Function at 0x40faf0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x45f640]
xor eax, esp
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45dbd4]
mov esi, dword [0x45dbcc]
mov edi, eax
mov eax, 0xc69fb513
imul ecx
add edx, ecx
sar edx, 0x19
mov ebx, edx
mov eax, esi
imul eax, eax, 0x33bbc84
shr ebx, 0x1f
add ebx, edx
add ebx, eax
mov eax, 0x2ee68aa5
imul esi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
sub ebx, eax
imul edx, edx, 0x20e865f
mov eax, dword [0x45dbdc]
imul eax, eax, 0x362805a
add ebx, edx
add ebx, eax
mov eax, 0xc41087d7
imul ecx
add edx, ecx
sar edx, 0x1a
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xc41087d7
imul esi
add edx, esi
sar edx, 0x1a
sub ebx, ecx
mov eax, edx
lea ecx, [esp + 0xa0]
shr eax, 0x1f
add ebx, edx
push ecx
add eax, ebx
push edi
mov dword [esp + 0x24], edi
mov dword [esp + 0xa8], 0x128
mov dword [str._r_____r____], eax
mov dword [esp + 0x20], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40fbdc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9bc]
xor ecx, esp
call fcn.0043079d
add esp, 0x9c0
ret
mov ecx, dword [0x45dbd4]
mov edi, dword [0x45dbe4]
mov eax, 0xc69fb513
imul ecx
add edx, ecx
mov esi, edi
imul esi, esi, 0x3e6f678
sar edx, 0x19
add esi, edx
mov ebx, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x33bbc84
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45dbcc]
add ebx, edx
mov eax, 0x83228937
imul esi
mov eax, dword [0x45dbe8]
add edx, esi
imul eax, eax, 0x20e865f
sar edx, 0x19
mov esi, edx
add ebx, edx
shr esi, 0x1f
add esi, ebx
sub esi, eax
mov eax, 0x974409b3
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
push ebp
mov ebp, dword [str._r_____r____]
sub ecx, ebp
add ecx, 0x276937b
mov dword [0x45dbcc], ecx
xor eax, eax
jmp 0x40fc70
mov dl, byte [esp + eax + 0xc8]
mov byte [esp + eax + 0x1cc], dl
inc eax
test dl, dl
jne 0x40fc70
mov esi, dword [0x45dbdc]
mov edx, dword [0x45dbd8]
mov eax, ebp
imul eax, eax, 0x293e68d
mov dword [esp + 0x18], eax
lea ebx, [edx + ebp]
mov eax, 0xc69fb513
imul ebx, ebx, 0x362805a
imul esi
add edx, esi
sar edx, 0x19
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov edx, esi
imul edx, edx, 0x33bbc84
add eax, edx
mov ebx, eax
mov eax, 0x83228937
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe0]
sub ebx, eax
add ebx, dword [esp + 0x18]
lea eax, [ebx + edx - 0x3e6f678]
mov edx, dword [esp + 0x9d4]
mov dword [0x45dbd4], eax
mov dword [esp + 0x14], edx
lea eax, [esp + 0x1cc]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x40fd32
test dl, dl
je 0x40fd2e
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x40fd32
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x40fd02
xor eax, eax
jmp 0x40fd37
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fdaa
mov eax, dword [0x45dbd0]
imul esi, esi, 0x3e6f678
lea ebx, [eax + ecx]
mov eax, 0xc69fb513
imul ebx, ebx, 0x2baab78
imul edi
mov eax, dword [0x45dbe0]
imul eax, eax, 0x35bbff4
add edx, edi
sar edx, 0x19
add ebx, esi
mov esi, edx
add ebx, edx
shr esi, 0x1f
add esi, ebx
add esi, eax
mov eax, 0x974409b3
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xc41087d7
imul edi
add edx, edi
sar edx, 0x1a
sub esi, ecx
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x45dbdc], eax
mov dword [esp + 0x1c], 1
mov ecx, dword [0x45dbc8]
mov edx, dword [0x45dbd4]
lea esi, [ecx + edx]
