Function at 0x40c4b0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x458190]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x456824]
mov edi, eax
mov ecx, dword [0x45682c]
mov eax, 0x606c8017
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x329dfa79
imul esi
sar edx, 0x14
sub ebx, ecx
mov ecx, dword [0x456838]
mov eax, edx
imul ecx, ecx, 0x15bc8b
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x53af19
sub ebx, eax
lea eax, [esp + 0xa0]
add ebx, ecx
push eax
add ebx, edx
push edi
mov dword [esp + 0x18], edi
mov dword [esp + 0xa8], 0x128
mov dword [str._r_____r____], ebx
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40c57b
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9bc]
call fcn.0042a161
add esp, 0x9c0
ret
mov esi, dword [0x456838]
mov ecx, dword [0x45681c]
mov eax, 0x606c8017
imul esi
imul esi, esi, 0x15bc8b
sar edx, 0x15
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x622f07f9
imul ecx
sar edx, 0x15
add edi, edx
mov ecx, edx
mov edx, dword [0x456830]
imul edx, edx, 0x53af19
shr ecx, 0x1f
add ecx, edi
sub ecx, esi
add ecx, edx
sub ecx, dword [0x456824]
add ecx, 0x42333a
mov dword [0x45681c], ecx
xor eax, eax
jmp 0x40c5e0
mov dl, byte [esp + eax + 0xc4]
mov byte [esp + eax + 0x1c8], dl
inc eax
test dl, dl
jne 0x40c5e0
mov edx, dword [0x45682c]
mov esi, dword [str._r_____r____]
mov ebx, dword [0x456834]
imul esi, esi, 0x54f550
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebp
mov ebp, dword [0x456818]
mov edi, dword [esp + 0x9d4]
mov edx, ebp
imul edx, edx, 0x53af19
add edx, ebx
mov ebx, dword [0x456828]
sub esi, eax
mov eax, ebx
imul eax, eax, 0x779018
add edx, esi
lea edx, [eax + edx - 0x45ab63]
mov dword [0x456824], edx
lea esi, [esp + 0x1cc]
lea ebx, [ebx]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40c684
test al, al
je 0x40c680
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40c684
add esi, 2
add edi, 2
test al, al
jne 0x40c660
xor eax, eax
jmp 0x40c689
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c6e9
mov edx, dword [0x456820]
mov esi, edx
mov eax, 0x329dfa79
imul esi, esi, 0x537276
imul edx
mov eax, dword [0x456830]
imul eax, eax, 0x31e0ba
sar edx, 0x14
mov edi, edx
shr edi, 0x1f
add esi, edx
add edi, esi
add edi, eax
mov eax, dword [0x456824]
imul eax, eax, 0x45ab63
add edi, eax
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [0x45682c], edi
mov dword [esp + 0x10], 1
mov eax, 0x606c8017
imul ebp, ebp, 0x536f78
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xc4570565
imul ebx
mov esi, ebx
imul esi, esi, 0x54f550
add edx, ebx
sar edx, 0x16
mov eax, edx
sub esi, ecx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x329dfa79
imul dword [0x456834]
mov eax, dword [esp + 0x14]
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0xa4]
add esi, ebp
push edx
sub esi, ecx
push eax
mov dword [0x456834], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40c8d2
mov eax, dword [esp + 0x10]
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea edi, [esp + eax + 0x1cc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
jmp 0x40c784
mov edi, dword [esp + 0x18]
mov ebp, dword [0x456820]
mov ebx, dword [0x456830]
mov eax, 0x521ee247
imul ebp
mov esi, dword [0x456834]
sar edx, 0x14
mov ecx, ebx
imul ecx, ecx, 0x537276
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, ebp
imul ecx, ecx, 0x45ab63
add eax, ecx
mov dword [esp + 0x20], eax
mov eax, 0x759571eb
imul esi
mov eax, dword [esp + 0x20]
sar edx, 0x15
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x224214b1
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x456818], ecx
lea eax, [esp + 0xc8]
mov dl, byte [eax]
mov byte [edi + eax], dl
inc eax
test dl, dl
jne 0x40c7f6
mov edi, dword [esp + 0x9d4]
mov esi, dword [esp + 0x1c]
jmp 0x40c810
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40c834
test al, al
je 0x40c830
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40c834
add esi, 2
add edi, 2
test al, al
jne 0x40c810
xor eax, eax
jmp 0x40c839
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c8b8
mov edx, dword [0x45682c]
imul ecx, ecx, 0x779018
mov esi, dword [str._r_____r____]
mov eax, 0x329dfa79
imul esi, esi, 0x50ebd8
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1eefbef3
imul ebp
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x1c]
sub esi, eax
mov eax, dword [esp + 0x10]
add esi, ecx
mov ecx, dword [esp + 0xac]
sub esi, ebx
mov dword [esp + eax*4 + 0x24], ecx
mov ecx, dword [esp + 0x18]
sub esi, 0x45ab63
inc eax
mov dword [esp + 0x10], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [0x456820], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xa4]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40c780
mov ecx, dword [0x456824]
mov esi, dword [0x45681c]
mov eax, 0x606c8017
imul esi, esi, 0x536f78
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x456838]
mov eax, 0xbc70579
imul ecx
sar edx, 0x10
mov edi, edx
add esi, edx
mov eax, 0x61e4609d
imul ecx
imul ecx, ecx, 0x45ab63
sar edx, 0x15
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, esi
add eax, edx
sub edi, eax
sub edi, ecx
mov ecx, dword [esp + 0x14]
push ecx
mov dword [0x456828], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9cc]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
call fcn.0042a161
add esp, 0x9c0
ret