Function at 0x40c520
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x458190]
push esi
push edi
push 0
push 2
mov dword [esp + 0x9cc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x456824]
mov esi, eax
mov eax, 0x4b226983
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45681c]
mov edi, eax
mov eax, 0x4c8d67b3
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0xd429
sub edi, eax
add edi, edx
mov eax, 0x2760f26d
imul ecx
mov ecx, dword [0x456838]
sar edx, 0xd
imul ecx, ecx, 0x38bb
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [esp + 0x9c]
sub edi, eax
push edx
add edi, ecx
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0xa4], 0x128
mov dword [str._r_____r____], edi
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40c5e7
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x9bc]
call fcn.0042a0b1
add esp, 0x9c0
ret
mov ecx, dword [0x456838]
mov eax, 0x4b226983
imul ecx
imul ecx, ecx, 0x38bb
push ebx
push ebp
mov ebp, dword [0x456830]
sar edx, 0xe
mov eax, ebp
imul eax, eax, 0xd429
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45681c]
add edi, eax
mov eax, 0x4da3463f
imul edx
sar edx, 0xe
mov esi, edx
shr esi, 0x1f
add edi, edx
add esi, edi
sub esi, ecx
mov ecx, dword [str._r_____r____]
sub esi, ecx
add esi, 0xa9e2
mov dword [0x45681c], esi
xor eax, eax
jmp 0x40c650
mov dl, byte [esp + eax + 0xc8]
mov byte [esp + eax + 0x1cc], dl
inc eax
test dl, dl
jne 0x40c650
mov ebx, dword [0x456818]
imul ecx, ecx, 0xda10
mov edx, ebx
imul edx, edx, 0xd429
add ecx, edx
mov eax, 0x4da3463f
imul dword [0x45682c]
mov edi, dword [esp + 0x9d4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
imul edx, edx, 0x13350
sub ecx, eax
add ecx, ebp
lea eax, [edx + ecx - 0xb323]
mov dword [0x456824], eax
lea eax, [esp + 0x1cc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x40c6dc
test cl, cl
je 0x40c6d8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x40c6dc
add eax, 2
add edi, 2
test cl, cl
jne 0x40c6b8
xor eax, eax
jmp 0x40c6e1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c73c
mov ecx, dword [0x456820]
imul ebp, ebp, 0x801a
mov edi, ecx
mov eax, 0x2760f26d
imul edi, edi, 0xd606
imul ecx
mov eax, dword [0x45682c]
imul eax, eax, 0xb323
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
add ecx, eax
mov eax, 0x6aa0ab9b
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, ebp
mov dword [0x45682c], ecx
mov dword [esp + 0x10], 1
mov ecx, dword [0x456828]
imul ebx, ebx, 0xd308
mov eax, 0x4b226983
imul ecx
mov esi, ecx
sar edx, 0xe
imul esi, esi, 0xda10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4c8d67b3
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x456834]
mov eax, 0x2760f26d
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xa4]
add esi, ebx
push ecx
sub esi, eax
push edx
mov dword [0x456834], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40c92d
mov eax, dword [esp + 0x10]
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea esi, [esp + eax + 0x1cc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], esi
jmp 0x40c7e0
mov esi, dword [esp + 0x18]
lea ecx, [ecx]
mov ebx, dword [0x456834]
mov ecx, dword [0x456830]
mov eax, 0x955f5465
imul ecx, ecx, 0xd606
imul ebx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov ebp, dword [0x456820]
sub edi, ecx
mov ecx, dword [0x456818]
mov eax, 0x2dbafdc3
imul ecx, ecx, 0xb323
imul ebx
sar edx, 0xd
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
add eax, ecx
mov edi, eax
mov eax, 0x7fe60547
imul ebp
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov dword [0x456818], ecx
lea eax, [esp + 0xc8]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40c850
mov edi, dword [esp + 0x9d4]
mov esi, dword [esp + 0x1c]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40c889
test al, al
je 0x40c885
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40c889
add esi, 2
add edi, 2
test al, al
jne 0x40c865
xor eax, eax
jmp 0x40c88e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c913
mov edx, dword [0x45682c]
imul ecx, ecx, 0x13350
mov esi, dword [str._r_____r____]
mov eax, 0x2760f26d
imul esi, esi, 0xd008
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xc0e2caa9
imul ebp
mov eax, dword [esp + 0x10]
add esi, ecx
add edx, ebp
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0xac]
sub esi, ecx
mov ecx, dword [esp + 0x18]
sub esi, ebx
mov dword [esp + eax*4 + 0x24], edx
mov edx, dword [esp + 0x1c]
sub esi, 0xb323
inc eax
mov dword [esp + 0x10], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [0x456820], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xa4]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40c7d9
mov ecx, dword [0x456824]
mov eax, 0x4b226983
imul ecx
mov ecx, dword [0x456838]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x658cf6d9
imul ecx
sub edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45681c]
imul edx, edx, 0xd308
mov edi, eax
sub edi, esi
add edi, edx
mov eax, 0x2419bc59
imul ecx
imul ecx, ecx, 0xb323
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
mov ecx, dword [esp + 0x14]
push ecx
mov dword [0x456828], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9cc]
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
call fcn.0042a0b1
add esp, 0x9c0
ret