Function at 0x405eb0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe80
mov eax, dword [0x45e640]
mov dword [esp + 0xe7c], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45ccd8]
mov eax, 0x5134ce4f
imul ecx
imul ecx, ecx, 0x150d2
mov eax, dword [0x45cce8]
imul eax, eax, 0xdaea
sar edx, 0xd
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45ccdc]
add esi, eax
mov eax, 0x61494a93
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x45ccc8]
imul ecx, ecx, 0xd082
add esi, ecx
mov ecx, dword [0x45ccd0]
mov eax, 0x79b0bfed
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce4]
sub esi, eax
sub esi, edx
push 0
sub esi, 0x64e1
push 2
mov dword [0x45ccd0], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45ccd4]
mov esi, dword [0x45cce8]
mov edi, dword [0x45cccc]
imul esi, esi, 0xdaea
mov ebp, eax
mov eax, 0x98dd629f
imul ecx
add edx, ecx
sar edx, 0xf
add esi, edx
mov ebx, edx
mov edx, edi
imul edx, edx, 0xd3c7
shr ebx, 0x1f
add ebx, esi
add ebx, edx
mov eax, 0x61494a93
imul ecx
mov esi, dword [0x45ccdc]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x61494a93
imul edi
sar edx, 0xf
mov ecx, edx
add ebx, edx
mov edx, esi
imul edx, edx, 0xd082
shr ecx, 0x1f
add ecx, ebx
mov eax, 0x5cb3b92f
add ecx, edx
imul edi
mov dword [esp + 0x18], ebp
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x98dd629f
imul esi
mov eax, dword [0x45ccd8]
add edx, esi
imul eax, eax, 0xd082
sar edx, 0xf
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, esi
imul edx, edx, 0xd3c7
add edi, edx
add edi, eax
mov eax, 0x8891a35
imul esi
sar edx, 9
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x1a6de
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x45cce0]
lea edx, [esp + 0xe4]
add edi, eax
push edx
lea ecx, [ecx + edi - 0x64e1]
push ebp
mov dword [esp + 0xec], 0x128
xor ebx, ebx
mov dword [0x45ccd4], ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40606b
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xe7c]
call fcn.0042fdb1
add esp, 0xe80
ret
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
imul esi, esi, 0x64e1
mov eax, 0x5134ce4f
imul ecx
sar edx, 0xd
add esi, edx
mov edi, edx
mov eax, 0x9aba81d9
imul ecx
add edx, ecx
sar edx, 0xf
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov edx, dword [0x45cce4]
mov eax, 0x4e93cfed
imul edx
sar edx, 0xe
shr esi, 0x1f
mov eax, edx
add esi, edi
mov edi, dword [0x45cce0]
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x2a2d
sub esi, eax
add esi, edx
mov eax, 0x1fd2221d
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
mov dword [0x45ccc8], ecx
xor esi, esi
lea esp, [esp]
mov al, byte [esp + esi + 0x108]
mov byte [esp + esi + 0x20c], al
inc esi
test al, al
jne 0x4060f0
mov esi, dword [0x45cce8]
imul ecx, ecx, 0xd65c
mov eax, 0x95af2ed3
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd4]
mov ebp, esi
imul ebp, ebp, 0x64e1
sub eax, ebp
mov ebp, dword [0x45ccd4]
mov dword [esp + 0x10], eax
mov eax, 0x98dd629f
imul edx
add edx, ebp
mov ebp, dword [esp + 0x10]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x9aba81d9
imul esi
add edx, esi
add ebp, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x8891a35
imul edi
imul edi, edi, 0x3bfc
sar edx, 9
sub ebp, ecx
mov ecx, dword [esp + 0xe94]
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
push ecx
lea edx, [esp + 0x210]
add eax, edi
push edx
mov dword [0x45ccd8], eax
call fcn.0043a81e
mov edi, dword [0x45cce4]
mov esi, dword [0x45cce0]
add esp, 8
test eax, eax
jne 0x406231
mov eax, dword [0x45cce8]
mov ecx, dword [0x45ccd4]
imul eax, eax, 0xdaea
mov ebx, edi
imul ebx, ebx, 0x64e1
