Function at 0x40e500
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x93c
mov eax, dword [0x45e540]
mov ecx, dword [0x45cbcc]
mov edx, dword [0x45cbe8]
xor eax, ebp
imul edx, edx, 0x53439e
mov dword [esp + 0x938], eax
push ebx
push esi
mov esi, dword [0x45cbd4]
push edi
mov edi, dword [0x45cbdc]
imul edi, edi, 0x63e546
mov eax, ecx
imul eax, eax, 0x5643ad
add edi, eax
add edi, edx
mov eax, 0x1b2eb4bf
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1b2eb4bf
imul ecx
sar edx, 0x14
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x7a2fd6e1
imul ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, dword [ebp + 8]
mov eax, 0xa3c4e0d7
imul esi
sub edi, ecx
add edx, esi
sar edx, 0x16
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [str._r_____r____], eax
mov byte [esp + 0x140], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
lea ecx, [esp + 0x144]
push 0x44d064
push ecx
stosb byte es:[edi], al
call fcn.0042fee1
mov edi, dword [0x45cbd0]
mov eax, 0x2900b7f9
imul dword [0x45cbe4]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x3e38df13
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x45cbc8]
imul ecx, ecx, 0x41d422
add esp, 0xc
add esi, ecx
mov ebx, dword [0x45cbe0]
mov edx, ebx
imul ebx, ebx, 0x5643ad
imul edx, edx, 0x32d358
sub esi, edx
mov eax, 0x5ef6c237
imul edi
sar edx, 0x15
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov esi, eax
mov eax, 0x3d3e7a09
imul edi
sar edx, 0x15
add esi, edx
mov ecx, edx
mov eax, 0x2900b7f9
imul dword [0x45cbd4]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe4]
imul edx, edx, 0x41d422
add eax, edx
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, 0xa3c4e0d7
imul dword [0x45cbd4]
add edx, dword [0x45cbd4]
mov eax, dword [esp + 0x10]
sar edx, 0x16
add eax, edx
mov ebx, edx
mov edx, dword [0x45cbcc]
shr ebx, 0x1f
add ebx, eax
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45cbe8]
mov eax, 0x4f7fd81
imul esi, esi, 0x53439e
imul edx
sar edx, 0x11
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, dword [str._r_____r____]
sub eax, esi
sub eax, ebx
add eax, 0x41fb8b
mov dword [0x45cbcc], eax
mov eax, 0x3e13b50f
imul edi
mov edi, dword [0x45cbd8]
mov dword [0x45cbc8], ecx
imul ecx, ecx, 0x63e546
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x3e38df13
imul edi
imul edi, edi, 0x96af7c
sar edx, 0x14
mov ebx, edx
add ecx, edx
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x45cbdc]
mov eax, 0x1b2eb4bf
imul ecx
add ebx, edi
mov dword [esp + 0x10], 0
sar edx, 0x14
mov edi, dword [0x45cbe4]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
sub ebx, edi
push 0
lea edx, [ebx + esi - 0x41d422]
push 2
mov dword [0x45cbd0], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0xc], ebx
jne 0x40e7f0
mov esi, dword [0x45cbdc]
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45cbd8]
lea edi, [eax + ecx]
imul ecx, ecx, 0x640b17
mov edx, esi
imul edi, edi, 0x63e546
imul edx, edx, 0x5643ad
add edi, edx
mov eax, 0xa3c4e0d7
imul esi
add edx, esi
sar edx, 0x16
mov ebx, edx
add edi, edx
mov eax, 0x4f7fd81
imul esi
sar edx, 0x11
shr ebx, 0x1f
mov eax, edx
add ebx, edi
shr eax, 0x1f
add ebx, ecx
mov ecx, dword [0x45cbe0]
add eax, edx
sub ebx, eax
lea edx, [ebx + ecx - 0x41d422]
push str.CreateToolhelp32Snapshot__of_processes_
mov dword [0x45cbd4], edx
call fcn.004309e6
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x938]
xor ecx, ebp
call fcn.0042fd0d
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cbe8]
mov eax, 0xa1093dc9
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov esi, ecx
imul esi, esi, 0x41d422
mov eax, 0x6262bd7d
imul ecx
mov ecx, dword [0x45cbc8]
sub edi, esi
imul ecx, ecx, 0x640b17
sar edx, 0x15
add edi, edx
mov esi, edx
shr esi, 0x1f
add esi, edi
add esi, ecx
mov ecx, dword [0x45cbe0]
