Function at 0x415e80
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe78
mov eax, dword [0x452944]
mov ecx, dword [0x4518e8]
mov dword [esp + 0xe74], eax
mov eax, 0x8b081419
imul ecx
add edx, ecx
mov ecx, dword [0x4518dc]
sar edx, 0xc
mov eax, edx
push ebx
shr eax, 0x1f
add eax, edx
push ebp
push esi
mov esi, eax
mov eax, 0xa5b2ed37
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518ec]
sub ecx, esi
push edi
sub ecx, edx
mov edx, dword [0x4518f4]
push 0
lea eax, [ecx + edx - 0x866]
push 2
mov dword [0x4518dc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x4518e8]
mov ebp, eax
mov eax, 0x6614bc37
imul esi
sar edx, 0xa
mov eax, dword [0x4518dc]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x926
sub edx, ecx
mov ecx, dword [0x4518d8]
sub edx, ecx
imul ecx, ecx, 0x1538
lea edx, [edx + eax + 0x1503]
mov ebx, dword [0x4518f0]
mov dword [str._r_____r_____n], edx
mov eax, 0x61dea4df
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x4cf
sub ecx, eax
add ecx, ebx
lea eax, [edx + ecx + 0x14d5]
lea ecx, [esp + 0xdc]
push ecx
push ebp
mov dword [esp + 0xe4], 0x128
xor edi, edi
mov dword [0x4518e0], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x415fa0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe74]
call fcn.004249c1
add esp, 0xe78
ret
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518ec]
mov eax, 0x4152dddf
imul esi, esi, 0xfffff5f8
imul ecx
mov ecx, dword [0x4518f0]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x6a79dd7b
imul ecx
mov eax, dword [str._r_____r_____n]
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518d4]
sub esi, ecx
add esi, eax
lea eax, [edx + esi - 0x86c]
mov dword [0x4518d4], eax
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x100]
mov byte [esp + eax + 0x204], cl
inc eax
test cl, cl
jne 0x416000
mov ecx, dword [0x4518e0]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x4518e4]
mov eax, 0x1bfba0af
imul ecx
mov ecx, dword [0x4518f4]
sar edx, 8
imul ecx, ecx, 0x86d
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xe8c]
sub eax, esi
sub eax, ecx
add eax, 0x322e
mov dword [0x4518e4], eax
push edx
lea eax, [esp + 0x208]
push eax
call fcn.0042f45e
mov ecx, dword [0x4518ec]
add esp, 8
test eax, eax
jne 0x4160c9
mov esi, dword [0x4518dc]
mov eax, 0x8c03f71d
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, dword [0x4518e0]
mov edx, ecx
imul edx, edx, 0x1538
add eax, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x926
sub eax, edx
sub eax, esi
add eax, 0x2044
mov dword [0x4518d8], eax
mov edi, 1
mov edx, dword [0x4518e8]
imul ecx, ecx, 0xfffff5f8
mov eax, 0x4152dddf
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f0]
mov ebx, dword [str._r_____r_____n]
sub ecx, eax
mov eax, 0x6a79dd7b
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d4]
sub ecx, eax
add ecx, ebx
lea eax, [edx + ecx - 0x86c]
lea ecx, [esp + 0xdc]
push ecx
push ebp
mov dword [0x4518d4], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x41622f
mov eax, edi
shl eax, 6
lea edx, [esp + 0x100]
lea ebx, [esp + eax + 0x204]
sub eax, edx
lea esi, [esp + eax + 0x204]
lea ecx, [ecx]
lea eax, [esp + 0x100]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x416157
mov ecx, dword [0x4518dc]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
mov ecx, dword [0x4518ec]
sar edx, 0xc
imul ecx, ecx, 0x1538
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x926
add eax, ecx
mov ecx, dword [0x4518e0]
sub eax, edx
sub eax, ecx
add eax, 0x2044
mov dword [0x4518d8], eax
mov eax, dword [esp + 0xe8c]
push eax
push ebx
call fcn.0042f45e
add esp, 8
test eax, eax
jne 0x416219
mov ecx, dword [0x4518d8]
mov eax, dword [0x4518dc]
imul eax, eax, 0xa08
mov edx, ecx
imul edx, edx, 0xfad
sub eax, edx
mov edx, dword [0x4518e0]
imul edx, edx, 0x86d
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x6a79dd7b
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x4518e8], ecx
mov ecx, dword [esp + 0xe4]
mov dword [esp + edi*4 + 0x14], ecx
inc edi
add ebx, 0x40
add esi, 0x40
lea edx, [esp + 0xdc]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x416150
mov ecx, dword [0x4518d8]
mov eax, 0x5a4d12c9
imul ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 0xa
imul ecx, ecx, 0xb57
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x687
sub ecx, eax
lea eax, [ecx + edx - 0x86c]
push ebp
mov dword [0x4518ec], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe84]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.004249c1
add esp, 0xe78
ret