Function at 0x40aeb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x456fc0]
mov ecx, dword [0x45569c]
mov dword [esp + 0x938], eax
mov eax, 0x59da2e6b
imul ecx
mov ecx, dword [0x455690]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
push esi
mov esi, eax
mov eax, 0x9cbd99d5
imul ecx
mov eax, dword [0x4556a8]
sar edx, 0xb
imul eax, eax, 0xaef
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45568c]
push edi
imul edx, edx, 0x140f
mov edi, ecx
mov ecx, dword [0x455694]
sub edi, esi
add edi, edx
add edi, eax
mov eax, 0x4700d503
imul ecx
sar edx, 9
add edi, edx
mov ecx, edx
mov edx, dword [ebp + 8]
shr ecx, 0x1f
add ecx, edi
mov dword [str._r_____r____], ecx
xor eax, eax
mov byte [esp + 0x140], 0
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x144]
push 0x445f7c
push eax
call fcn.0042977a
mov edi, dword [0x4556a0]
mov eax, 0x5e17e411
imul dword [0x45569c]
sar edx, 0xb
mov ecx, edi
imul ecx, ecx, 0x16cb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x4556a4]
mov eax, 0x6d62dd3b
imul ecx
mov esi, dword [0x455688]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455690]
imul edx, edx, 0x5cc
sub ebx, ecx
mov ecx, dword [0x45568c]
sub ebx, edx
add ebx, dword [str._r_____r____]
add esi, ebx
mov ebx, edi
add esp, 0xc
imul ebx, ebx, 0x140f
mov dword [0x455688], esi
mov eax, 0x903bb8bb
imul esi, esi, 0x12b9
imul ecx
add edx, ecx
mov ecx, dword [0x4556a8]
sar edx, 0xb
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov edx, ecx
imul ecx, ecx, 0x14a2
imul edx, edx, 0xaef
sub eax, edx
mov ebx, eax
mov eax, 0x4700d503
imul dword [0x455690]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, dword [0x455694]
add eax, 0x11d7
mov dword [0x45568c], eax
mov eax, 0x6342662b
imul dword [0x45569c]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x1cb32649
imul dword [0x455690]
sar edx, 9
mov eax, edx
add ecx, esi
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, edi
push 0
sub ecx, 0x5cc
push 2
mov dword [esp + 0x18], 0
mov dword [0x455690], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
jne 0x40b109
mov esi, dword [0x45568c]
mov ecx, dword [0x455698]
imul esi, esi, 0x140f
imul ecx, ecx, 0x12b9
add esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0x903bb8bb
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xb
imul ecx, ecx, 0x736
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub esi, eax
add esi, edx
lea edx, [ecx + esi - 0x5cc]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x455694], edx
call fcn.00429d56
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042904d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4556a8]
mov esi, dword [0x4556a0]
mov eax, 0xcc33a611
imul esi, esi, 0xe33
imul ecx
add edx, ecx
imul ecx, ecx, 0x5cc
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
sub esi, eax
mov eax, 0x5da803a9
imul edx
sar edx, 0xa
mov edi, edx
add esi, edx
mov edx, dword [0x455694]
mov eax, 0x4700d503
imul edx
sar edx, 9
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, esi
add eax, edx
sub edi, eax
sub edi, ecx
lea ecx, [esp + 0x18]
push ecx
push ebx
mov dword [0x455698], edi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40b200
mov esi, dword [0x45568c]
mov edi, dword [0x455690]
mov ecx, dword [0x455694]
imul edi, edi, 0x16cb
mov edx, esi
imul edx, edx, 0x15c4
add edi, edx
mov eax, 0x6342662b
imul ecx
imul ecx, ecx, 0x5cc
sar edx, 0xb
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x6d62dd3b
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push ebx
mov dword [0x45569c], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x944]
call fcn.0042904d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45568c]
mov eax, 0x1cb32649
imul ecx
mov eax, dword [0x455698]
sar edx, 9
imul eax, eax, 0x509
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x11d7
sub edx, ecx
add edx, eax
lea ecx, [esp + 0x140]
mov dword [0x4556a0], edx
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00433ade
add esp, 8
test eax, eax
je 0x40b5ec
mov ecx, dword [str._r_____r____]
mov esi, dword [0x455690]
mov eax, 0x5e17e411
imul esi, esi, 0x140f
imul ecx
mov ecx, dword [0x455698]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x903bb8bb
imul ecx
