Function at 0x40f880
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x45f540]
xor eax, esp
push ebx
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45dbcc]
mov edi, eax
mov esi, dword [0x45dbd4]
mov eax, 0x61b9fbc5
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x830d168d
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
mov ebp, eax
imul edx, edx, 0x3409f8e
mov eax, ecx
imul eax, eax, 0x35f16dd
sub ebp, ebx
add ebp, edx
add ebp, eax
mov eax, 0x56f92285
imul esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x56f92285
imul ecx
sar edx, 0x19
mov ecx, edx
add ebp, edx
mov edx, dword [0x45dbdc]
imul edx, edx, 0x3e67c56
shr ecx, 0x1f
lea eax, [esp + 0xa4]
add ecx, ebp
push eax
add ecx, edx
push edi
mov dword [esp + 0x28], edi
mov dword [esp + 0xac], 0x128
mov dword [str._r_____r____], ecx
mov dword [esp + 0x24], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40f95c
or eax, 0xffffffff
jmp 0x40fe05
mov ecx, dword [0x45dbd4]
mov esi, dword [0x45dbe4]
imul esi, esi, 0x2927ae2
mov eax, 0x830d168d
imul ecx
add edx, ecx
mov ebp, dword [0x45dbe0]
sar edx, 0x19
add esi, edx
mov edi, edx
mov edx, dword [0x45dbcc]
mov eax, 0x3f96a7f5
imul edx
sar edx, 0x18
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x3409f8e
mov eax, ebp
imul eax, eax, 0x35f16dd
shr esi, 0x1f
add esi, edi
sub esi, edx
add esi, eax
mov eax, 0x8345522b
imul ecx
mov eax, dword [str._r_____r____]
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, eax
add ecx, 0x293659b
mov dword [0x45dbcc], ecx
xor esi, esi
jmp 0x40f9f0
mov dl, byte [esp + esi + 0xc8]
mov byte [esp + esi + 0x1cc], dl
inc esi
test dl, dl
jne 0x40f9f0
mov edx, dword [0x45dbd8]
mov esi, dword [0x45dbdc]
lea ebx, [edx + eax]
mov edi, eax
imul ebx, ebx, 0x3e67c56
mov eax, 0x830d168d
imul edi, edi, 0x3e828c7
imul esi
add edx, esi
sar edx, 0x19
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x3f96a7f5
imul esi
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x35f16dd
sub ebx, eax
add ebx, edi
add edx, ebx
lea eax, [edx + ebp - 0x2927ae2]
mov edx, dword [esp + 0x9d4]
mov dword [0x45dbd4], eax
mov dword [esp + 0x14], edx
lea eax, [esp + 0x1cc]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x40faa4
test dl, dl
je 0x40faa0
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x40faa4
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x40fa74
xor eax, eax
jmp 0x40faa9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fb26
mov eax, dword [0x45dbd0]
imul esi, esi, 0x2927ae2
imul ebp, ebp, 0x539869b
lea ebx, [eax + ecx]
imul ebx, ebx, 0x53d3666
add ebx, esi
mov esi, dword [0x45dbe4]
mov eax, 0x830d168d
imul esi
add edx, esi
sar edx, 0x19
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, 0x56f92285
imul esi
mov eax, dword [esp + 0x18]
sar edx, 0x19
mov ebx, edx
add eax, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x8345522b
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ebx, ebp
add ecx, edx
sub ebx, ecx
mov dword [0x45dbdc], ebx
mov dword [esp + 0x1c], 1
jmp 0x40fb2c
mov esi, dword [0x45dbe4]
mov edx, dword [0x45dbc8]
mov eax, dword [0x45dbd4]
lea ecx, [edx + eax]
imul ecx, ecx, 0x406a069
mov eax, 0x31b1a317
imul dword [str._r_____r____]
sar edx, 0x17
add ecx, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x45dbd8]
mov eax, 0x61b9fbc5
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x830d168d
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x56f92285
imul esi
sar edx, 0x19
mov eax, edx
sub ebx, ecx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0xa4]
sub ebx, eax
push ecx
add ebx, edi
push edx
mov dword [0x45dbe4], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40fd70
mov eax, dword [esp + 0x1c]
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea esi, [esp + eax + 0x1cc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], esi
jmp 0x40fbf0
mov esi, dword [esp + 0x18]
jmp 0x40fbf0
mov edi, dword [0x45dbd0]
mov ecx, dword [0x45dbc8]
imul ecx, ecx, 0x2927ae2
mov eax, 0x6386b3b9
imul edi
sar edx, 0x18
add ecx, edx
mov ebx, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x1fc96d8
shr ebx, 0x1f
add ebx, ecx
sub ebx, edx
mov eax, 0x4bee9027
imul edi
sar edx, 0x18
add ebx, edx
mov ebp, edx
mov eax, 0x187fbc47
imul edi
sar edx, 0x17
shr ebp, 0x1f
add ebp, ebx
mov ebx, dword [0x45dbe4]
add ebp, edx
mov ecx, edx
mov eax, 0x8345522b
imul ebx
add edx, ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
shr ecx, 0x1f
add eax, edx
add ecx, ebp
sub ecx, eax
mov dword [0x45dbc8], ecx
lea eax, [esp + 0xc8]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40fc71
mov ebp, dword [esp + 0x9d4]
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40fcab
test al, al
je 0x40fca7
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40fcab
add esi, 2
add ebp, 2
test al, al
jne 0x40fc86
xor eax, eax
jmp 0x40fcb0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fd56
mov esi, dword [0x45dbd8]
imul ecx, ecx, 0x3e67c56
mov eax, 0x6386b3b9
imul esi
imul esi, esi, 0x5e30a0c
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x31b1a317
imul edi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x3409f8e
sub ebp, eax
add ebp, edx
mov edx, dword [0x45dbdc]
mov eax, 0x56f92285
imul edx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
add ebp, esi
sub ebp, eax
mov eax, dword [esp + 0x1c]
add ebp, ecx
mov ecx, dword [esp + 0xac]
sub ebp, ebx
mov dword [esp + eax*4 + 0x24], ecx
mov ecx, dword [esp + 0x18]
sub ebp, 0x2927ae2
inc eax
mov dword [esp + 0x1c], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [0x45dbd0], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
lea edx, [esp + 0xa4]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40fbe2
mov ecx, dword [0x45dbe8]
mov edi, dword [0x45dbc8]
mov esi, dword [0x45dbd4]
imul edi, edi, 0x3e828c7
mov edx, ecx
imul edx, edx, 0x2927ae2
sub edi, edx
mov eax, 0x830d168d
imul esi
add edx, esi
mov esi, dword [0x45dbe0]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3f96a7f5
imul esi
imul esi, esi, 0x406a069
sar edx, 0x18
mov ebx, edx
add edi, edx
mov eax, 0x9d6ba841
imul ecx
add edx, ecx
shr ebx, 0x1f
sar edx, 0x19
add ebx, edi
add ebx, esi
mov esi, edx
add ebx, edx
mov eax, 0x4bee9027
imul ecx
sar edx, 0x18
mov ecx, edx
shr esi, 0x1f
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x20]
add esi, ebx
sub esi, ecx
push edx
mov dword [0x45dbd8], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x9cc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004301cd
add esp, 0x9c0
ret