Function at 0x40c680
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x458190]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9cc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x456824]
mov edi, dword [0x456830]
mov esi, eax
imul edi, edi, 0x340e3f9
mov eax, 0x281003eb
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x9b24a0b5
imul ecx
add edx, ecx
mov ecx, dword [0x45682c]
sar edx, 0x19
mov ebx, edx
add edi, edx
mov eax, 0x4eff369
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456838]
imul edx, edx, 0xdc19cb
shr ebx, 0x1f
add ebx, edi
lea eax, [esp + 0x9c]
sub ebx, ecx
push eax
add ebx, edx
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0xa4], 0x128
mov dword [str._r_____r____], ebx
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40c749
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b8]
call fcn.0042a3c1
add esp, 0x9bc
ret
mov ecx, dword [0x456838]
mov esi, dword [0x456830]
mov eax, 0x9b24a0b5
imul esi, esi, 0x340e3f9
imul ecx
add edx, ecx
imul ecx, ecx, 0xdc19cb
sar edx, 0x19
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
sub edi, ecx
mov ecx, dword [0x45681c]
mov eax, 0x4eff7f81
imul ecx
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add edi, edx
mov edx, dword [0x456824]
add ecx, edi
sub ecx, edx
add ecx, 0x298583a
mov dword [0x45681c], ecx
xor eax, eax
jmp 0x40c7b0
mov dl, byte [esp + eax + 0xc0]
mov byte [esp + eax + 0x1c4], dl
inc eax
test dl, dl
jne 0x40c7b0
mov esi, dword [0x456828]
mov eax, dword [str._r_____r____]
imul esi, esi, 0x4b2efd8
push ebp
imul eax, eax, 0x34cd890
mov ebp, dword [0x456818]
mov edx, ebp
imul edx, edx, 0x340e3f9
add esi, edx
mov edx, dword [0x45682c]
add esi, eax
mov edi, dword [esp + 0x9d0]
mov eax, 0x4eff7f81
imul edx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456834]
sub esi, eax
lea ebx, [esi + edx - 0x2b747a3]
mov dword [0x456824], ebx
lea esi, [esp + 0x1c8]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40c84b
test al, al
je 0x40c847
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40c84b
add esi, 2
add edi, 2
test al, al
jne 0x40c827
xor eax, eax
jmp 0x40c850
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c8aa
mov esi, dword [0x456820]
imul ebx, ebx, 0x2b747a3
mov eax, 0x6cf5c25f
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x281003eb
imul esi
imul esi, esi, 0x33d9a16
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [0x456830]
imul eax, eax, 0x1eadb5a
sub edx, edi
add edx, eax
add edx, ebx
add edx, esi
mov dword [0x45682c], edx
mov ebx, 1
jmp 0x40c8ae
mov ebx, dword [esp + 0x10]
mov esi, dword [0x456828]
imul ebp, ebp, 0x33d9718
mov eax, 0x281003eb
imul dword [0x456834]
sar edx, 0x17
mov eax, edx
mov edi, esi
imul edi, edi, 0x34cd890
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x9b24a0b5
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x4eff369
imul esi
sar edx, 0x14
mov eax, edx
sub edi, ecx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xa0]
sub edi, eax
push ecx
add edi, ebp
push edx
mov dword [0x456834], edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40ca95
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea esi, [esp + eax + 0x1c8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
jmp 0x40c950
mov esi, dword [esp + 0x10]
lea ecx, [ecx]
mov ecx, dword [0x456834]
mov ebp, dword [0x456820]
mov eax, 0x6cf5c25f
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x858372bd
imul ebp
add edx, ebp
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebp
imul edx, edx, 0x2b747a3
sub eax, edi
add eax, edx
mov edi, eax
mov eax, 0x17908a77
imul ecx
mov eax, dword [0x456830]
imul eax, eax, 0x33d9a16
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
sub ecx, eax
mov dword [0x456818], ecx
lea eax, [esp + 0xc4]
lea ecx, [ecx]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40c9c0
mov edi, dword [esp + 0x9d0]
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40c9f9
test al, al
je 0x40c9f5
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40c9f9
add esi, 2
add edi, 2
test al, al
jne 0x40c9d5
xor eax, eax
jmp 0x40c9fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ca7b
mov edx, dword [0x45682c]
imul ecx, ecx, 0x4b2efd8
mov eax, 0x281003eb
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x331ebb8
sub ecx, eax
add ecx, edx
mov eax, 0x62a5c8bd
imul ebp
mov ebp, dword [0x456830]
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
sub ecx, eax
sub ecx, ebp
sub ecx, 0x2b747a3
mov dword [0x456820], ecx
mov ecx, dword [esp + 0xa8]
mov dword [esp + ebx*4 + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xa0]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40c949
mov ecx, dword [0x456838]
mov esi, dword [0x456824]
mov eax, 0x2757ae75
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x64db5f4b
imul esi
sub edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x2b747a3
mov esi, eax
sub esi, edi
sub esi, edx
mov eax, 0x4a704a7b
imul ecx
mov ecx, dword [0x45681c]
imul ecx, ecx, 0x33d9718
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [esp + 0x18]
add eax, esi
add eax, ecx
push edx
mov dword [0x456828], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c8]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0042a3c1
add esp, 0x9bc
ret