mov eax, 0x4f7fd81
imul ecx
imul ecx, ecx, 0x670b79
sar edx, 0x11
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, ecx
mov ecx, dword [0x45cbd4]
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
lea ecx, [esp + 0x18]
add eax, edx
push ecx
sub edi, eax
push ebx
mov dword [0x45cbd8], edi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40e930
mov ecx, dword [0x45cbcc]
mov edx, dword [0x45cbd0]
lea esi, [edx + ecx]
mov eax, 0x2900b7f9
imul esi, esi, 0x8616f6
imul ecx
mov ecx, dword [0x45cbdc]
sar edx, 0x14
imul ecx, ecx, 0x41d422
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe0]
imul edx, edx, 0x85c28b
sub esi, eax
add esi, ecx
mov ecx, dword [0x45cbe4]
add esi, edx
mov eax, 0x1b2eb4bf
imul ecx
sar edx, 0x14
mov edi, edx
add esi, edx
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
sar edx, 0x16
shr edi, 0x1f
mov eax, edx
add edi, esi
shr eax, 0x1f
add edi, edx
add eax, edi
push ebx
mov dword [0x45cbdc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x938]
xor ecx, ebp
call fcn.0042fd0d
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cbe8]
mov edx, dword [0x45cbd0]
lea esi, [edx + ecx]
mov edx, dword [0x45cbcc]
imul esi, esi, 0x41fb8b
mov eax, 0x3e13b50f
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0x41d422
sub esi, eax
mov eax, dword [0x45cbd4]
sub esi, edx
imul eax, eax, 0x53439e
mov edx, dword [0x45cbd8]
imul edx, edx, 0x85c28b
sub esi, eax
add esi, edx
mov eax, 0x7a2fd6e1
imul ecx
sar edx, 0x16
mov eax, edx
add esi, edx
lea ecx, [esp + 0x140]
shr eax, 0x1f
push ecx
lea edx, [esp + 0x40]
add eax, esi
push edx
mov dword [0x45cbe0], eax
call fcn.0043a81e
add esp, 8
test eax, eax
je 0x40ee4e
mov ecx, dword [0x45cbd0]
mov eax, dword [0x45cbd8]
mov edx, dword [0x45cbe4]
lea esi, [eax + ecx]
imul edx, edx, 0x41d422
imul ecx, ecx, 0x640b17
imul esi, esi, 0x5643ad
sub esi, edx
mov edx, dword [str._r_____r____]
mov eax, 0x3d3e7a09
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45cbc8]
mov eax, 0xa3c4e0d7
imul ecx
add edx, ecx
sar edx, 0x16
mov edi, edx
add esi, edx
mov eax, 0x4f7fd81
imul ecx
shr edi, 0x1f
sar edx, 0x11
add edi, esi
mov ecx, edx
add edi, edx
mov edx, dword [esp + 0x20]
push edx
shr ecx, 0x1f
push 0
add ecx, edi
push 0x1f0fff
mov dword [0x45cbe8], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x45cbcc]
mov ebx, dword [0x45cbdc]
mov edx, dword [0x45cbe8]
imul ebx, ebx, 0x63e546
mov esi, dword [0x45cbd4]
imul edx, edx, 0x53439e
mov edi, eax
mov eax, ecx
imul eax, eax, 0x5643ad
add ebx, eax
add ebx, edx
mov eax, 0x1b2eb4bf
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1b2eb4bf
imul ecx
sar edx, 0x14
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x7a2fd6e1
imul ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xa3c4e0d7
imul esi
add edx, esi
sar edx, 0x16
sub ebx, ecx
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
test edi, edi
mov dword [str._r_____r____], eax
jne 0x40eae2
push 0x44d030
call fcn.004309e6
add esp, 4
jmp 0x40eb7c
mov ecx, dword [0x45cbe4]
mov eax, 0x2900b7f9
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x45cbd0]
mov eax, 0x3e38df13
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbc8]
mov ebx, eax
imul edx, edx, 0x41d422
mov eax, dword [0x45cbe0]
imul eax, eax, 0x32d358
sub ebx, esi
add ebx, edx
sub ebx, eax
mov eax, 0x5ef6c237
imul ecx
sar edx, 0x15
mov esi, edx
add ebx, edx
mov eax, 0x3d3e7a09
imul ecx
sar edx, 0x15
shr esi, 0x1f
mov ecx, edx
add esi, ebx
shr ecx, 0x1f
add esi, edx
add ecx, esi
push edi
mov dword [0x45cbc8], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x40eb75
push 0x44d01c
call fcn.004309e6
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x45cbd4]
mov eax, 0x2900b7f9
imul ecx
mov eax, dword [0x45cbe0]
sar edx, 0x14
imul eax, eax, 0x5643ad
