Function at 0x40f980
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c4
mov eax, dword [0x45e540]
xor eax, esp
push ebx
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x45cbd4]
mov edi, eax
mov ecx, dword [0x45cbcc]
mov eax, 0x315a5211
imul esi
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x315a5211
imul ecx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
mov ebp, eax
imul edx, edx, 0x3575d9d
mov eax, dword [0x45cbe8]
imul eax, eax, 0x5335ef4
sub ebp, ebx
add ebp, edx
add ebp, eax
mov eax, 0x680c7cd1
imul esi
sar edx, 0x19
mov esi, edx
add ebp, edx
mov edx, ecx
imul edx, edx, 0x4e899b9
shr esi, 0x1f
add esi, ebp
add esi, edx
mov eax, 0x83740ec5
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
lea ecx, [esp + 0xa8]
add eax, edx
push ecx
sub esi, eax
push edi
mov dword [esp + 0x28], edi
mov dword [esp + 0xb0], 0x128
mov dword [str._r_____r____], esi
mov dword [esp + 0x24], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40fa5b
or eax, 0xffffffff
jmp 0x40fef8
mov ecx, dword [0x45cbd4]
mov eax, 0x993c2c11
imul ecx
add edx, ecx
sar edx, 0x19
mov ebp, dword [0x45cbe0]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x5335ef4
mov esi, eax
sub esi, edx
mov eax, 0x680c7cd1
imul ecx
mov ecx, dword [0x45cbcc]
sar edx, 0x19
mov eax, ebp
imul eax, eax, 0x4e899b9
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, eax
mov eax, 0x74b32761
imul ecx
mov eax, dword [str._r_____r____]
sar edx, 0x18
add edi, edx
mov ecx, edx
mov edx, dword [0x45cbe4]
imul edx, edx, 0xfcfe96
shr ecx, 0x1f
add ecx, edi
add ecx, edx
sub ecx, eax
add ecx, 0x456b154
mov dword [0x45cbcc], ecx
xor esi, esi
jmp 0x40faf0
mov dl, byte [esp + esi + 0xcc]
mov byte [esp + esi + 0x1d0], dl
inc esi
test dl, dl
jne 0x40faf0
mov edx, dword [0x45cbd8]
mov esi, dword [0x45cbdc]
lea ebx, [edx + eax]
mov edi, eax
imul ebx, ebx, 0x3575d9d
mov eax, 0x680c7cd1
imul edi, edi, 0x4ebb783
imul esi
sar edx, 0x19
add ebx, edx
mov eax, edx
shr eax, 0x1f
mov edx, esi
imul edx, edx, 0x4e899b9
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x74b32761
imul esi
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0x9d8]
add ebx, edi
lea edx, [ebx + ebp - 0xfcfe96]
mov dword [esp + 0x14], eax
mov dword [0x45cbd4], edx
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x40fba3
test dl, dl
je 0x40fb9f
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x40fba3
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x40fb73
xor eax, eax
jmp 0x40fba8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fc1c
mov eax, dword [0x45cbd0]
imul ebp, ebp, 0x222559d
imul esi, esi, 0xfcfe96
lea ebx, [eax + ecx]
mov eax, 0x315a5211
imul ebx, ebx, 0x3e51956
imul dword [0x45cbe4]
sar edx, 0x18
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x993c2c11
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x680c7cd1
imul dword [0x45cbe4]
sub ebx, ecx
sar edx, 0x19
add ebx, ebp
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
mov dword [0x45cbdc], eax
mov dword [esp + 0x1c], 1
mov edx, dword [0x45cbd4]
mov ecx, dword [0x45cbc8]
add ecx, edx
mov eax, 0x315a5211
imul ecx, ecx, 0x23193db
imul dword [0x45cbe4]
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x3b012ec7
imul dword [str._r_____r____]
sar edx, 0x18
add ecx, edx
mov esi, edx
shr esi, 0x1f
add esi, ecx
mov ecx, dword [0x45cbd8]
mov eax, 0x680c7cd1
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x83740ec5
imul ecx
mov eax, dword [esp + 0x20]
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0xa8]
sub esi, ecx
push edx
add esi, edi
push eax
mov dword [0x45cbe4], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40fe6a
mov eax, dword [esp + 0x1c]
shl eax, 6
lea ecx, [esp + eax + 0x1d0]
lea edx, [esp + 0xcc]
sub eax, edx
lea esi, [esp + eax + 0x1d0]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], esi
jmp 0x40fce0
mov esi, dword [esp + 0x18]
lea ebx, [ebx]
mov ebx, dword [0x45cbe4]
mov edi, dword [0x45cbd0]
mov eax, 0x993c2c11
imul ebx
add edx, ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x3bfa58a9
imul edi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
sub ebp, ecx
mov ecx, dword [0x45cbe0]
imul ecx, ecx, 0x14e459e
mov eax, 0x342745e1
imul edi
sar edx, 0x18
add ebp, ecx
add ebp, edx
mov eax, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0xfcfe96
shr eax, 0x1f
add eax, ebp
add eax, edx
mov ebp, eax
mov eax, 0x206151bf
imul edi
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov dword [0x45cbc8], ecx
lea eax, [esp + 0xcc]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40fd67
mov ebp, dword [esp + 0x9d8]
mov esi, dword [esp + 0x14]
lea esp, [esp]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40fda5
test al, al
je 0x40fda1
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40fda5
add esi, 2
add ebp, 2
test al, al
jne 0x40fd80
xor eax, eax
jmp 0x40fdaa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fe50
mov edx, dword [0x45cbdc]
imul ecx, ecx, 0x3575d9d
mov esi, dword [0x45cbd8]
mov eax, 0x315a5211
imul edx
sar edx, 0x18
mov ebp, esi
imul ebp, ebp, 0x52fe876
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
add ebp, ecx
mov ecx, dword [0x45cbe8]
imul ecx, ecx, 0x5335ef4
mov eax, 0x3b012ec7
imul edi
sar edx, 0x18
add ebp, ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x206151bf
imul esi
mov eax, dword [esp + 0x1c]
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
mov edx, dword [esp + 0xb0]
add ecx, ebp
sub ecx, ebx
sub ecx, 0xfcfe96
mov dword [esp + eax*4 + 0x28], edx
mov edx, dword [esp + 0x14]
inc eax
mov dword [0x45cbd0], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xa8]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40fcd6
mov ecx, dword [0x45cbe8]
mov eax, 0xc4e5d61
imul ecx
sar edx, 0x16
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0x4ebb783
add edi, edx
mov edx, dword [0x45cbd4]
mov eax, 0x680c7cd1
imul edx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov esi, dword [0x45cbe0]
mov eax, 0x342745e1
imul ecx
imul ecx, ecx, 0xfcfe96
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x74b32761
imul esi
imul esi, esi, 0x23193db
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x20]
push ecx
mov dword [0x45cbd8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x9d0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043016d
add esp, 0x9c4
ret