sub ebx, eax
mov eax, 0x98dd629f
imul ecx
add edx, ecx
sar edx, 0xf
add ebx, edx
mov ebp, edx
mov edx, esi
imul edx, edx, 0xd3c7
shr ebp, 0x1f
add ebp, ebx
add ebp, edx
mov eax, 0x4e93cfed
imul ecx
mov ecx, dword [0x45cccc]
sar edx, 0xe
add ebp, edx
mov ebx, edx
mov eax, 0x8891a35
imul ecx
shr ebx, 0x1f
sar edx, 9
add ebx, ebp
mov eax, edx
add ebx, edx
mov edx, dword [str._r_____r____]
shr eax, 0x1f
add eax, ebx
sub eax, edx
add eax, 0x86a3
mov dword [0x45cccc], eax
mov ebx, 1
mov ecx, dword [0x45ccd0]
imul esi, esi, 0x2a2d
mov ebp, dword [0x45ccc8]
imul ebp, ebp, 0x64e1
mov eax, 0x5134ce4f
imul ecx
sar edx, 0xd
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov dword [esp + 0x10], eax
mov eax, 0x9aba81d9
imul ecx
mov eax, dword [esp + 0x10]
add edx, ecx
sar edx, 0xf
add eax, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0x4e93cfed
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x1fd2221d
imul ecx
sar edx, 0xd
mov ecx, edx
add ebp, esi
add ebp, edx
shr ecx, 0x1f
add ecx, ebp
mov ebp, dword [esp + 0x18]
lea edx, [esp + 0xe4]
push edx
push ebp
mov dword [0x45ccc8], ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406441
mov eax, ebx
shl eax, 6
lea ecx, [esp + 0x108]
lea edi, [esp + eax + 0x20c]
sub eax, ecx
lea esi, [esp + eax + 0x20c]
mov dword [esp + 0x10], esi
lea eax, [esp + 0x108]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x4062e8
mov ebp, dword [0x45cce4]
mov edx, dword [0x45cce8]
imul ebp, ebp, 0x64e1
mov ecx, dword [0x45ccd4]
imul edx, edx, 0xdaea
sub ebp, edx
mov eax, 0x98dd629f
imul ecx
add edx, ecx
sar edx, 0xf
add ebp, edx
mov eax, edx
mov edx, dword [0x45cce0]
shr eax, 0x1f
imul edx, edx, 0xd3c7
add eax, ebp
add eax, edx
mov dword [esp + 0x14], eax
mov eax, 0x4e93cfed
imul ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [0x45cccc]
sar edx, 0xe
add eax, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, eax
mov eax, 0x8891a35
imul ecx
mov ecx, dword [esp + 0xe94]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [str._r_____r____]
add eax, ebp
sub eax, edx
push ecx
add eax, 0x86a3
push edi
mov dword [0x45cccc], eax
call fcn.0043a81e
add esp, 8
test eax, eax
jne 0x406427
mov esi, dword [0x45cccc]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
mov ecx, dword [0x45cce4]
imul eax, eax, 0x64e1
lea ebp, [esi + edx]
imul ebp, ebp, 0xb0bd
add ebp, eax
mov eax, 0x98dd629f
imul ecx
add edx, ecx
sar edx, 0xf
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x61494a93
imul ecx
sar edx, 0xf
add ebp, edx
mov ecx, edx
mov eax, 0x4e93cfed
imul esi
mov esi, dword [esp + 0x10]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x10171
shr ecx, 0x1f
add ecx, ebp
sub ecx, eax
mov eax, dword [esp + 0xec]
add ecx, edx
mov dword [esp + ebx*4 + 0x1c], eax
inc ebx
add edi, 0x40
add esi, 0x40
mov dword [0x45ccdc], ecx
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0xe4]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4062e1
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
lea esi, [ecx + edx]
imul eax, eax, 0x64e1
mov edx, dword [0x45ccd4]
imul esi, esi, 0x86a3
imul edx, edx, 0xdaea
sub esi, eax
sub esi, edx
mov eax, 0x5cb3b92f
imul ecx
mov ecx, dword [0x45cccc]
sar edx, 0xe
mov edi, edx
add esi, edx
mov eax, 0x79b0bfed
imul ecx
mov ecx, dword [0x45ccd8]
sar edx, 0xe
imul ecx, ecx, 0x10171
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, esi
add eax, edx
sub edi, eax
add edi, ecx
push ebp
mov dword [0x45cce0], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe8c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
call fcn.0042fdb1
add esp, 0xe80
ret