Function at 0x40f600
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x964
mov eax, dword [0x460640]
xor eax, ebp
mov dword [esp + 0x960], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0x1c], eax
mov eax, dword [0x45ecd4]
push esi
mov esi, dword [0x45eccc]
cdq
push edi
mov edi, eax
push 0x14
mov ebx, edx
mov eax, esi
cdq
push 0x76aab896
push edx
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
call fcn.00432020
push 0x14
push 0x76aab896
push ebx
push edi
mov dword [esp + 0x20], eax
call fcn.00432020
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
push 0xf
push 0x3c2325f6
sub ecx, eax
mov eax, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x20], ecx
call fcn.00432020
mov ecx, dword [esp + 0x10]
push 0x13
push 0x2c2da253
mov edx, ebx
push edx
sub ecx, eax
push edi
mov dword [esp + 0x20], ecx
call fcn.00432020
imul esi, esi, 0x392bae29
mov ecx, dword [esp + 0x10]
mov edx, dword [0x45ece8]
add ecx, eax
imul edx, edx, 0x471ee414
mov eax, dword [0x45ecdc]
imul eax, eax, 0x3dbf610d
add ecx, eax
add ecx, edx
add ecx, esi
mov dword [str._r_____r____], ecx
xor eax, eax
mov byte [esp + 0x168], 0
mov ecx, 0x1ff
lea edi, [esp + 0x169]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x16c]
push 0x44effc
push ecx
call fcn.004320ca
mov eax, dword [0x45ecd0]
cdq
mov edi, eax
mov eax, dword [0x45ece4]
mov ebx, edx
add esp, 0xc
mov dword [esp + 0x34], ebx
cdq
push 0xd
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 8
push 0x42a7b17d
push ebx
push edi
mov dword [esp + 0x20], eax
call fcn.00432020
push 3
push 0xce4a7dc6
mov esi, eax
mov eax, dword [esp + 0x18]
push ebx
push edi
sub esi, eax
call fcn.00432020
push 0x13
push 0x392bae29
push ebx
push edi
add esi, eax
call fcn.00432020
mov edx, dword [0x45ece0]
add esi, eax
imul edx, edx, 0xafbbe1e
mov eax, dword [0x45ecc8]
imul eax, eax, 0x31b5823a
add esi, edx
sub esi, eax
mov eax, dword [0x45ecd4]
cdq
mov ebx, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x471ee414
mov dword [esp + 0x24], eax
mov eax, dword [0x45eccc]
push 8
mov dword [esp + 0x20], edx
cdq
push 0x974b287b
push edx
push eax
mov dword [0x45ecc8], esi
mov dword [esp + 0x28], ebx
call fcn.00432020
mov ecx, dword [esp + 0x1c]
push 0xd
push 0x3dbf610d
push ecx
push ebx
mov dword [esp + 0x20], eax
call fcn.00432020
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
push 0x13
push 0x2c2da253
add ecx, eax
push edx
mov eax, ebx
push eax
mov dword [esp + 0x20], ecx
call fcn.00432020
mov ecx, dword [esp + 0x10]
mov edx, dword [0x45ece4]
mov ebx, dword [str._r_____r____]
imul edx, edx, 0x31b5823a
add ecx, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0x392bae29
sub ecx, edx
mov edx, dword [esp + 0x24]
add ecx, eax
mov eax, dword [0x45ecdc]
sub ecx, ebx
sub ecx, edx
sub ecx, 0x1bcdabbc
mov dword [0x45eccc], ecx
mov dword [esp + 0x10], 0
cdq
push 0x14
push 0x76aab896
push edx
push eax
call fcn.00432020
mov ebx, eax
mov eax, dword [0x45ecd8]
push 3
cdq
push 0xce4a7dc6
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x34]
push 0x10
push 0xe4325444
push ecx
sub eax, ebx
push edi
mov ebx, eax
call fcn.00432020
imul esi, esi, 0x3dbf610d
mov edx, dword [esp + 0x24]
sub ebx, eax
mov eax, dword [0x45ecd8]
imul eax, eax, 0x76aab896
add ebx, esi
mov esi, dword [0x45ece4]
add ebx, eax
sub ebx, esi
push 0
lea eax, [ebx + edx + 0x31b5823a]
push 2
mov dword [0x45ecd0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
