84c1e9
imul ecx
mov eax, dword [0x459b50]
mov edi, dword [0x459b58]
imul eax, eax, 0x1db98
sar edx, 0x12
imul edi, edi, 0x3b76e
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
sub ecx, eax
mov eax, 0xf957fd3
imul dword [0x459b54]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
add ecx, edi
mov dword [0x459b38], ecx
lea eax, [esp + 0xc8]
mov dl, byte [eax]
mov byte [ebx + eax], dl
inc eax
test dl, dl
jne 0x40e150
mov eax, dword [esp + 0x9d4]
mov ebp, dword [esp + 0x14]
mov bl, byte [ebp]
mov dl, bl
cmp bl, byte [eax]
jne 0x40e18a
test dl, dl
je 0x40e186
mov bl, byte [ebp + 1]
mov dl, bl
cmp bl, byte [eax + 1]
jne 0x40e18a
add ebp, 2
add eax, 2
test dl, dl
jne 0x40e165
xor eax, eax
jmp 0x40e18f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e21e
mov ebx, dword [0x459b48]
imul ecx, ecx, 0x20dab
mov eax, 0xf6ddfe9
imul ebx, ebx, 0xbb797
imul dword [0x459b40]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b4c]
sub ebx, eax
mov eax, 0x5764ae1b
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xac]
sub ebx, eax
mov eax, dword [0x459b54]
add ebx, ecx
sub ebx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x24], edx
mov edx, dword [esp + 0x14]
add ebx, esi
inc eax
lea ecx, [ebx + edi - 0xd61e3]
mov dword [0x459b40], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ecx
mov esi, dword [esp + 0x20]
lea eax, [esp + 0xa4]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40e0b7
mov ecx, dword [0x459b44]
mov edi, dword [0x459b50]
mov eax, 0x491979d9
imul edi, edi, 0x3eb37
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [0x459b58]
mov eax, 0x3da796f7
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x89c36131
imul ecx
add edx, ecx
imul ecx, ecx, 0x9aa75
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
push esi
mov dword [0x459b48], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9cc]
mov eax, dword [esp + 0x18]
pop ebp
pop edi
pop esi
pop ebx
call fcn.0042d001
add esp, 0x9c0
ret