Function at 0x40f850
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c0
mov eax, dword [0x45e640]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45ccd4]
mov esi, dword [0x45cce8]
mov edi, eax
imul esi, esi, 0xdaea
mov eax, 0x98dd629f
imul ecx
add edx, ecx
sar edx, 0xf
mov ebx, edx
add esi, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45cccc]
mov eax, esi
imul eax, eax, 0xd3c7
add ebx, eax
mov eax, 0x61494a93
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x61494a93
imul esi
sub ebx, ecx
sar edx, 0xf
mov ecx, edx
add ebx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0xd082
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
mov eax, 0x5cb3b92f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [str._r_____r____], ecx
lea ecx, [esp + 0xa0]
push ecx
push edi
mov dword [esp + 0x20], edi
mov dword [esp + 0xa8], 0x128
mov dword [esp + 0x24], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40f936
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9bc]
call fcn.0042fdb1
add esp, 0x9c0
ret
mov esi, dword [0x45cce4]
mov edx, dword [0x45cce8]
imul esi, esi, 0x64e1
mov ecx, dword [0x45ccd4]
imul edx, edx, 0xdaea
sub esi, edx
mov eax, 0x98dd629f
imul ecx
add edx, ecx
push ebp
mov ebp, dword [0x45cce0]
sar edx, 0xf
add esi, edx
mov eax, ebp
imul eax, eax, 0xd3c7
mov edi, edx
shr edi, 0x1f
add edi, esi
add edi, eax
mov eax, 0x4e93cfed
imul ecx
mov ecx, dword [0x45cccc]
sar edx, 0xe
add edi, edx
mov esi, edx
mov eax, 0x8891a35
imul ecx
mov eax, dword [str._r_____r____]
shr esi, 0x1f
sar edx, 9
add esi, edi
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, eax
add ecx, 0x86a3
mov dword [0x45cccc], ecx
xor esi, esi
lea ecx, [ecx]
mov dl, byte [esp + esi + 0xc8]
mov byte [esp + esi + 0x1cc], dl
inc esi
test dl, dl
jne 0x40f9c0
mov edx, dword [0x45ccd8]
mov esi, dword [0x45ccdc]
lea ebx, [edx + eax]
mov edi, eax
imul ebx, ebx, 0xd082
mov eax, 0x98dd629f
imul edi, edi, 0xd65c
imul esi
add edx, esi
sar edx, 0xf
add ebx, edx
mov eax, edx
shr eax, 0x1f
mov edx, esi
imul edx, edx, 0xd3c7
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x8891a35
imul esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0x9d4]
add ebx, edi
lea edx, [ebx + ebp - 0x64e1]
mov dword [esp + 0x14], eax
mov dword [0x45ccd4], edx
lea eax, [esp + 0x1cc]
mov dl, byte [eax]
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x40fa75
test dl, dl
je 0x40fa71
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x40fa75
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0x14], ebx
jne 0x40fa45
xor eax, eax
jmp 0x40fa7a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40faf2
mov eax, dword [0x45ccd0]
imul esi, esi, 0x64e1
imul ebp, ebp, 0x10171
lea ebx, [eax + ecx]
imul ebx, ebx, 0xb0bd
add ebx, esi
mov esi, dword [0x45cce4]
mov eax, 0x98dd629f
imul esi
add edx, esi
sar edx, 0xf
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, 0x61494a93
imul esi
mov eax, dword [esp + 0x18]
sar edx, 0xf
mov ebx, edx
add eax, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x4e93cfed
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
add ebx, ebp
mov dword [0x45ccdc], ebx
mov ebx, 1
jmp 0x40fafc
mov esi, dword [0x45cce4]
mov ebx, dword [esp + 0x20]
mov edx, dword [0x45ccc8]
mov eax, dword [0x45ccd4]
mov ecx, dword [0x45ccd8]
lea ebp, [edx + eax]
mov eax, 0x98dd629f
imul ebp, ebp, 0x3bfc
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x61494a93
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x5cb3b92f
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x79b0bfed
imul dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
sub ebp, ecx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xa4]
add ebp, edi
push ecx
add eax, ebp
push edx
mov dword [0x45cce4], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40fd34
mov eax, ebx
shl eax, 6
lea ecx, [esp + eax + 0x1cc]
lea edx, [esp + 0xc8]
sub eax, edx
lea esi, [esp + eax + 0x1cc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], esi
jmp 0x40fbb3
mov esi, dword [esp + 0x18]
mov edi, dword [0x45ccd0]
mov ecx, dword [0x45ccc8]
imul ecx, ecx, 0x64e1
mov eax, 0x5134ce4f
imul edi
sar edx, 0xd
add ecx, edx
mov ebp, edx
mov eax, 0x9aba81d9
imul edi
add edx, edi
shr ebp, 0x1f
add ebp, ecx
sar edx, 0xf
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov ecx, dword [0x45cce0]
mov eax, 0x4e93cfed
imul ecx, ecx, 0x2a2d
imul dword [0x45cce4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x1fd2221d
imul edi
add ebp, ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov dword [0x45ccc8], ecx
lea eax, [esp + 0xc8]
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x40fc34
mov ebp, dword [esp + 0x9d4]
mov esi, dword [esp + 0x14]
lea esp, [esp]
mov dl, byte [esi]
mov al, dl
cmp dl, byte [ebp]
jne 0x40fc75
test al, al
je 0x40fc71
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x40fc75
add esi, 2
add ebp, 2
test al, al
jne 0x40fc50
xor eax, eax
jmp 0x40fc7a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fd1a
mov esi, dword [0x45ccd8]
imul ecx, ecx, 0xd082
mov eax, 0x5134ce4f
imul esi
imul esi, esi, 0x150d2
mov eax, dword [0x45cce8]
imul eax, eax, 0xdaea
sar edx, 0xd
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x45ccdc]
add ebp, eax
mov eax, 0x61494a93
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebp, esi
sub ebp, eax
mov eax, 0x79b0bfed
imul edi
mov eax, dword [0x45cce4]
add ebp, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0xac]
sub ebp, ecx
mov ecx, dword [esp + 0x18]
sub ebp, eax
mov dword [esp + ebx*4 + 0x24], edx
mov edx, dword [esp + 0x14]
sub ebp, 0x64e1
mov eax, 0x40
add edx, eax
inc ebx
add ecx, eax
mov dword [0x45ccd0], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xa4]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40fbaf
mov ecx, dword [0x45cce8]
mov eax, 0x95af2ed3
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
mov esi, ecx
imul edx, edx, 0xd65c
mov edi, eax
imul esi, esi, 0x64e1
sub edi, esi
mov esi, dword [0x45ccd4]
add edi, edx
mov eax, 0x98dd629f
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x9aba81d9
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45cce0]
mov eax, 0x8891a35
imul ecx
imul ecx, ecx, 0x3bfc
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, ecx
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [0x45ccd8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9cc]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0042fdb1
add esp, 0x9c0
ret