Function at 0x40bc20
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9b8
mov eax, dword [0x457190]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9c8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45581c]
mov esi, eax
mov eax, 0x51eb851f
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4bda12f7
imul ecx
mov eax, dword [0x455830]
sar edx, 4
imul eax, eax, 0x35
mov ecx, edx
sub ebx, edi
add ebx, edx
mov edx, dword [0x455838]
imul edx, edx, 0xd
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
add ecx, eax
mov dword [str._r_____r____], ecx
lea ecx, [esp + 0x98]
push ecx
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xa0], 0x128
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40bce6
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9b4]
call fcn.00428e41
add esp, 0x9b8
ret
mov esi, dword [0x455838]
mov ecx, dword [0x45581c]
mov eax, 0x4bda12f7
imul esi
imul esi, esi, 0xd
mov ebx, dword [0x455830]
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
add edi, edx
mov ecx, edx
mov edx, ebx
imul edx, edx, 0x35
shr ecx, 0x1f
add ecx, edi
sub ecx, esi
mov esi, dword [str._r_____r____]
add ecx, edx
sub ecx, esi
add ecx, 0x28
mov dword [0x45581c], ecx
xor eax, eax
jmp 0x40bd40
mov dl, byte [esp + eax + 0xbc]
mov byte [esp + eax + 0x1c0], dl
inc eax
test dl, dl
jne 0x40bd40
push ebp
imul esi, esi, 0x36
mov ebp, dword [0x455828]
lea eax, [ebp + ebp*8]
shl eax, 3
mov edi, eax
mov eax, 0x4bda12f7
imul dword [0x45582c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455818]
imul edx, edx, 0x35
sub edi, eax
add edx, ebx
add edx, edi
mov edi, dword [esp + 0x9cc]
lea eax, [esi + edx - 0x31]
mov dword [0x455824], eax
lea esi, [esp + 0x1c4]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40bdc5
test al, al
je 0x40bdc1
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40bdc5
add esi, 2
add edi, 2
test al, al
jne 0x40bda1
xor eax, eax
jmp 0x40bdca
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40be1b
mov esi, dword [0x455820]
imul ebx, ebx, 0x22
mov eax, 0x92492493
imul esi
mov eax, dword [0x45582c]
add edx, esi
imul eax, eax, 0x31
imul esi, esi, 0x32
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
add edi, esi
add edi, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ebx
mov dword [0x45582c], edi
mov ebx, 1
jmp 0x40be1f
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x455818]
lea esi, [ecx + ebp]
mov ecx, dword [0x455834]
imul esi, esi, 0x36
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4bda12f7
imul ebp
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x51eb851f
imul ebp
sar edx, 4
mov eax, edx
sub esi, ecx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x9c]
push ecx
sub esi, eax
push edx
mov dword [0x455834], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40bff9
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1c4]
lea edx, [esp + 0xc0]
sub eax, edx
lea esi, [esp + eax + 0x1c4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
jmp 0x40bec0
mov esi, dword [esp + 0x10]
jmp 0x40bec0
mov ebp, dword [0x455834]
mov eax, 0x38e38e39
imul ebp
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x5397829d
imul ebp
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x78787879
imul dword [0x455820]
mov eax, dword [0x455830]
sub edi, ecx
imul eax, eax, 0x32
sar edx, 4
add edi, edx
mov ecx, edx
mov edx, dword [0x455818]
imul edx, edx, 0x31
shr ecx, 0x1f
add ecx, edi
add ecx, edx
sub ecx, eax
mov dword [0x455818], ecx
lea eax, [esp + 0xc0]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40bf27
mov edi, dword [esp + 0x9cc]
mov esi, dword [esp + 0x18]
lea esp, [esp]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x40bf64
test al, al
je 0x40bf60
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x40bf64
add esi, 2
add edi, 2
test al, al
jne 0x40bf40
xor eax, eax
jmp 0x40bf69
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40bfdf
mov esi, dword [0x45582c]
mov eax, 0x66666667
imul dword [0x455820]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x6db6db6d
imul esi
sub edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
lea ecx, [ecx + ecx*8]
lea edx, [eax + ecx*8]
mov eax, dword [str._r_____r____]
mov ecx, dword [esp + 0xa4]
imul eax, eax, 0x38
add edx, eax
sub edx, ebp
sub edx, 0x31
mov dword [0x455820], edx
mov edx, dword [esp + 0x18]
mov dword [esp + ebx*4 + 0x1c], ecx
mov ecx, dword [esp + 0x10]
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x9c]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40beb2
mov ecx, dword [0x455838]
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45581c]
mov esi, ecx
imul edx, edx, 0x36
imul esi, esi, 0xffffffcf
sub esi, eax
add esi, edx
mov edx, dword [0x455824]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov ecx, edx
add esi, edx
mov edx, dword [esp + 0x14]
shr ecx, 0x1f
add ecx, esi
push edx
mov dword [0x455828], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c4]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.00428e41
add esp, 0x9b8
ret