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45cbe4]
imul edx, edx, 0x41d422
add esi, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x53439e
add esi, eax
sub esi, edx
mov eax, 0xa3c4e0d7
imul ecx
mov ebx, dword [str._r_____r____]
add edx, ecx
mov ecx, dword [0x45cbcc]
sar edx, 0x16
mov edi, edx
add esi, edx
mov eax, 0x4f7fd81
imul ecx
sar edx, 0x11
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, esi
add edi, edx
add eax, edi
sub eax, ebx
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
add eax, 0x41fb8b
push ebx
mov dword [0x45cbcc], eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40e930
mov edi, dword [0x45cbc8]
mov ecx, dword [0x45cbe4]
mov esi, dword [0x45cbd8]
mov edx, dword [0x45cbd0]
imul edi, edi, 0x63e546
mov eax, 0x3e13b50f
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3e38df13
imul esi
imul esi, esi, 0x96af7c
sar edx, 0x14
mov eax, edx
add edi, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x53439e
shr eax, 0x1f
add eax, edi
add eax, edx
mov edx, dword [0x45cbdc]
add eax, esi
mov dword [esp + 0xc], eax
mov eax, 0x1b2eb4bf
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
sub edx, ecx
sub edx, 0x41d422
push ebx
mov dword [0x45cbd0], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40e7d9
mov esi, dword [0x45cbdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45cbd8]
lea edi, [edx + ecx]
imul ecx, ecx, 0x640b17
mov eax, esi
imul edi, edi, 0x63e546
imul eax, eax, 0x5643ad
add edi, eax
mov eax, 0xa3c4e0d7
imul esi
add edx, esi
sar edx, 0x16
mov ebx, edx
add edi, edx
mov eax, 0x4f7fd81
imul esi
shr ebx, 0x1f
sar edx, 0x11
add ebx, edi
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cbe0]
sub ebx, ecx
mov ecx, dword [esp + 0x20]
push ecx
push 0
lea eax, [ebx + edx - 0x41d422]
push 0x1f0fff
mov dword [0x45cbd4], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [0x45cbd4]
mov ebx, eax
mov edi, dword [0x45cbcc]
mov eax, 0xa3c4e0d7
imul esi
mov eax, dword [0x45cbdc]
add edx, esi
imul eax, eax, 0x63e546
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, edi
imul edx, edx, 0x5643ad
add eax, edx
mov edx, dword [0x45cbe8]
imul edx, edx, 0x53439e
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x1b2eb4bf
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, 0x1b2eb4bf
imul edi
mov eax, dword [esp + 0xc]
sar edx, 0x14
add eax, edx
mov esi, edx
shr esi, 0x1f
add esi, eax
mov eax, 0x7a2fd6e1
imul edi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
test ebx, ebx
mov dword [str._r_____r____], esi
je 0x40e7d9
mov esi, dword [0x45cbe8]
mov eax, 0xa1093dc9
imul esi
mov edi, esi
imul edi, edi, 0x41d422
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
mov dword [esp + 0xc], eax
mov eax, 0x6262bd7d
imul esi
mov eax, dword [esp + 0xc]
mov esi, dword [0x45cbe0]
sar edx, 0x15
add eax, edx
mov edi, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0x640b17
shr edi, 0x1f
add edi, eax
add edi, edx
mov eax, 0x4f7fd81
imul esi
imul esi, esi, 0x670b79
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x944]
pop edi
mov dword [0x45cbd8], eax
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0042fd0d
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45cbd4]
mov edi, dword [0x45cbc8]
lea esi, [edi + edx]
mov eax, 0x3e13b50f
imul esi, esi, 0x670b79
imul dword [str._r_____r____]
sar edx, 0x14
add esi, edx
mov ecx, edx
mov edx, dword [0x45cbe4]
mov eax, 0x1b2eb4bf
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45cbd8]
sub ecx, eax
mov eax, 0x7a2fd6e1
imul esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xa3c4e0d7
imul esi
add edx, esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x20]
sub ecx, eax
mov eax, dword [str._r_____r____]
imul eax, eax, 0x640b17
add ecx, eax
mov dword [0x45cbe4], ecx
mov dword [esp + 0x10], edx
jmp 0x40ec25