push 8
mov dword [esp + 0x24], edi
push 0x974b287b
jne 0x40f942
mov esi, dword [0x45ecdc]
mov ecx, dword [0x45ecd8]
mov edi, dword [str._r_____r____]
mov eax, esi
cdq
push edx
lea ebx, [ecx + edi]
push eax
imul ebx, ebx, 0x3dbf610d
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call fcn.00432020
mov edx, dword [esp + 0x1c]
push 0x13
push 0x2c2da253
sub ebx, eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.00432020
imul esi, esi, 0x392bae29
imul edi, edi, 0x2c2da253
add ebx, eax
add esi, dword [0x45ece0]
add esi, ebx
lea ecx, [edi + esi + 0x31b5823a]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45ecd4], ecx
call fcn.00432bd6
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x960]
xor ecx, ebp
call fcn.00431e3d
mov esp, ebp
pop ebp
ret
mov esi, dword [0x45ece8]
mov eax, esi
cdq
mov dword [esp + 0x38], eax
mov eax, dword [0x45ece0]
mov dword [esp + 0x3c], edx
cdq
push edx
push eax
call fcn.00432020
mov ebx, eax
mov eax, dword [0x45ecd4]
push 0x13
cdq
push 0x2c2da253
push edx
push eax
call fcn.00432020
mov edx, dword [esp + 0x34]
push 0x14
push 0x471ee414
sub ebx, eax
mov eax, dword [esp + 0x38]
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push 0x13
push 0x392bae29
push ecx
push edx
add ebx, eax
call fcn.00432020
imul esi, esi, 0x31b5823a
sub ebx, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0x68b4d785
sub ebx, eax
mov eax, dword [0x45ecc8]
imul eax, eax, 0x2c2da253
lea ecx, [esp + 0x40]
add ebx, esi
push ecx
add ebx, eax
push edi
mov dword [0x45ecd8], ebx
mov dword [esp + 0x48], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40fa85
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
mov esi, eax
push 0xd
mov dword [esp + 0x20], edx
mov eax, ebx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
mov edx, dword [0x45ecd0]
add ebx, edx
imul ebx, ebx, 0x3c2325f6
push 0x14
sub ebx, eax
mov eax, dword [esp + 0x20]
push 0x76aab896
push eax
push esi
call fcn.00432020
mov ecx, dword [esp + 0x1c]
push 0x13
push 0x2c2da253
push ecx
push esi
add ebx, eax
call fcn.00432020
mov edx, dword [0x45ece0]
add ebx, eax
imul edx, edx, 0x42a7b17d
mov eax, dword [0x45ecdc]
imul eax, eax, 0x31b5823a
add ebx, edx
sub ebx, eax
push edi
mov dword [0x45ecdc], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x960]
xor ecx, ebp
call fcn.00431e3d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45eccc]
mov ecx, dword [0x45ecd0]
mov esi, dword [0x45ece8]
push 0xffffffffffffffef
cdq
push 0x1bcdabbc
push edx
lea ebx, [ecx + esi]
push eax
imul ebx, ebx, 0x1bcdabbc
call fcn.00432020
sub eax, ebx
mov ebx, eax
push 0xf
mov eax, esi
cdq
push 0x3c2325f6
push edx
push eax
call fcn.00432020
mov edx, dword [0x45ecd8]
mov ecx, dword [0x45ecd4]
imul edx, edx, 0x42a7b17d
add ebx, eax
imul ecx, ecx, 0x471ee414
mov eax, dword [0x45ecdc]
imul eax, eax, 0x31b5823a
add ebx, edx
add ebx, eax
lea edx, [esp + 0x168]
push edx
lea eax, [esp + 0x68]
sub ebx, ecx
push eax
mov dword [0x45ece0], ebx
call fcn.0043c95e
add esp, 8
test eax, eax
je 0x41000b
mov eax, dword [0x45ecc8]
cdq
mov edi, eax
mov eax, dword [str._r_____r____]
push 8
mov ebx, edx
cdq
push 0x42a7b17d
push edx
push eax
mov dword [esp + 0x4c], ebx
call fcn.00432020
mov esi, dword [0x45ecd0]
mov ecx, dword [0x45ecd8]
add ecx, esi
imul ecx, ecx, 0x392bae29
push 8
push 0x974b287b
push ebx
sub ecx, eax
push edi
mov dword [esp + 0x24], ecx