mov ecx, dword [0x45dbd8]
imul esi, esi, 0x3e78532
mov eax, 0xc69fb513
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x2ee68aa5
imul ecx
sar edx, 0x17
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xcfdc5805
imul ebp
mov ebx, dword [esp + 0x18]
sub esi, ecx
add edx, ebp
sar edx, 0x19
mov ecx, edx
add esi, edx
mov eax, 0xc41087d7
imul edi
add edx, edi
sar edx, 0x1a
shr ecx, 0x1f
mov eax, edx
add ecx, esi
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
sub ecx, eax
add ecx, ebx
mov dword [0x45dbe4], ecx
lea ecx, [esp + 0xa4]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40fff4
mov eax, dword [esp + 0x1c]
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea esi, [esp + eax + 0x1cc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], esi
jmp 0x40fe70
mov esi, dword [esp + 0x18]
lea esp, [esp]
mov edi, dword [0x45dbd0]
mov ecx, dword [0x45dbc8]
imul ecx, ecx, 0x3e6f678
mov eax, 0x1066a8b3
imul edi
sar edx, 0x16
add ecx, edx
mov ebx, edx
mov eax, 0x4f2cca89
imul edi
sar edx, 0x18
shr ebx, 0x1f
add ebx, ecx
add ebx, edx
mov ebp, edx
mov eax, 0x4c3a114b
imul edi
sar edx, 0x18
shr ebp, 0x1f
mov ecx, edx
add ebp, ebx
mov ebx, dword [0x45dbe4]
add ebp, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0xac2519
shr ecx, 0x1f
add ecx, ebp
sub ecx, edx
mov eax, 0x974409b3
imul ebx
add edx, ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x45dbc8], ecx
lea eax, [esp + 0xc8]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40fef1
mov ebp, dword [esp + 0x9d4]
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40ff2b
test al, al
je 0x40ff27
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40ff2b
add esi, 2
add ebp, 2
test al, al
jne 0x40ff06
xor eax, eax
jmp 0x40ff30
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ffda
mov esi, dword [0x45dbd8]
imul ecx, ecx, 0x362805a
mov eax, 0x1066a8b3
imul esi
imul esi, esi, 0x5390766
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0xcfdc5805
imul edi
add edx, edi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x20e865f
sub ebp, eax
add ebp, edx
add ebp, ecx
mov ecx, dword [0x45dbdc]
mov eax, 0xc41087d7
imul ecx
add edx, ecx
mov ecx, dword [esp + 0xac]
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
add ebp, esi
sub ebp, eax
mov eax, dword [esp + 0x1c]
sub ebp, ebx
mov dword [esp + eax*4 + 0x24], ecx
mov ecx, dword [esp + 0x18]
sub ebp, 0x3e6f678
inc eax
mov dword [esp + 0x1c], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [0x45dbd0], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
lea edx, [esp + 0xa4]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40fe65
mov esi, dword [0x45dbe8]
mov edi, dword [0x45dbc8]
imul edi, edi, 0x293e68d
mov ecx, esi
imul ecx, ecx, 0x3e6f678
sub edi, ecx
mov ecx, dword [0x45dbd4]
mov eax, 0xc69fb513
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x4f2cca89
imul esi
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45dbe0]
mov eax, 0x83228937
imul ecx
add edx, ecx
imul ecx, ecx, 0x3e78532
sar edx, 0x19
mov ebx, edx
add edi, edx
mov eax, 0x7c780d21
imul esi
shr ebx, 0x1f
sar edx, 0x18
add ebx, edi
add ebx, ecx
mov ecx, dword [esp + 0x20]
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
push ecx
mov dword [0x45dbd8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9cc]
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043079d
add esp, 0x9c0
ret