Function at 0x404e60
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe7c
mov eax, dword [0x459190]
mov dword [esp + 0xe78], eax
push ebp
push esi
push edi
mov ecx, dword [0x45782c]
mov eax, 0x9ad70599
imul ecx
mov esi, dword [str._r_____r____]
add edx, ecx
imul esi, esi, 0x1a74
mov ecx, dword [0x457820]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x77826bf5
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x457818]
imul edx, edx, 0x59b
sub esi, ecx
add esi, edx
sub esi, dword [0x457834]
push 0
sub esi, 0x2220
push 2
mov dword [0x457820], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x457824]
mov ebp, eax
mov eax, 0x77c150d
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x9ad70599
imul esi
add edx, esi
mov esi, dword [0x45781c]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x457838]
imul edx, edx, 0x1685
sub ecx, eax
mov edi, dword [0x457830]
add ecx, edx
mov eax, 0xb7fe3405
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x10e6
sub ecx, eax
add ecx, edx
mov edx, dword [0x45782c]
mov eax, 0x17eb125
imul edx
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x2234
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x457818]
xor esi, esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0xdc], 0x128
sub ecx, eax
mov eax, dword [0x457828]
imul edx, edx, 0x10e6
imul eax, eax, 0x59b
add edx, edi
add edx, ecx
lea ecx, [eax + edx - 0x2220]
lea edx, [esp + 0xdc]
push edx
push ebp
mov dword [0x457824], ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x404fd0
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0xe78]
call fcn.0042a6e1
add esp, 0xe7c
ret
mov ecx, dword [0x457834]
mov eax, 0xf00f00f1
imul ecx
mov eax, dword [0x457818]
mov edi, dword [0x457820]
imul eax, eax, 0x2220
add edx, ecx
sar edx, 0xd
push ebx
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x457830]
imul edx, edx, 0x1643
add ebx, eax
sub ebx, edx
mov eax, 0x8f2b7b75
imul edi
add edx, edi
sar edx, 0xb
add ebx, edx
mov edi, edx
mov eax, 0xb6adc247
imul ecx
add edx, ecx
sar edx, 0xa
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, ebx
add eax, edx
sub edi, eax
mov dword [0x457818], edi
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x104]
mov byte [esp + eax + 0x208], cl
inc eax
test cl, cl
jne 0x405040
mov edx, dword [0x457824]
mov ecx, dword [0x457838]
mov eax, 0xf883eaf3
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov edi, ecx
imul edi, edi, 0x2220
mov eax, 0x2d78bd59
imul ecx
sar edx, 0xa
sub ebx, edi
mov edi, edx
add ebx, edx
mov edx, dword [0x45781c]
imul edx, edx, 0x1568
shr edi, 0x1f
add edi, ebx
add edi, edx
mov eax, 0x7931d3bd
imul ecx
mov ecx, dword [esp + 0xe90]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
push ecx
lea edx, [esp + 0x20c]
sub edi, eax
push edx
mov dword [0x457828], edi
call fcn.0043515e
mov edi, dword [0x457830]
add esp, 8
test eax, eax
jne 0x405133
mov ecx, dword [0x457838]
mov eax, 0x77c150d
imul ecx
imul ecx, ecx, 0x1685
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x45781c]
mov eax, 0x17eb125
imul ecx
sar edx, 5
add esi, edx
mov ecx, edx
mov edx, edi
imul edx, edx, 0x10e6
shr ecx, 0x1f
add ecx, esi
add ecx, edx
sub ecx, dword [str._r_____r____]
add ecx, 0x1123
mov dword [0x45781c], ecx
mov esi, 1
mov ecx, dword [0x457834]
imul edi, edi, 0x1643
mov eax, 0xf00f00f1
imul ecx
mov eax, dword [0x457818]
add edx, ecx
imul eax, eax, 0x2220
sar edx, 0xd
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, eax
sub ebx, edi
mov edi, dword [0x457820]
mov eax, 0x8f2b7b75
imul edi
add edx, edi
sar edx, 0xb
mov edi, edx
add ebx, edx
mov eax, 0xb6adc247
imul ecx
add edx, ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shr edi, 0x1f
lea edx, [esp + 0xe0]
add edi, ebx
push edx
sub edi, ecx
push ebp
mov dword [0x457818], edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4052e3
mov eax, esi
shl eax, 6
lea ecx, [esp + 0x104]
lea edi, [esp + eax + 0x208]
sub eax, ecx
lea ebx, [esp + eax + 0x208]
lea esp, [esp]
lea eax, [esp + 0x104]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x4051d7
mov ecx, dword [0x457838]
mov eax, 0x77c150d
imul ecx
imul ecx, ecx, 0x1685
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x45781c]
mov dword [esp + 0x10], eax
mov eax, 0x17eb125
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 5
add eax, edx
mov ecx, edx
mov edx, dword [0x457830]
imul edx, edx, 0x10e6
shr ecx, 0x1f
add ecx, eax
mov eax, dword [str._r_____r____]
add ecx, edx
sub ecx, eax
mov eax, dword [esp + 0xe90]
push eax
add ecx, 0x1123
push edi
mov dword [0x45781c], ecx
call fcn.0043515e
add esp, 8
test eax, eax
jne 0x4052cd
mov ecx, dword [0x457820]
mov ebp, dword [0x45782c]
mov eax, 0x9ad70599
imul ebp, ebp, 0x2220
imul ecx
add edx, ecx
imul ecx, ecx, 0x1643
sar edx, 0xc
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
add eax, ecx
mov ecx, dword [0x457830]
imul ecx, ecx, 0xe4e
add eax, ecx
mov ecx, dword [0x45781c]
mov ebp, eax
mov eax, 0xb6adc247
imul ecx
add edx, ecx
mov ecx, dword [esp + 0xe8]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov dword [esp + esi*4 + 0x18], ecx
mov dword [0x45782c], ebp
mov ebp, dword [esp + 0x14]
inc esi
add edi, 0x40
add ebx, 0x40
lea edx, [esp + 0xe0]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4051d0
mov ecx, dword [0x45781c]
mov edi, dword [0x45782c]
mov eax, 0x887d940b
imul edi, edi, 0x2220
imul ecx
mov ecx, dword [0x457828]
sar edx, 0xb
imul ecx, ecx, 0xe4e
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x457824]
imul edx, edx, 0x562
sub eax, edi
add eax, ecx
sub eax, edx
push ebp
mov dword [0x457830], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe88]
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
call fcn.0042a6e1
add esp, 0xe7c
ret