call fcn.00432020
mov ecx, dword [esp + 0x14]
push 0x13
push 0x2c2da253
mov edx, ebx
push edx
add ecx, eax
push edi
mov dword [esp + 0x24], ecx
call fcn.00432020
imul esi, esi, 0x2c2da253
mov ecx, dword [esp + 0x14]
add ecx, eax
mov eax, dword [0x45ece4]
imul eax, eax, 0x31b5823a
add ecx, eax
sub ecx, esi
mov dword [0x45ece8], ecx
mov ecx, dword [esp + 0x48]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45eccc]
mov dword [esp + 0x24], eax
mov eax, dword [0x45ecd4]
cdq
mov edi, eax
push 0x14
mov ebx, edx
mov eax, esi
cdq
push 0x76aab896
push edx
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
call fcn.00432020
push 0x14
push 0x76aab896
push ebx
push edi
mov dword [esp + 0x24], eax
call fcn.00432020
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x2c]
push 0xf
push 0x3c2325f6
sub ecx, eax
mov eax, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x24], ecx
call fcn.00432020
mov ecx, dword [esp + 0x14]
push 0x13
sub ecx, eax
push 0x2c2da253
mov edx, ebx
push edx
push edi
mov dword [esp + 0x24], ecx
call fcn.00432020
imul esi, esi, 0x392bae29
mov ecx, dword [esp + 0x14]
mov edx, dword [0x45ece8]
add ecx, eax
imul edx, edx, 0x471ee414
mov eax, dword [0x45ecdc]
imul eax, eax, 0x3dbf610d
add ecx, eax
mov eax, dword [esp + 0x24]
add ecx, edx
add ecx, esi
test eax, eax
mov dword [str._r_____r____], ecx
jne 0x40fc6e
push 0x44efc8
call fcn.00432bd6
add esp, 4
jmp 0x40fd04
mov eax, dword [0x45ecd0]
cdq
mov esi, eax
mov eax, dword [0x45ece4]
push 0xd
mov edi, edx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 8
push 0x42a7b17d
push edi
push esi
mov ebx, eax
call fcn.00432020
push 3
push 0xce4a7dc6
push edi
sub eax, ebx
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x392bae29
push edi
push esi
add ebx, eax
call fcn.00432020
mov ecx, dword [0x45ecc8]
mov esi, dword [esp + 0x24]
imul ecx, ecx, 0x31b5823a
add ebx, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0xafbbe1e
add ebx, eax
sub ebx, ecx
push esi
mov dword [0x45ecc8], ebx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40fcfd
push 0x44efb4
call fcn.00432bd6
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x45ecd4]
cdq
mov esi, eax
mov eax, dword [0x45eccc]
push 8
mov edi, edx
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
push 0xd
push 0x3dbf610d
push edi
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push edi
push esi
add ebx, eax
call fcn.00432020
mov edx, dword [0x45ece4]
mov ecx, dword [0x45ece0]
imul edx, edx, 0x31b5823a
mov edi, dword [esp + 0x20]
imul ecx, ecx, 0x392bae29
add ebx, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x471ee414
sub ebx, edx
sub ebx, eax
mov eax, dword [str._r_____r____]
add ebx, ecx
lea edx, [esp + 0x40]
sub ebx, eax
push edx
sub ebx, 0x1bcdabbc
push edi
mov dword [0x45eccc], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40fa85
mov esi, dword [0x45ece4]
mov eax, dword [0x45ecdc]
push 0x14
cdq
push 0x76aab896
push edx
push eax
call fcn.00432020
mov ebx, eax
mov eax, dword [0x45ecd8]
push 3
cdq
push 0xce4a7dc6
push edx
push eax
call fcn.00432020
sub eax, ebx
mov ebx, eax
mov eax, dword [0x45ecd0]
push 0x10
cdq
push 0xe4325444
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ece8]
sub ebx, eax
imul ecx, ecx, 0x471ee414
mov eax, dword [0x45ecc8]
imul eax, eax, 0x3dbf610d
add ebx, eax
mov eax, dword [0x45ecd8]
imul eax, eax, 0x76aab896
add ebx, eax
add ebx, ecx
sub ebx, esi
