Function at 0x4058a0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe7c
mov eax, dword [0x458190]
mov ecx, dword [0x45682c]
mov dword [esp + 0xe78], eax
mov eax, 0x329dfa79
imul ecx
mov ecx, dword [0x456820]
push ebp
push esi
mov esi, dword [str._r_____r____]
sar edx, 0x14
imul esi, esi, 0x50ebd8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1eefbef3
imul ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x779018
sub esi, ecx
add esi, edx
mov edx, dword [0x456830]
push edi
sub esi, edx
push 0
sub esi, 0x45ab63
push 2
mov dword [0x456820], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [0x456824]
mov ebp, eax
mov esi, dword [0x45682c]
mov eax, 0x606c8017
imul edi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xc4570565
imul esi
add edx, esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x329dfa79
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456838]
sub ecx, eax
imul edx, edx, 0x15bc8b
mov eax, dword [0x456830]
imul eax, eax, 0x53af19
add ecx, edx
add ecx, eax
mov eax, 0x622f07f9
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x54f550
imul edx, edx, 0x53af19
sub ecx, eax
mov eax, dword [0x456834]
xor edi, edi
add edx, eax
mov eax, dword [0x456828]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xdc], 0x128
imul eax, eax, 0x779018
add edx, ecx
lea ecx, [eax + edx - 0x45ab63]
lea edx, [esp + 0xdc]
push edx
push ebp
mov dword [0x456824], ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x405a0a
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0xe78]
call fcn.0042a161
add esp, 0xe7c
ret
mov ecx, dword [0x456820]
mov esi, dword [0x456830]
mov eax, 0x521ee247
imul esi, esi, 0x537276
imul ecx
imul ecx, ecx, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
mov ebx, eax
sub ebx, esi
mov esi, dword [0x456834]
mov eax, 0x759571eb
imul esi
sar edx, 0x15
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, ecx
mov ebx, eax
mov eax, 0x224214b1
imul esi
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov dword [0x456818], ebx
xor eax, eax
mov cl, byte [esp + eax + 0x104]
mov byte [esp + eax + 0x208], cl
inc eax
test cl, cl
jne 0x405a70
mov ecx, dword [0x456824]
mov esi, dword [0x45681c]
mov eax, 0x606c8017
imul esi, esi, 0x536f78
imul ecx
mov ecx, dword [0x456838]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xbc70579
imul ecx
sar edx, 0x10
mov ebx, edx
add esi, edx
mov eax, 0x61e4609d
imul ecx
imul ecx, ecx, 0x45ab63
sar edx, 0x15
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add eax, edx
add ebx, esi
sub ebx, eax
sub ebx, ecx
mov ecx, dword [esp + 0xe90]
push ecx
lea edx, [esp + 0x20c]
push edx
mov dword [0x456828], ebx
call fcn.00434bee
mov esi, dword [0x456830]
add esp, 8
test eax, eax
jne 0x405b5d
mov ecx, dword [0x456838]
mov eax, 0x606c8017
imul ecx
imul ecx, ecx, 0x15bc8b
sar edx, 0x15
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [0x456824]
add eax, edi
sub eax, ecx
mov ecx, esi
imul ecx, ecx, 0x53af19
add eax, ecx
sub eax, edx
add eax, 0x42333a
mov dword [0x45681c], eax
mov edi, 1
mov ecx, dword [0x456820]
imul esi, esi, 0x537276
mov eax, 0x521ee247
imul ecx
imul ecx, ecx, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, esi
mov esi, dword [0x456834]
mov eax, 0x759571eb
imul esi
sar edx, 0x15
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
add eax, ecx
mov ebx, eax
mov eax, 0x224214b1
imul esi
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0xe0]
push edx
sub ebx, ecx
push ebp
mov dword [0x456818], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405cf8
mov eax, edi
shl eax, 6
lea ecx, [esp + 0x104]
lea esi, [esp + eax + 0x208]
sub eax, ecx
lea ebx, [esp + eax + 0x208]
lea esp, [esp]
lea eax, [esp + 0x104]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x405bf7
mov ecx, dword [0x456838]
mov eax, 0x606c8017
imul ecx
imul ecx, ecx, 0x15bc8b
sar edx, 0x15
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [0x456824]
add eax, ebp
sub eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x53af19
add eax, ecx
sub eax, edx
mov edx, dword [esp + 0xe90]
push edx
add eax, 0x42333a
push esi
mov dword [0x45681c], eax
call fcn.00434bee
add esp, 8
test eax, eax
jne 0x405cde
mov ecx, dword [0x456820]
mov ebp, ecx
imul ebp, ebp, 0x537276
mov eax, 0x329dfa79
imul ecx
mov ecx, dword [0x456830]
sar edx, 0x14
imul ecx, ecx, 0x31e0ba
add ebp, edx
mov eax, edx
mov edx, dword [0x456824]
shr eax, 0x1f
imul edx, edx, 0x45ab63
add eax, ebp
add eax, ecx
mov ecx, dword [0x45681c]
add eax, edx
mov ebp, eax
mov eax, 0x224214b1
imul ecx
mov ecx, dword [esp + 0xe8]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov dword [esp + edi*4 + 0x18], ecx
inc edi
add esi, 0x40
mov dword [0x45682c], ebp
add ebx, 0x40
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0xe0]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405bf0
mov ecx, dword [0x45681c]
mov eax, 0x1eefbef3
imul ecx
mov ecx, dword [0x456824]
imul ecx, ecx, 0x42333a
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub ecx, eax
imul edx, edx, 0x45ab63
mov eax, dword [0x456828]
imul eax, eax, 0x1c242f
sub ecx, edx
add ecx, eax
push ebp
mov dword [0x456830], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe88]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
call fcn.0042a161
add esp, 0xe7c
ret