Function at 0x407420
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe88
mov eax, dword [0x43d120]
mov ecx, dword [0x43c0b0]
push ebx
mov dword [esp + 0xe88], eax
mov eax, dword [0x43c0bc]
push ebp
push esi
mov esi, dword [0x43c0c0]
lea ebx, [eax + esi]
push edi
imul ebx, ebx, 0xff3e
mov edi, dword [str._r_____r____]
lea edx, [edi + ecx]
mov ecx, dword [0x43c0ac]
imul edx, edx, 0x17928
add ebx, edx
mov eax, 0x49f13bb3
imul ecx
imul ecx, ecx, 0x94045
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0c4]
imul edx, edx, 0xdd94
sub ebx, eax
add ebx, edx
mov eax, 0x49f13bb3
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3e565a5f
imul edi
add ebx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x43c0cc]
imul edx, edx, 0x106d4
sub ebx, ecx
sub ebx, edx
push 0
sub ebx, 0xff3e
push 2
mov dword [0x43c0c0], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, dword [0x43c0b0]
mov ecx, dword [str._r_____r____]
mov dword [esp + 0x1c], eax
mov eax, dword [0x43c0b8]
add eax, ebx
imul eax, eax, 0x17928
mov dword [esp + 0x20], eax
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x43c0c0]
mov eax, 0x49f13bb3
imul edx
sar edx, 0xe
mov edi, edx
shr edi, 0x1f
mov ebp, dword [0x43c0ac]
add edi, edx
mov eax, 0x3e565a5f
imul ebx
mov eax, dword [0x43c0bc]
sar edx, 0xe
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
imul eax, eax, 0xff3e
mov dword [esp + 0x14], eax
mov eax, ebp
imul eax, eax, 0x94046
imul ecx, ecx, 0x8386f
add eax, ecx
mov ecx, dword [0x43c0b4]
mov dword [esp + 0x10], eax
mov eax, 0x7c32ca05
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0xf
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x3e565a5f
imul dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0c8]
sub ecx, eax
mov eax, dword [esp + 0x14]
sub ecx, esi
sub ecx, edi
add ecx, eax
mov eax, dword [esp + 0x20]
add ecx, ebx
add ecx, eax
lea eax, [edx + ebp]
imul ebp, ebp, 0x8386f
mov edx, dword [0x43c0c4]
imul eax, eax, 0x107d6
add eax, ebp
mov dword [esp + 0x10], eax
mov eax, 0x7c32ca05
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
mov eax, dword [esp + 0x1c]
sub edx, ebx
mov ebx, dword [esp + 0x14]
sub edx, esi
sub edx, edi
mov edi, dword [esp + 0x20]
add edx, ebx
add edx, edi
mov dword [0x43c0cc], ecx
lea ecx, [edx + ecx + 0x107ce]
lea edx, [esp + 0xec]
push edx
push eax
mov dword [esp + 0xf4], 0x128
mov dword [esp + 0x20], 0
mov dword [0x43c0bc], ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x407642
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe84]
call fcn.00415ffe
add esp, 0xe88
ret
mov ecx, dword [0x43c0c0]
mov edi, dword [0x43c0bc]
mov esi, dword [0x43c0b8]
mov eax, 0x49f13bb3
imul ecx
mov eax, dword [0x43c0b0]
sar edx, 0xe
mov ecx, edx
mov ebx, edi
sub ebx, eax
shr ecx, 0x1f
imul ebx, ebx, 0xff3e
add ecx, edx
mov eax, 0x15b86ecf
imul esi
sar edx, 0xd
add ebx, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, ebx
mov ebx, dword [0x43c0b4]
mov eax, 0x15b86ecf
imul ebx
imul ebx, ebx, 0x106d5
sar edx, 0xd
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x15b86ecf
imul dword [0x43c0b0]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0c8]
sub ebp, eax
imul edx, edx, 0x8386f
mov eax, esi
imul eax, eax, 0x107d6
add ebp, edx
add ebp, eax
add ebp, ebx
sub ebp, ecx
add ebp, 0x79ea
mov dword [0x43c0c8], ebp
xor eax, eax
lea esp, [esp]
mov dl, byte [esp + eax + 0x110]
mov byte [esp + eax + 0x214], dl
inc eax
test dl, dl
jne 0x4076f0
mov edx, dword [0x43c0b0]
imul edi, edi, 0xff3e
mov ebx, dword [0x43c0ac]
lea ebp, [esi + edx]
mov eax, 0x49f13bb3
imul ebp, ebp, 0x17928
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov edx, ebx
imul edx, edx, 0xb4759
add ebp, edx
mov eax, 0x3e565a5f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x3e565a5f
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
add eax, edi
sub eax, ecx
mov ecx, dword [str._r_____r____]
lea edx, [eax + ecx - 0x107d6]
mov eax, dword [esp + 0xe9c]
push eax
lea ecx, [esp + 0x218]
push ecx
mov dword [0x43c0b8], edx
call fcn.004166d0
mov esi, dword [0x43c0bc]
mov ecx, dword [0x43c0b8]
mov ebx, dword [0x43c0c8]
add esp, 8
test eax, eax
je 0x407858
mov edi, dword [str._r_____r____]
mov edx, dword [0x43c0b0]
lea ebp, [edi + edx]
