Function at 0x40f650
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x45e540]
xor eax, esp
push ebx
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45cbcc]
mov ebx, dword [0x45cbdc]
mov edx, dword [0x45cbe8]
imul ebx, ebx, 0x63e546
mov esi, dword [0x45cbd4]
imul edx, edx, 0x53439e
mov edi, eax
mov eax, ecx
imul eax, eax, 0x5643ad
add ebx, eax
add ebx, edx
mov eax, 0x1b2eb4bf
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1b2eb4bf
imul ecx
sar edx, 0x14
mov ebp, edx
add ebx, edx
mov eax, 0x7a2fd6e1
imul ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xa3c4e0d7
imul esi
shr ebp, 0x1f
add edx, esi
sar edx, 0x16
add ebp, ebx
sub ebp, ecx
mov eax, edx
lea ecx, [esp + 0xa4]
shr eax, 0x1f
add ebp, edx
push ecx
add eax, ebp
push edi
mov dword [esp + 0x24], edi
mov dword [esp + 0xac], 0x128
mov dword [str._r_____r____], eax
mov dword [esp + 0x28], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40f727
or eax, 0xffffffff
jmp 0x40fbab
mov ecx, dword [0x45cbd4]
mov ebp, dword [0x45cbe0]
mov eax, 0x2900b7f9
imul ecx
sar edx, 0x14
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45cbe4]
imul edx, edx, 0x41d422
add esi, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x53439e
mov eax, ebp
imul eax, eax, 0x5643ad
add esi, eax
sub esi, edx
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
mov ecx, dword [0x45cbcc]
sar edx, 0x16
add esi, edx
mov edi, edx
mov eax, 0x4f7fd81
imul ecx
mov eax, dword [str._r_____r____]
shr edi, 0x1f
sar edx, 0x11
add edi, esi
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
sub ecx, eax
add ecx, 0x41fb8b
mov dword [0x45cbcc], ecx
xor esi, esi
lea ecx, [ecx]
mov dl, byte [esp + esi + 0xc8]
mov byte [esp + esi + 0x1cc], dl
inc esi
test dl, dl
jne 0x40f7b0
mov esi, dword [0x45cbdc]
mov edx, dword [0x45cbd8]
lea ebx, [edx + eax]
mov edi, eax
imul ebx, ebx, 0x63e546
mov eax, esi
imul edi, edi, 0x640b17
imul eax, eax, 0x5643ad
add ebx, eax
mov eax, 0xa3c4e0d7
imul esi
add edx, esi
sar edx, 0x16
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x4f7fd81
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0x9d4]
add ebx, edi
lea edx, [ebx + ebp - 0x41d422]
mov dword [esp + 0x14], eax
mov dword [0x45cbd4], edx
lea eax, [esp + 0x1cc]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x40f865
test dl, dl
je 0x40f861
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x40f865
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x40f835
xor eax, eax
jmp 0x40f86a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f8d9
mov eax, dword [0x45cbd0]
imul esi, esi, 0x41d422
imul ebp, ebp, 0x85c28b
lea ebx, [eax + ecx]
mov eax, 0x2900b7f9
imul ebx, ebx, 0x8616f6
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45cbe4]
mov eax, 0x1b2eb4bf
imul ecx
add ebx, esi
sar edx, 0x14
add ebx, ebp
add ebx, edx
mov esi, edx
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
shr esi, 0x1f
sar edx, 0x16
add esi, ebx
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x45cbdc], eax
mov ebx, 1
jmp 0x40f8e3
mov ecx, dword [0x45cbe4]
mov ebx, dword [esp + 0x20]
mov edx, dword [0x45cbc8]
mov eax, dword [0x45cbd4]
lea esi, [edx + eax]
mov eax, 0x3e13b50f
imul esi, esi, 0x670b79
imul dword [str._r_____r____]
sar edx, 0x14
mov ebp, edx
add esi, edx
mov eax, 0x1b2eb4bf
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shr ebp, 0x1f
add ebp, esi
sub ebp, ecx
mov ecx, dword [0x45cbd8]
mov eax, 0x7a2fd6e1
imul ecx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0xa3c4e0d7
imul ecx
mov eax, dword [esp + 0x1c]
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0xa4]
sub ebp, ecx
push edx
add ebp, edi
push eax
mov dword [0x45cbe4], ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40fb19
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea edi, [esp + eax + 0x1cc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
jmp 0x40f9a0
mov edi, dword [esp + 0x18]
jmp 0x40f9a0
mov ecx, dword [0x45cbc8]
mov esi, dword [0x45cbd0]
imul ecx, ecx, 0x41d422
mov eax, 0x2900b7f9
imul dword [0x45cbe4]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x3e38df13
imul esi
sar edx, 0x14
add ecx, edx
mov ebp, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x32d358
shr ebp, 0x1f
add ebp, ecx
sub ebp, edx
mov eax, 0x5ef6c237
imul esi
sar edx, 0x15
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x3d3e7a09
imul esi
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov dword [0x45cbc8], ecx
lea eax, [esp + 0xc8]
nop
mov dl, byte [eax]
mov byte [edi + eax], dl
inc eax
test dl, dl
jne 0x40fa20
mov ebp, dword [esp + 0x9d4]
mov edi, dword [esp + 0x14]
mov dl, byte [edi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40fa5a
test al, al
je 0x40fa56
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40fa5a
add edi, 2
add ebp, 2
test al, al
jne 0x40fa35
xor eax, eax
jmp 0x40fa5f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40faff
mov eax, 0x3e13b50f
imul ecx, ecx, 0x63e546
imul esi
mov esi, dword [0x45cbd8]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x3e38df13
imul esi
imul esi, esi, 0x96af7c
sar edx, 0x14
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x45cbe8]
imul ecx, ecx, 0x53439e
add edi, ecx
mov ecx, dword [0x45cbdc]
mov eax, 0x1b2eb4bf
imul ecx
mov ecx, dword [esp + 0xac]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
add edi, esi
sub edi, eax
sub edi, dword [0x45cbe4]
mov dword [esp + ebx*4 + 0x24], ecx
mov ecx, dword [esp + 0x18]
sub edi, 0x41d422
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [0x45cbd0], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0xa4]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40f997
mov ecx, dword [0x45cbe8]
mov eax, 0xa1093dc9
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov esi, ecx
imul esi, esi, 0x41d422
mov eax, 0x6262bd7d
imul ecx
mov ecx, dword [0x45cbc8]
imul ecx, ecx, 0x640b17
sar edx, 0x15
sub edi, esi
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
add esi, ecx
mov ecx, dword [0x45cbd4]
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
mov ecx, dword [0x45cbe0]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4f7fd81
imul ecx
imul ecx, ecx, 0x670b79
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
add eax, ecx
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [0x45cbd8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [esp + 0x9cc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042fd0d
add esp, 0x9c0
ret