Function at 0x40f490
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9bc
mov eax, dword [0x45f640]
xor eax, esp
push ebx
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d0], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov eax, dword [0x45dbd4]
cdq
mov esi, eax
mov eax, dword [0x45dbd8]
push 2
mov edi, edx
cdq
push 0xbeb5aaf
push edx
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0xb0], 0x128
call fcn.004305f0
mov ebp, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
push 2
push 0x1b912b5c
push edi
push esi
add ebp, eax
call fcn.004305f0
push 1
push 0xba7a7bcd
push edi
push esi
add ebp, eax
call fcn.004305f0
mov ecx, dword [0x45dbe0]
sub ebp, eax
imul ecx, ecx, 0x264da184
mov eax, dword [0x45dbdc]
imul eax, eax, 0x6d4760f7
lea edx, [esp + 0xa0]
add ebp, eax
push edx
add ebp, ecx
push ebx
mov dword [0x45dbc4], ebp
mov dword [esp + 0x18], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40f55b
or eax, 0xffffffff
jmp 0x40f9c4
mov edi, dword [0x45dbc8]
push 2
mov eax, edi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebp, eax
mov eax, dword [0x45dbd8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
sub ebp, eax
mov eax, dword [0x45dbe0]
push 1
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
mov ebx, dword [0x45dbdc]
add ebp, eax
mov eax, 0x1f64bb9f
mul dword [0x45dbd0]
mov ecx, dword [0x45dbd4]
shr edx, 0x1c
sub ebp, edx
mov eax, 0x9a168f41
mul ebx
mov eax, dword [0x45dbc4]
imul eax, eax, 0x1531b042
shr edx, 0x1f
add ebp, edx
sub ebp, eax
mov eax, 0x45291d0f
imul ecx
sar edx, 0x1d
mov esi, edx
shr esi, 0x1f
add ebp, edx
add esi, ebp
mov dword [0x45dbcc], esi
xor eax, eax
mov cl, byte [esp + eax + 0xc4]
mov byte [esp + eax + 0x1c8], cl
inc eax
test cl, cl
jne 0x40f5f0
mov eax, ebx
cdq
push 2
push 0x1b912b5c
mov ebp, edx
mov ebx, eax
push ebp
push ebx
call fcn.004305f0
push 1
push 0x388a7f11
push ebp
push ebx
mov dword [esp + 0x24], eax
call fcn.004305f0
mov edx, dword [0x45dbe8]
mov ecx, dword [esp + 0x14]
imul edx, edx, 0x1b912b5c
mov ebp, dword [0x45dbe4]
sub ecx, eax
mov eax, dword [0x45dbc4]
imul eax, eax, 0x4f22272
add ecx, edx
mov edx, edi
imul edx, edx, 0x264da184
add eax, ebp
mov ebp, dword [esp + 0x9d0]
add eax, ecx
lea ebx, [edx + eax + 0x7672ee00]
mov dword [0x45dbd4], ebx
lea eax, [esp + 0x1c8]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [ebp]
jne 0x40f69b
test cl, cl
je 0x40f697
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [ebp + 1]
jne 0x40f69b
add eax, 2
add ebp, 2
test cl, cl
jne 0x40f676
xor eax, eax
jmp 0x40f6a0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f709
mov eax, dword [0x45dbd0]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebp, eax
mov eax, dword [0x45dbe4]
push 2
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
imul edi, edi, 0x3903276d
add ebp, eax
mov eax, 0x1f64bb9f
mul esi
mov eax, dword [0x45dbc4]
imul eax, eax, 0x7672ee00
mov ecx, esi
imul ecx, ecx, 0x74f4f79a
shr edx, 0x1c
sub ebp, edx
sub ebp, edi
add ebp, eax
add ebp, ecx
mov dword [0x45dbdc], ebp
mov dword [esp + 0x10], 1
mov eax, dword [0x45dbe4]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov edi, eax
mov eax, dword [0x45dbd0]
push 0xfffffffffffffffe
cdq
push 0x45858433
push edx
push eax
call fcn.004305f0
mov ebp, eax
push 2
mov eax, esi
cdq
push 0x1b912b5c
push edx
push eax
sub ebp, edi
call fcn.004305f0
imul ebx, ebx, 0x7114fe22
add ebp, eax
mov eax, 0x9a168f41
mul dword [0x45dbc4]
mov eax, dword [0x45dbd8]
imul eax, eax, 0x1b912b5c
shr edx, 0x1f
add ebp, edx
sub ebp, eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xa0]
push edx
add ebp, ebx
push eax
mov dword [0x45dbe4], ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40f932
mov eax, dword [esp + 0x10]
shl eax, 6
lea ecx, [esp + eax + 0x1c8]
lea edx, [esp + 0xc4]
sub eax, edx
lea esi, [esp + eax + 0x1c8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], esi
jmp 0x40f7c0
mov esi, dword [esp + 0x14]
jmp 0x40f7c0
mov eax, dword [0x45dbdc]
push 1
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
mov ebp, dword [0x45dbe0]
mov ebx, dword [0x45dbd0]
mov ecx, eax
mov eax, 0x1f64bb9f
mul ebp
shr edx, 0x1c
sub ecx, edx
mov edi, dword [0x45dbe4]
mov eax, 0x2d0ae8c5
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
mov edx, ebp
imul edx, edx, 0x3053d3f1
shr eax, 0x1f
add ecx, eax
add ecx, edx
mov eax, 0x45291d0f
imul edi
sar edx, 0x1d
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x45dbd8]
imul ecx, ecx, 0x7672ee00
add eax, ecx
mov dword [0x45dbc8], eax
lea eax, [esp + 0xc4]
nop
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x40f840
mov esi, dword [esp + 0x9d0]
mov eax, dword [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f879
test cl, cl
je 0x40f875
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f879
add eax, 2
add esi, 2
test cl, cl
jne 0x40f855
xor eax, eax
jmp 0x40f87e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f918
mov esi, dword [0x45dbe8]
push 2
mov eax, esi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
imul esi, esi, 0x1531b042
imul edi, edi, 0x7d86eec7
mov ecx, dword [0x45dbc4]
imul ecx, ecx, 0xf414a551
sub ecx, eax
mov eax, 0x9a168f41
mul ebx
shr edx, 0x1f
sub ecx, edx
mov eax, 0x45291d0f
imul dword [0x45dbd8]
sar edx, 0x1d
sub ecx, esi
add ecx, edx
mov eax, edx
mov edx, dword [esp + 0xa8]
shr eax, 0x1f
add eax, ecx
sub eax, edi
lea ecx, [eax + ebp - 0x7672ee00]
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
inc eax
mov dword [0x45dbd0], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xa0]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40f7b7
mov eax, dword [0x45dbe0]
push 1
cdq
push 0x388a7f11
push edx
push eax
call fcn.004305f0
mov esi, dword [0x45dbc8]
mov edi, eax
push 2
mov eax, esi
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
sub edi, eax
mov eax, dword [0x45dbc4]
push 1
cdq
push 0xeace4fbe
push edx
push eax
call fcn.004305f0
imul esi, esi, 0x1b912b5c
mov ecx, dword [0x45dbe8]
add edi, eax
mov eax, 0x2d0ae8c5
mul ecx
mov eax, ecx
imul ecx, ecx, 0x7672ee00
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [0x45dbcc]
imul edx, edx, 0x388a7f11
shr eax, 0x1f
add edi, eax
mov eax, dword [esp + 0x18]
sub edi, edx
add edi, esi
sub edi, ecx
push eax
mov dword [0x45dbd8], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x9c8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043040d
add esp, 0x9bc
ret