mov eax, 0x49f13bb3
imul ebp, ebp, 0x17928
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x49f13bb3
imul dword [0x43c0c0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0c4]
imul edx, edx, 0x8386f
sub ebp, eax
add ebp, edx
mov eax, 0x7c32ca05
imul ecx
sar edx, 0xf
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov edx, ecx
imul edx, edx, 0x107d6
add eax, edx
mov edx, esi
imul edx, edx, 0x796
sub eax, edx
mov ebp, eax
mov eax, 0x3e565a5f
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x4030a4dd
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebp, edx
lea edx, [eax + ebp - 0x107d6]
mov dword [0x43c0c4], edx
mov edi, 1
jmp 0x40785c
mov edi, dword [esp + 0x18]
mov eax, dword [0x43c0b0]
imul ebx, ebx, 0x8386f
sub esi, eax
mov eax, 0x15b86ecf
imul esi, esi, 0xff3e
imul ecx
imul ecx, ecx, 0x107d6
sar edx, 0xd
add esi, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, esi
mov esi, dword [0x43c0b4]
mov eax, 0x15b86ecf
imul esi
imul esi, esi, 0x106d5
sar edx, 0xd
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x15b86ecf
imul dword [0x43c0b0]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x49f13bb3
imul dword [0x43c0c0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ebx
add ebp, ecx
lea ecx, [esi + ebp + 0x79ea]
mov esi, dword [esp + 0x1c]
lea edx, [esp + 0xec]
push edx
push esi
mov dword [0x43c0c8], ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x407aec
mov eax, edi
shl eax, 6
lea ecx, [esp + 0x110]
lea ebx, [esp + eax + 0x214]
sub eax, ecx
lea edx, [esp + eax + 0x214]
mov dword [esp + 0x14], edx
jmp 0x407930
mov edx, dword [esp + 0x14]
jmp 0x407930
lea eax, [esp + 0x110]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x407937
mov esi, dword [str._r_____r____]
mov edx, dword [0x43c0b0]
mov ecx, dword [0x43c0c8]
lea ebp, [esi + edx]
mov eax, 0x49f13bb3
imul ebp, ebp, 0x17928
imul ecx
mov ecx, dword [0x43c0c0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x43c0c4]
imul edx, edx, 0x8386f
sub ebp, ecx
mov ecx, dword [0x43c0b8]
add ebp, edx
mov eax, 0x7c32ca05
imul ecx
sar edx, 0xf
add ebp, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x107d6
shr eax, 0x1f
add eax, ebp
add eax, edx
mov edx, dword [0x43c0bc]
imul edx, edx, 0x796
sub eax, edx
mov ebp, eax
mov eax, 0x3e565a5f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x4030a4dd
imul ecx
mov eax, dword [esp + 0xe9c]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
push eax
lea edx, [ecx + ebp - 0x107d6]
push ebx
mov dword [0x43c0c4], edx
call fcn.004166d0
add esp, 8
test eax, eax
je 0x407ad2
mov edx, dword [0x43c0c0]
mov esi, dword [0x43c0b0]
mov ecx, dword [0x43c0bc]
lea ebp, [ecx + esi]
imul ecx, ecx, 0x7f9f
mov eax, 0x49f13bb3
imul ebp, ebp, 0xbc94
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, dword [0x43c0ac]
mov edx, eax
imul edx, edx, 0x83eb
add ebp, edx
add ebp, ecx
mov ecx, dword [0x43c0c8]
add ecx, eax
imul ecx, ecx, 0x8386f
mov eax, 0x7c32ca05
imul esi
sar edx, 0xf
lea ecx, [ecx + ebp*2 - 0x17928]
add ecx, edx
mov esi, edx
shr esi, 0x1f
add esi, ecx
mov ecx, dword [str._r_____r____]
mov eax, 0x3e565a5f
imul ecx
mov ecx, dword [0x43c0b4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4030a4dd
imul ecx
mov eax, dword [esp + 0x14]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0xf4]
sub esi, ecx
mov dword [esp + edi*4 + 0x24], edx
inc edi
add ebx, 0x40
add eax, 0x40
mov dword [0x43c0b4], esi
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0xec]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x407924
mov ecx, dword [0x43c0c0]
mov edx, dword [0x43c0b0]
mov eax, dword [0x43c0ac]
lea ebx, [edx + ecx]
imul eax, eax, 0x862b1
mov edx, dword [0x43c0b4]
imul ebx, ebx, 0x17928
add ebx, eax
mov eax, 0x49f13bb3
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x43c0b8]
imul edx, edx, 0x106d4
sub ebx, ecx
mov ecx, dword [str._r_____r____]
add ebx, edx
mov eax, 0x3e565a5f
imul ecx
mov ecx, dword [0x43c0bc]
sar edx, 0xe
imul ecx, ecx, 0x1fe7c
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
lea edx, [ebx + ecx - 0x17928]
push esi
mov dword [0x43c0b0], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe94]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.00415ffe
add esp, 0xe88
ret