Function at 0x415de0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe78
mov eax, dword [0x452944]
mov ecx, dword [0x4518dc]
mov dword [esp + 0xe74], eax
mov eax, 0x57bc6617
imul ecx
mov ecx, dword [0x4518e8]
sar edx, 0xd
push ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebp
push esi
mov esi, eax
mov eax, 0xf1bde717
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518f4]
push edi
mov edi, dword [0x4518ec]
sub ecx, esi
sub ecx, edi
push 0
lea eax, [ecx + edx - 0x5a6f]
push 2
mov dword [0x4518dc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x4518e8]
mov edi, dword [0x4518f4]
mov ebp, eax
imul edi, edi, 0x62fe
mov eax, 0x58fba7b7
imul esi
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518dc]
sub edi, ecx
mov ecx, dword [0x4518d8]
sub edi, ecx
imul ecx, ecx, 0xd4a0
lea eax, [edi + edx + 0xd46b]
mov dword [str._r_____r_____n], eax
mov ebx, dword [0x4518f0]
mov eax, 0x9a5307c5
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x33af
sub ecx, eax
add ecx, ebx
lea eax, [edx + ecx + 0xc49d]
lea ecx, [esp + 0xdc]
push ecx
push ebp
mov dword [esp + 0xe4], 0x128
xor edi, edi
mov dword [0x4518e0], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x415f00
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe74]
call fcn.00424991
add esp, 0xe78
ret
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518ec]
mov eax, 0xd45237bd
imul esi, esi, 0x5c10
imul ecx
mov ecx, dword [0x4518f0]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x27a02fad
imul ecx
mov eax, dword [str._r_____r_____n]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
sub ebx, esi
add ecx, edx
mov edx, dword [0x4518d4]
sub ebx, ecx
add ebx, eax
lea eax, [edx + ebx - 0x5a74]
mov dword [0x4518d4], eax
xor eax, eax
jmp 0x415f60
mov cl, byte [esp + eax + 0x100]
mov byte [esp + eax + 0x204], cl
inc eax
test cl, cl
jne 0x415f60
mov ecx, dword [0x4518e4]
mov eax, 0xa5820cf9
imul ecx
add edx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x5a75
mov esi, ecx
mov ecx, dword [0x4518e0]
sub esi, edx
mov eax, 0x7225d683
imul ecx
mov ecx, dword [esp + 0xe8c]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push ecx
lea edx, [esp + 0x208]
add esi, 0x1f366
push edx
mov dword [0x4518e4], esi
call fcn.0042f42e
mov ecx, dword [0x4518ec]
add esp, 8
test eax, eax
jne 0x416026
mov eax, dword [0x4518f4]
mov edx, dword [0x4518dc]
imul eax, eax, 0x62fe
mov esi, ecx
imul esi, esi, 0xd4a0
sub esi, eax
mov eax, 0x7225d683
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, dword [0x4518e0]
add eax, 0x131b4
mov dword [0x4518d8], eax
mov edi, 1
mov edx, dword [0x4518e8]
imul ecx, ecx, 0x5c10
mov eax, 0xd45237bd
imul edx
sar edx, 0xd
mov eax, edx
mov ebx, dword [str._r_____r_____n]
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x4518f0]
mov eax, 0x27a02fad
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518d4]
sub esi, ecx
lea ecx, [esp + 0xdc]
add esi, ebx
push ecx
lea eax, [edx + esi - 0x5a74]
push ebp
mov dword [0x4518d4], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x416194
mov eax, edi
shl eax, 6
lea edx, [esp + 0x100]
lea ebx, [esp + eax + 0x204]
sub eax, edx
lea esi, [esp + eax + 0x204]
lea esp, [esp]
lea eax, [esp + 0x100]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x4160b7
mov eax, dword [0x4518f4]
mov ecx, dword [0x4518ec]
imul eax, eax, 0x62fe
imul ecx, ecx, 0xd4a0
sub ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [0x4518dc]
mov eax, 0x7225d683
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add eax, edx
mov edx, dword [esp + 0xe8c]
add ecx, eax
sub ecx, dword [0x4518e0]
push edx
add ecx, 0x131b4
push ebx
mov dword [0x4518d8], ecx
call fcn.0042f42e
add esp, 8
test eax, eax
jne 0x41617e
mov eax, dword [0x4518dc]
mov ecx, dword [0x4518e0]
imul eax, eax, 0x5c10
imul ecx, ecx, 0x5a75
add eax, ecx
mov ecx, dword [0x4518d8]
mov edx, ecx
imul edx, edx, 0xbb8d
sub eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x27a02fad
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x4518e8], ecx
mov ecx, dword [esp + 0xe4]
mov dword [esp + edi*4 + 0x14], ecx
inc edi
add ebx, 0x40
add esi, 0x40
lea edx, [esp + 0xdc]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4160b0
mov ecx, dword [0x4518d8]
mov eax, 0x57bc6617
imul ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 0xd
imul ecx, ecx, 0x5d5f
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x588f
sub ecx, eax
lea eax, [ecx + edx - 0x5a74]
push ebp
mov dword [0x4518ec], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe84]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.00424991
add esp, 0xe78
ret