Function at 0x4105d0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9c4
mov eax, dword [0x460640]
xor eax, esp
push ebx
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x9d8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [0x45eccc]
mov dword [esp + 0x24], eax
mov eax, dword [0x45ecd4]
cdq
mov edi, eax
push 1
mov ebx, edx
mov eax, esi
cdq
push 0xeae0c6d3
push ebx
mov ebp, eax
push edi
mov dword [esp + 0xb8], 0x128
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], edx
call fcn.004319f0
mov ecx, dword [esp + 0x1c]
push 1
push 0x86050f76
push ecx
push ebp
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
push 2
push 0xb57eb16
sub ecx, eax
push edx
mov eax, ebp
push eax
mov dword [esp + 0x20], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x10]
push 2
push 0xb57eb16
push ebx
add ecx, eax
push edi
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul esi, esi, 0x140cef57
mov ecx, dword [esp + 0x10]
mov edx, dword [0x45ece8]
sub ecx, eax
imul edx, edx, 0x6b66a94
mov eax, dword [0x45ecdc]
imul eax, eax, 0x5295f78d
sub ecx, esi
add ecx, edx
mov edx, dword [esp + 0x24]
add ecx, eax
mov dword [str._r_____r____], ecx
lea ecx, [esp + 0xa8]
push ecx
push edx
mov dword [esp + 0x28], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4106cc
or eax, 0xffffffff
jmp 0x410b7c
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov ebx, edx
mov edi, eax
push ebx
push edi
call fcn.004319f0
push 1
push 0x5295f78d
push ebx
push edi
mov esi, eax
call fcn.004319f0
mov ecx, dword [0x45eccc]
mov ebx, dword [0x45ece0]
add esi, eax
mov eax, 0x2a215c6f
mul ecx
mov ebp, dword [str._r_____r____]
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece4]
shr ecx, 0x1f
imul edx, edx, 0x6181b446
add esi, ecx
mov ecx, dword [0x45ece8]
mov eax, ebx
imul ecx, ecx, 0x6b66a94
imul eax, eax, 0x140cef57
sub esi, eax
sub esi, ecx
add esi, edx
sub esi, ebp
sub esi, 0x4f64023c
mov dword [0x45eccc], esi
xor eax, eax
mov cl, byte [esp + eax + 0xcc]
mov byte [esp + eax + 0x1d0], cl
inc eax
test cl, cl
jne 0x410750
mov edi, dword [0x45ecdc]
imul ebp, ebp, 0x151f392d
push 1
mov eax, edi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd8]
mov ecx, eax
mov eax, dword [str._r_____r____]
add edx, eax
imul edx, edx, 0x5295f78d
add ecx, edx
mov eax, 0x2a215c6f
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
mov edx, edi
imul edx, edx, 0x140cef57
shr eax, 0x1f
sub ecx, eax
sub ecx, edx
sub ecx, ebp
lea eax, [ecx + ebx - 0x6181b446]
mov ecx, dword [esp + 0x9d8]
mov dword [0x45ecd4], eax
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x17], dl
cmp dl, byte [ecx]
jne 0x410811
mov cl, dl
test cl, cl
je 0x41080d
mov dl, byte [eax + 1]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x17], dl
cmp dl, byte [ecx + 1]
jne 0x410811
mov edx, ecx
mov cl, byte [esp + 0x17]
add edx, 2
add eax, 2
test cl, cl
mov dword [esp + 0x18], edx
jne 0x4107d5
xor eax, eax
jmp 0x410816
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4108ab
mov eax, dword [0x45ece4]
cdq
mov dword [esp + 0x18], eax
push 0xfffffffffffffffe
mov dword [esp + 0x20], edx
mov eax, esi
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd0]
mov ecx, dword [esp + 0x1c]
add edx, esi
imul edx, edx, 0x79faf08a
push 1
push 0xeae0c6d3
sub eax, edx
mov edx, dword [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push 2
add ecx, eax
mov eax, dword [esp + 0x20]
push 0xb57eb16
push eax
push edx
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul ebx, ebx, 0x2c857103
imul edi, edi, 0x6181b446
mov ecx, dword [esp + 0x10]
add ecx, eax
sub ecx, ebx
add ecx, edi
mov dword [0x45ecdc], ecx
mov dword [esp + 0x20], 1