add ebx, 0x31b5823a
push edi
mov dword [0x45ecd0], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40f92b
mov esi, dword [0x45ecdc]
mov ecx, dword [0x45ecd8]
mov edi, dword [str._r_____r____]
push 8
mov eax, esi
cdq
push 0x974b287b
push edx
lea ebx, [ecx + edi]
push eax
imul ebx, ebx, 0x3dbf610d
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call fcn.00432020
mov edx, dword [esp + 0x1c]
push 0x13
push 0x2c2da253
sub ebx, eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.00432020
imul esi, esi, 0x392bae29
imul edi, edi, 0x2c2da253
mov ecx, dword [0x45ece0]
mov edx, dword [esp + 0x48]
add esi, ecx
add ebx, eax
push edx
add esi, ebx
push 0
lea ecx, [edi + esi + 0x31b5823a]
push 0x1f0fff
mov dword [0x45ecd4], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45eccc]
mov dword [esp + 0x24], eax
mov eax, dword [0x45ecd4]
cdq
push 0x13
mov edi, eax
mov ebx, edx
push 0x2c2da253
mov eax, esi
cdq
push ebx
push edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
call fcn.00432020
mov ecx, dword [esp + 0x28]
push 0x14
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
push 0x76aab896
push eax
push ecx
call fcn.00432020
push 0x14
push 0x76aab896
push ebx
push edi
mov dword [esp + 0x30], eax
call fcn.00432020
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
push 0xf
push 0x3c2325f6
sub ecx, eax
mov eax, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x30], ecx
call fcn.00432020
mov edx, dword [0x45ecdc]
mov ecx, dword [esp + 0x20]
imul edx, edx, 0x3dbf610d
mov edi, dword [0x45ece8]
sub ecx, eax
add ecx, edx
mov eax, edi
mov ebx, dword [esp + 0x10]
imul eax, eax, 0x471ee414
imul esi, esi, 0x392bae29
add eax, ebx
add eax, ecx
add esi, eax
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [str._r_____r____], esi
je 0x40f92b
mov esi, dword [0x45ece0]
mov eax, edi
cdq
mov ebx, eax
push 8
mov dword [esp + 0x38], edx
mov eax, esi
cdq
push 0x974b287b
push edx
push eax
mov dword [esp + 0x40], ebx
call fcn.00432020
mov ecx, dword [esp + 0x34]
push 0x14
push 0x471ee414
push ecx
push ebx
mov dword [esp + 0x30], eax
call fcn.00432020
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x34]
push 0x13
push 0x392bae29
add ecx, eax
push edx
mov eax, ebx
push eax
mov dword [esp + 0x30], ecx
call fcn.00432020
imul esi, esi, 0x68b4d785
imul edi, edi, 0x31b5823a
mov edx, dword [0x45ecc8]
mov ecx, dword [esp + 0x20]
imul edx, edx, 0x2c2da253
sub ecx, eax
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, edi
add ecx, edx
sub ecx, eax
mov eax, dword [esp + 0x24]
mov dword [0x45ecd8], ecx
mov ecx, dword [esp + 0x96c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431e3d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45ecd8]
cdq
mov dword [esp + 0x18], eax
mov eax, dword [0x45ece4]
push 0xffffffffffffffeb
mov dword [esp + 0x20], edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecc8]
mov ebx, dword [str._r_____r____]
mov esi, eax
mov eax, dword [0x45ecd4]
add ecx, eax
imul ecx, ecx, 0x68b4d785
push 0x10
mov eax, ebx
cdq
push 0xe4325444
push edx
push eax
sub esi, ecx
call fcn.00432020
mov edx, dword [esp + 0x1c]
push 0xf
push 0x3c2325f6
add esi, eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0x13
push 0x2c2da253
push ecx
push edx
sub esi, eax
call fcn.00432020
imul ebx, ebx, 0x2c2da253
sub esi, eax
mov eax, dword [esp + 0x48]
add esi, ebx
mov dword [0x45ece4], esi
mov dword [esp + 0x10], eax
jmp 0x40fd9d