mov eax, dword [esp + 0x20]
add edx, ecx
sar edx, 0xb
mov ecx, edx
add esi, edx
mov edx, dword [0x4556a0]
imul edx, edx, 0xd02
shr ecx, 0x1f
push eax
add ecx, esi
push 0
sub ecx, edx
push 0x1f0fff
mov dword [0x4556a8], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov esi, dword [0x455690]
mov eax, 0x59da2e6b
imul dword [0x45569c]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x9cbd99d5
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a8]
sub eax, ecx
imul edx, edx, 0xaef
mov ecx, dword [0x45568c]
imul ecx, ecx, 0x140f
add eax, ecx
mov ecx, dword [0x455694]
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x4700d503
imul ecx
mov eax, dword [esp + 0xc]
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
test edi, edi
mov dword [str._r_____r____], ecx
jne 0x40b341
push 0x445f48
call fcn.00429d56
add esp, 4
jmp 0x40b3ba
mov ebx, dword [0x4556a0]
imul esi, esi, 0x5cc
mov eax, 0x5e17e411
imul ebx, ebx, 0x16cb
imul dword [0x45569c]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub eax, ebx
mov ebx, eax
mov eax, 0x6d62dd3b
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, esi
mov esi, dword [0x455688]
add ebx, ecx
add esi, ebx
push edi
mov dword [0x455688], esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40b3af
push 0x445f34
call fcn.00429d56
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
mov ecx, dword [0x45568c]
mov esi, dword [0x4556a0]
mov eax, 0x903bb8bb
imul esi, esi, 0x140f
imul ecx
add edx, ecx
mov ecx, dword [0x4556a8]
imul ecx, ecx, 0xaef
sar edx, 0xb
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
sub edi, ecx
mov ecx, dword [0x455690]
mov eax, 0x4700d503
imul ecx
mov ecx, dword [0x455694]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
lea ecx, [esp + 0x18]
push ecx
add eax, 0x11d7
push ebx
mov dword [0x45568c], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40b200
mov esi, dword [0x45569c]
mov ecx, dword [0x455688]
mov edi, dword [esp + 0x10]
mov eax, dword [0x4556a8]
imul ecx, ecx, 0x12b9
imul eax, eax, 0x14a2
mov dword [esp + 0x10], eax
mov eax, 0x6342662b
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
mov esi, dword [0x4556a0]
sub edx, eax
add edx, ecx
mov ecx, dword [0x455690]
mov dword [esp + 0x10], edx
mov eax, 0x1cb32649
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
sub eax, esi
sub eax, 0x5cc
push ebx
mov dword [0x455690], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40b0f4
mov esi, dword [0x45568c]
mov edx, dword [0x455698]
imul esi, esi, 0x140f
mov ecx, dword [0x45569c]
imul edx, edx, 0x12b9
mov edi, dword [0x4556a4]
add esi, edx
mov eax, 0x903bb8bb
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xb
imul ecx, ecx, 0x736
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [esp + 0x20]
push eax
add esi, edi
push 0
lea edx, [ecx + esi - 0x5cc]
push 0x1f0fff
mov dword [0x455694], edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x455694]
mov edi, eax
mov eax, 0x4700d503
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45569c]
mov eax, 0x59da2e6b
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455690]
mov esi, eax
mov eax, 0x9cbd99d5
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45568c]
sub eax, esi
imul edx, edx, 0x140f
mov esi, dword [0x4556a8]
mov ebx, esi
imul ebx, ebx, 0xaef
add edx, ecx
add edx, eax
add ebx, edx
test edi, edi
mov dword [str._r_____r____], ebx
je 0x40b0f4
mov ebx, dword [0x4556a0]
mov eax, 0xcc33a611
imul ebx, ebx, 0xe33
imul esi
add edx, esi
imul esi, esi, 0x5cc
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
sub ebx, eax
mov eax, 0x5da803a9
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x944]
mov dword [0x455698], eax
mov eax, edi
call fcn.0042904d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x45569c]
mov ecx, dword [0x4556a4]
mov eax, 0x59da2e6b
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x9cbd99d5
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
mov ecx, dword [0x455688]
mov edx, ecx
imul edx, edx, 0xe33
sub eax, edi
add eax, edx
mov edx, esi
imul edx, edx, 0x736
add eax, edx
mov edx, dword [0x45568c]
mov edi, eax
mov eax, 0x4700d503
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [0x4556a4], edi
mov edi, dword [esp + 0x20]
jmp 0x40b43d