Function at 0x40bcb0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9b8
mov eax, dword [0x456fc0]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x455690]
mov esi, eax
mov eax, 0x709ad4e5
imul ecx
mov ecx, dword [0x45569c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xc2c05bdf
imul ecx
mov eax, dword [0x4556a8]
sar edx, 7
imul eax, eax, 0x12b
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x217
mov ebx, ecx
mov ecx, dword [0x455694]
sub ebx, edi
add ebx, edx
add ebx, eax
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
add ebx, edx
lea edx, [esp + 0x98]
shr ecx, 0x1f
push edx
add ecx, ebx
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xa0], 0x128
mov dword [str._r_____r____], ecx
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40bd82
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b4]
call fcn.004291fd
add esp, 0x9b8
ret
mov esi, dword [0x4556a0]
mov eax, dword [0x4556a8]
imul esi, esi, 0x217
mov ecx, dword [0x45568c]
imul eax, eax, 0x12b
sub esi, eax
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [0x455690]
sar edx, 8
add esi, edx
mov edi, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
mov ecx, dword [0x455694]
shr edi, 0x1f
add edi, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add edi, edx
add esi, edi
sub esi, ecx
add esi, 0x1d3
mov dword [0x45568c], esi
xor eax, eax
jmp 0x40bdf0
mov cl, byte [esp + eax + 0xbc]
mov byte [esp + eax + 0x1c0], cl
inc eax
test cl, cl
jne 0x40bdf0
mov edi, dword [0x455698]
imul edi, edi, 0x1ed
mov ecx, esi
imul ecx, ecx, 0x217
add edi, ecx
mov ecx, dword [0x45569c]
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x92
sub edi, eax
add edi, dword [0x4556a4]
lea ebx, [edx + edi - 0xb8]
push ebp
mov ebp, dword [esp + 0x9cc]
mov dword [0x455694], ebx
lea edi, [esp + 0x1c4]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40be87
test al, al
je 0x40be83
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40be87
add edi, 2
add ebp, 2
test al, al
jne 0x40be62
xor eax, eax
jmp 0x40be8c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40bee0
mov eax, 0x709ad4e5
imul ebx
imul ebx, ebx, 0xb8
mov eax, esi
imul eax, eax, 0x23c
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, eax
mov eax, dword [0x455690]
imul eax, eax, 0x217
add ecx, eax
mov eax, 0x42776e9b
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, ebx
mov dword [0x45569c], ecx
mov ebx, 1
jmp 0x40bee4
mov ebx, dword [esp + 0x10]
mov eax, 0x709ad4e5
imul dword [0x4556a4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xc2c05bdf
imul ecx
imul ecx, ecx, 0x92
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
imul edx, edx, 0x14f
mov ebp, eax
sub ebp, edi
add ebp, edx
mov eax, 0xe070381d
imul esi
add edx, esi
sar edx, 7
mov eax, edx
add ebp, ecx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x9c]
push ecx
sub ebp, eax
push edx
mov dword [0x4556a4], ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40c0c5
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1c4]
lea edx, [esp + 0xc0]
sub eax, edx
lea esi, [esp + eax + 0x1c4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
jmp 0x40bf85
mov esi, dword [esp + 0x10]
mov ecx, dword [0x4556a0]
mov eax, 0x3949660b
imul ecx, ecx, 0x217
imul dword [0x45569c]
sar edx, 7
mov ebp, dword [0x455690]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, ecx
mov ecx, dword [0x4556a4]
mov eax, 0x42776e9b
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, ebp
imul edx, edx, 0xb8
sub edi, ecx
mov ecx, dword [str._r_____r____]
sub edi, edx
add edi, ecx
mov ecx, dword [0x455688]
add ecx, edi
mov dword [0x455688], ecx
lea eax, [esp + 0xc0]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40bff0
mov edi, dword [esp + 0x9cc]
mov esi, dword [esp + 0x18]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40c029
test al, al
je 0x40c025
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40c029
add esi, 2
add edi, 2
test al, al
jne 0x40c005
xor eax, eax
jmp 0x40c02e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c0ab
mov esi, dword [0x4556a8]
imul ecx, ecx, 0x1ed
mov eax, 0x709ad4e5
imul esi, esi, 0x246
imul dword [0x45569c]
sar edx, 8
mov eax, edx
add esi, ecx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x8c55841d
imul ebp
add edx, ebp
mov ebp, dword [0x4556a0]
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0xa4]
sub esi, ecx
mov ecx, dword [esp + 0x10]
sub esi, ebp
mov dword [esp + ebx*4 + 0x1c], edx
mov edx, dword [esp + 0x18]
sub esi, 0xb8
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [0x455690], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x9c]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40bf81
mov ecx, dword [0x4556a8]
mov esi, dword [0x4556a0]
mov eax, 0x3d3fa421
imul esi, esi, 0x14f
imul ecx
imul ecx, ecx, 0xb8
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
sub esi, eax
mov eax, 0x6d978b8f
imul edx
sar edx, 7
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
sub edi, ecx
mov ecx, dword [0x455694]
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x14]
sub edi, ecx
push edx
mov dword [0x455698], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c4]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.004291fd
add esp, 0x9b8
ret