Function at 0x40f700
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x45e640]
push ebx
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x45ccd4]
mov edi, eax
mov ecx, dword [0x45cccc]
mov eax, 0x4f576647
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4f576647
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x242
mov ebp, eax
sub ebp, ebx
add ebp, edx
mov eax, 0x38e38e39
imul esi
mov eax, dword [0x45cce8]
sar edx, 7
imul eax, eax, 0x21e
mov esi, edx
add ebp, edx
mov edx, ecx
imul edx, edx, 0x203
shr esi, 0x1f
add esi, ebp
add esi, eax
add esi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
lea ecx, [esp + 0xa4]
add eax, edx
push ecx
sub esi, eax
push edi
mov dword [esp + 0x24], edi
mov dword [esp + 0xac], 0x128
mov dword [str._r_____r____], esi
mov dword [esp + 0x28], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40f7eb
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9bc]
call fcn.0042fb01
add esp, 0x9c0
ret
mov ecx, dword [0x45ccd4]
mov eax, 0x71625345
imul ecx
mov ebp, dword [0x45cce0]
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x38e38e39
imul ecx
mov eax, dword [0x45cce8]
mov ecx, dword [0x45cce4]
imul eax, eax, 0x21e
sar edx, 7
imul ecx, ecx, 0xe1
add esi, edx
mov edi, edx
mov edx, ebp
imul edx, edx, 0x203
shr edi, 0x1f
add edi, esi
add edi, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x45cccc]
mov eax, 0xd20d20d3
imul ecx
mov eax, dword [str._r_____r____]
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
sub ecx, eax
add ecx, 0x16f
mov dword [0x45cccc], ecx
xor esi, esi
mov dl, byte [esp + esi + 0xc8]
mov byte [esp + esi + 0x1cc], dl
inc esi
test dl, dl
jne 0x40f870
mov edx, dword [0x45ccd8]
mov esi, dword [0x45ccdc]
lea ebx, [edx + eax]
lea edi, [eax + eax*8]
imul ebx, ebx, 0x242
mov eax, 0x38e38e39
imul esi
sar edx, 7
add ebx, edx
mov eax, edx
shr eax, 0x1f
mov edx, esi
imul edx, edx, 0x203
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0xd20d20d3
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0x9d4]
shl edi, 6
add ebx, edi
lea edx, [ebx + ebp - 0xe1]
mov dword [esp + 0x14], eax
mov dword [0x45ccd4], edx
lea eax, [esp + 0x1cc]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x40f923
test dl, dl
je 0x40f91f
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x40f923
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x40f8f3
xor eax, eax
jmp 0x40f928
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f9a0
mov eax, dword [0x45ccd0]
imul ebp, ebp, 0x25d
imul esi, esi, 0xe1
lea ebx, [eax + ecx]
imul ebx, ebx, 0x1bd
mov eax, 0x4f576647
imul dword [0x45cce4]
sar edx, 8
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, ebp
mov dword [esp + 0x18], eax
mov eax, 0x38e38e39
imul dword [0x45cce4]
mov eax, dword [esp + 0x18]
sar edx, 7
mov ebx, edx
add eax, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x71625345
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
add ebx, esi
mov dword [0x45ccdc], ebx
mov ebx, 1
jmp 0x40f9a4
mov ebx, dword [esp + 0x20]
mov edx, dword [0x45ccc8]
mov eax, dword [0x45ccd4]
lea esi, [edx + eax]
mov eax, 0x4f576647
imul esi, esi, 0x9c
imul dword [0x45cce4]
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45ccd8]
mov eax, 0x38e38e39
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x93459be7
imul ecx
add edx, ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x59493e15
imul dword [str._r_____r____]
sar edx, 7
mov eax, edx
sub esi, ecx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xa4]
add esi, edi
push ecx
add eax, esi
push edx
mov dword [0x45cce4], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40fbdd
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea esi, [esp + eax + 0x1cc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], esi
jmp 0x40fa60
mov esi, dword [esp + 0x18]
nop
mov edi, dword [0x45ccd0]
mov eax, 0xd8a5df
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x71625345
imul dword [0x45cce4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x7f411e53
imul edi
sar edx, 8
add ecx, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, ecx
mov ecx, dword [0x45ccc8]
imul ecx, ecx, 0xe1
mov eax, 0x91a2b3c5
imul edi
add edx, edi
add ebp, ecx
sar edx, 7
add ebp, edx
mov ecx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x61
shr ecx, 0x1f
add ecx, ebp
add ecx, edx
mov dword [0x45ccc8], ecx
lea eax, [esp + 0xc8]
lea ecx, [ecx]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40fae0
mov ebp, dword [esp + 0x9d4]
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40fb1a
test al, al
je 0x40fb16
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40fb1a
add esi, 2
add ebp, 2
test al, al
jne 0x40faf5
xor eax, eax
jmp 0x40fb1f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fbc3
mov edx, dword [0x45ccdc]
imul ecx, ecx, 0x242
mov esi, dword [0x45ccd8]
mov eax, 0x4f576647
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, esi
imul ebp, ebp, 0x33a
sub ebp, eax
add ebp, ecx
mov ecx, dword [0x45cce8]
imul ecx, ecx, 0x21e
mov eax, 0x59493e15
imul edi
sar edx, 7
add ebp, ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x91a2b3c5
imul esi
add edx, esi
sar edx, 7
add ebp, edx
mov ecx, edx
mov edx, dword [esp + 0xac]
shr ecx, 0x1f
add ecx, ebp
sub ecx, dword [0x45cce4]
sub ecx, 0xe1
mov dword [esp + ebx*4 + 0x24], edx
mov edx, dword [esp + 0x14]
mov dword [0x45ccd0], ecx
mov ecx, dword [esp + 0x18]
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xa4]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40fa5b
mov eax, dword [0x45ccc8]
mov ecx, dword [0x45ccd4]
lea edx, [eax + eax*8]
shl edx, 6
mov esi, edx
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x45cce8]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xf1d48bd
imul ecx
sar edx, 5
mov edi, edx
add esi, edx
mov eax, 0x7f411e53
imul ecx
imul ecx, ecx, 0xe1
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
add edi, esi
sub edi, eax
sub edi, ecx
mov ecx, dword [0x45cce0]
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
imul ecx, ecx, 0x9c
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, ecx
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [0x45ccd8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9cc]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
call fcn.0042fb01
add esp, 0x9c0
ret