mov eax, dword [0x45ecd8]
cdq
mov esi, eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov edi, edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd4]
mov ebx, eax
mov eax, dword [0x45ecc8]
add eax, ecx
imul eax, eax, 0x242d3a05
sub ebx, eax
mov eax, dword [str._r_____r____]
push 1
cdq
push 0xb09bfdc4
push edx
push eax
call fcn.004319f0
push 1
push 0xeae0c6d3
push edi
push esi
add ebx, eax
call fcn.004319f0
push 1
push 0x86050f76
push edi
push esi
sub ebx, eax
call fcn.004319f0
sub ebx, eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0xa8]
push edx
sub ebx, ebp
push eax
mov dword [0x45ece4], ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x410aea
mov eax, dword [esp + 0x20]
shl eax, 6
lea ecx, [esp + eax + 0x1d0]
lea edx, [esp + 0xcc]
sub eax, edx
lea eax, [esp + eax + 0x1d0]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], eax
mov edi, edi
mov esi, dword [0x45ecd0]
mov eax, esi
cdq
mov ebp, eax
mov eax, dword [0x45ece4]
push 1
mov ebx, edx
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
mov ecx, eax
mov eax, 0x4d7937c3
mul esi
push 1
push 0xebf310a9
shr edx, 0x1e
push ebx
mov edi, edx
push ebp
sub edi, ecx
call fcn.004319f0
mov edx, dword [0x45ece0]
add edi, eax
imul edx, edx, 0x7f4ea4e2
mov eax, dword [0x45ecc8]
imul eax, eax, 0x6181b446
sub edi, edx
add edi, eax
mov eax, 0x2a01e433
imul esi
sar edx, 0x1c
mov esi, edx
shr esi, 0x1f
add edi, edx
add esi, edi
mov dword [0x45ecc8], esi
lea eax, [esp + 0xcc]
lea esp, [esp]
mov cl, byte [eax]
mov edx, dword [esp + 0x10]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4109e0
mov edi, dword [esp + 0x9d8]
mov eax, dword [esp + 0x18]
lea esp, [esp]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x410a24
test cl, cl
je 0x410a20
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x410a24
add eax, 2
add edi, 2
test cl, cl
jne 0x410a00
xor eax, eax
jmp 0x410a29
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410ad0
mov eax, dword [0x45ecdc]
push 2
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
push 0xfffffffffffffffe
push 0x4f64023c
push ebx
push ebp
mov edi, eax
call fcn.004319f0
imul esi, esi, 0x5295f78d
mov ecx, dword [0x45ecd8]
mov ebx, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x6b66a94
mov edx, ecx
imul edx, edx, 0xb57eb16
sub ebx, edi
add ebx, eax
add ebx, edx
mov eax, 0x2a01e433
imul ecx
mov ecx, dword [esp + 0xb0]
sar edx, 0x1c
add ebx, edx
mov eax, edx
mov edx, dword [esp + 0x18]
shr eax, 0x1f
add eax, ebx
mov ebx, dword [0x45ece4]
add eax, esi
sub eax, ebx
sub eax, 0x6181b446
mov dword [0x45ecd0], eax
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x28], ecx
mov ecx, dword [esp + 0x10]
inc eax
mov dword [esp + 0x20], eax
mov eax, 0x40
add edx, eax
add ecx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x24]
lea edx, [esp + 0xa8]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x410960
mov esi, dword [0x45ece8]
mov eax, esi
cdq
mov edi, eax
mov eax, dword [0x45ecd4]
push 1
mov ebp, edx
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
push 0xfffffffffffffffe
push 0x140cef57
push ebp
push edi
mov ebx, eax
call fcn.004319f0
push 2
push 0x6b66a94
push ebp
sub eax, ebx
push edi
mov ebx, eax
call fcn.004319f0
imul esi, esi, 0x6181b446
mov ecx, dword [0x45ece0]
add ebx, eax
mov eax, 0x2a215c6f
mul ecx
mov eax, ecx
imul ecx, ecx, 0x242d3a05
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x151f392d
shr eax, 0x1f
add ebx, eax
mov eax, dword [esp + 0x24]
sub ebx, esi
sub ebx, edx
sub ebx, ecx
push eax
mov dword [0x45ecd8], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x9d0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043180d
add esp, 0x9c4
ret