Function at 0x404cb0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe78
mov eax, dword [0x442230]
mov ecx, dword [0x4410d0]
mov dword [esp + 0xe74], eax
push ebx
mov eax, 0xccf850a7
imul ecx
mov ecx, dword [str._r_____r____]
push ebp
imul ecx, ecx, 0x181cd
push esi
mov esi, dword [0x4410c4]
imul esi, esi, 0x3bf27
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
sub eax, esi
push 0
add eax, ecx
push 2
mov dword [0x4410bc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x4410bc]
mov ebp, eax
mov eax, 0x61f4f3e1
imul ecx
mov ecx, dword [0x4410b8]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xa0c15
cdq
idiv ecx
mov dword [esp + 0xdc], 0x128
mov edi, eax
mov eax, 0x1984ece9
imul ecx
sar edx, 0x10
mov ecx, edx
sub edi, esi
mov esi, dword [0x4410b4]
add edi, edx
mov eax, 0x88a76c3f
imul esi
add edx, esi
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x4410cc]
mov eax, 0x197ad0b7
imul edx
shr ecx, 0x1f
add ecx, edi
sar edx, 0x10
mov ebx, edx
add esi, edx
mov eax, 0x3307af59
imul ecx
sar edx, 0x11
mov dword [str._r_____r____], ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shr ebx, 0x1f
lea edx, [esp + 0xdc]
add ebx, esi
push edx
sub ebx, ecx
push ebp
xor edi, edi
mov dword [0x4410c0], ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x404dd1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe74]
call fcn.00419f5d
add esp, 0xe78
ret
mov ecx, dword [0x4410d0]
mov esi, dword [0x4410b4]
mov eax, 0x3307af59
imul esi, esi, 0x53a0f
imul ecx
sar edx, 0x11
add esi, edx
mov eax, edx
mov edx, dword [0x4410b8]
imul edx, edx, 0xff4b
shr eax, 0x1f
add eax, esi
sub eax, edx
mov dword [0x4410b4], eax
xor eax, eax
jmp 0x404e10
mov dl, byte [esp + eax + 0x100]
mov byte [esp + eax + 0x204], dl
inc eax
test dl, dl
jne 0x404e10
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x4410bc]
mov eax, 0x3307af59
imul edx
sar edx, 0x11
mov ebx, edx
add esi, edx
mov eax, 0x1984ece9
imul ecx
mov ecx, dword [esp + 0xe8c]
sar edx, 0x10
shr ebx, 0x1f
mov eax, edx
add ebx, esi
add ebx, edx
shr eax, 0x1f
push ecx
lea edx, [esp + 0x208]
add eax, ebx
push edx
mov dword [0x4410c4], eax
call fcn.0042529e
mov ecx, dword [0x4410b8]
add esp, 8
test eax, eax
jne 0x404ebf
mov edx, dword [0x4410c8]
imul ecx, ecx, 0xd454
mov eax, 0x61f4f3e1
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4410c0]
imul edx, edx, 0xa081a
sub ecx, eax
sub ecx, edx
mov dword [0x4410b8], ecx
mov edi, 1
mov edx, dword [0x4410d0]
imul ecx, ecx, 0xff4b
mov esi, dword [0x4410b4]
mov eax, 0x3307af59
imul esi, esi, 0x53a0f
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
lea ecx, [esp + 0xdc]
push ecx
push ebp
mov dword [0x4410b4], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40501a
mov eax, edi
shl eax, 6
lea edx, [esp + 0x100]
lea ebx, [esp + eax + 0x204]
sub eax, edx
lea esi, [esp + eax + 0x204]
lea eax, [esp + 0x100]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x404f30
mov eax, dword [0x4410b8]
mov ecx, dword [0x4410c8]
imul eax, eax, 0xd454
mov dword [esp + 0x10], eax
mov eax, 0x61f4f3e1
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4410c0]
imul edx, edx, 0xa081a
sub ecx, eax
mov eax, dword [esp + 0xe8c]
push eax
sub ecx, edx
push ebx
mov dword [0x4410b8], ecx
call fcn.0042529e
add esp, 8
test eax, eax
jne 0x405004
mov ecx, dword [0x4410b4]
mov eax, 0x88a76c3f
imul ecx
add edx, ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
mov ecx, dword [0x4410c0]
mov dword [esp + 0x10], eax
mov eax, 0x61f4f3e1
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x4410d4]
mov dword [esp + 0x10], eax
mov eax, 0x402d6015
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0xe
add eax, edx
mov ecx, edx
mov edx, dword [esp + 0xe4]
shr ecx, 0x1f
add ecx, eax
mov dword [esp + edi*4 + 0x14], edx
inc edi
add ebx, 0x40
mov dword [0x4410c8], ecx
add esi, 0x40
lea eax, [esp + 0xdc]
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404f23
mov ecx, dword [str._r_____r____]
mov eax, 0x197ad0b7
imul ecx
mov ecx, dword [0x4410cc]
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, ecx
imul edx, edx, 0xa0887
add esi, edx
mov eax, 0x40499437
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
push ebp
mov dword [0x4410cc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe84]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.00419f5d
add esp, 0xe78
ret