Function at 0x405ed0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xe84
mov eax, dword [0x45f540]
xor eax, esp
mov dword [esp + 0xe80], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x45dbd8]
mov eax, dword [esp + 0xe98]
mov dword [esp + 0x1c], eax
mov eax, 0x6386b3b9
imul ecx
imul ecx, ecx, 0x5e30a0c
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbd0]
mov esi, eax
mov eax, 0x31b1a317
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x3409f8e
sub esi, eax
add esi, edx
mov edx, dword [0x45dbdc]
mov eax, 0x56f92285
imul edx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x45dbc8]
imul ecx, ecx, 0x3e67c56
mov edi, dword [0x45dbe4]
add esi, ecx
sub esi, edi
push 0
sub esi, 0x2927ae2
push 2
mov dword [0x45dbd0], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [0x45dbcc]
mov ebx, eax
mov esi, dword [0x45dbd4]
mov eax, 0x61b9fbc5
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x830d168d
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
mov ebp, eax
imul edx, edx, 0x3409f8e
mov eax, ecx
imul eax, eax, 0x35f16dd
sub ebp, edi
add ebp, edx
add ebp, eax
mov eax, 0x56f92285
imul esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], ebx
sub ebp, eax
mov eax, 0x56f92285
imul ecx
mov ecx, dword [0x45dbdc]
sar edx, 0x19
add ebp, edx
mov esi, edx
mov edx, ecx
imul edx, edx, 0x3e67c56
shr esi, 0x1f
add esi, ebp
add esi, edx
mov eax, 0x830d168d
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x3f96a7f5
imul ecx
imul ecx, ecx, 0x35f16dd
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, dword [0x45dbe0]
mov edx, dword [0x45dbd8]
mov dword [str._r_____r____], esi
imul esi, esi, 0x7cea51d
imul edx, edx, 0x3e67c56
sub ebp, eax
add ebp, esi
add ecx, ebp
lea eax, [edx + ecx - 0x2927ae2]
lea ecx, [esp + 0xe8]
push ecx
push ebx
mov dword [esp + 0xf0], 0x128
xor edi, edi
mov dword [0x45dbd4], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40608c
or eax, 0xffffffff
jmp 0x4064d8
mov ecx, dword [0x45dbd0]
mov esi, dword [0x45dbc8]
mov eax, 0x6386b3b9
imul esi, esi, 0x2927ae2
imul ecx
sar edx, 0x18
mov ebx, edx
add esi, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45dbe0]
mov edx, esi
imul edx, edx, 0x1fc96d8
sub ebx, edx
mov eax, 0x4bee9027
imul ecx
sar edx, 0x18
add ebx, edx
mov ebp, edx
mov eax, 0x187fbc47
imul ecx
sar edx, 0x17
shr ebp, 0x1f
add ebp, ebx
mov ebx, dword [0x45dbe4]
add ebp, edx
mov ecx, edx
mov eax, 0x8345522b
imul ebx
add edx, ebx
sar edx, 0x19
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, ebp
add eax, edx
sub ecx, eax
mov dword [0x45dbc8], ecx
xor eax, eax
lea ebx, [ebx]
mov dl, byte [esp + eax + 0x10c]
mov byte [esp + eax + 0x210], dl
inc eax
test dl, dl
jne 0x406110
mov edx, dword [0x45dbd4]
imul ecx, ecx, 0x3e828c7
mov ebx, dword [0x45dbe8]
mov eax, 0x7cf2e973
imul edx
sub edx, dword [0x45dbd4]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, ebx
imul ebp, ebp, 0x2927ae2
sub eax, ebp
add eax, ecx
mov ebp, eax
mov eax, 0x3f96a7f5
imul esi
imul esi, esi, 0x406a069
sar edx, 0x18
mov ecx, edx
add ebp, edx
mov eax, 0x9d6ba841
imul ebx
shr ecx, 0x1f
add edx, ebx
add ecx, ebp
add ecx, esi
sar edx, 0x19
add ecx, edx
mov esi, edx
mov eax, 0x4bee9027
imul ebx
sar edx, 0x18
mov eax, edx
shr esi, 0x1f
add esi, ecx
mov ecx, dword [esp + 0x1c]
shr eax, 0x1f
add eax, edx
push ecx
lea edx, [esp + 0x214]
sub esi, eax
push edx
mov dword [0x45dbd8], esi
call fcn.0043acde
mov ebx, dword [0x45dbe4]
mov esi, dword [0x45dbe0]
add esp, 8
test eax, eax
jne 0x40624b
mov ecx, dword [0x45dbd4]
mov eax, 0x830d168d
imul ecx
add edx, ecx
mov edi, ebx
imul edi, edi, 0x2927ae2
sar edx, 0x19
add edi, edx
mov ebp, edx
mov edx, dword [0x45dbcc]
mov eax, 0x3f96a7f5
imul edx
mov eax, dword [0x45dbe8]
sar edx, 0x18
imul eax, eax, 0x3409f8e
shr ebp, 0x1f
add ebp, edi
add ebp, edx
mov edi, edx
mov edx, esi
imul edx, edx, 0x35f16dd
shr edi, 0x1f
add edi, ebp
sub edi, eax
add edi, edx
mov eax, 0x8345522b
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
add edi, edx
mov edx, dword [str._r_____r____]
shr eax, 0x1f
add eax, edi
sub eax, edx
add eax, 0x293659b
mov dword [0x45dbcc], eax
mov edi, 1
mov ecx, dword [0x45dbd0]
imul esi, esi, 0x1fc96d8
mov ebp, dword [0x45dbc8]
mov eax, 0x6386b3b9
imul ebp, ebp, 0x2927ae2
imul ecx
sar edx, 0x18
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
sub eax, esi
mov ebp, eax
mov eax, 0x4bee9027
imul ecx
sar edx, 0x18
add ebp, edx
mov esi, edx
mov eax, 0x187fbc47
imul ecx
sar edx, 0x17
shr esi, 0x1f
mov ecx, edx
add esi, ebp
mov ebp, dword [esp + 0x18]
add esi, edx
mov eax, 0x8345522b
imul ebx
add edx, ebx
sar edx, 0x19
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, esi
add eax, edx
sub ecx, eax
mov dword [0x45dbc8], ecx
lea ecx, [esp + 0xe8]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406460
mov eax, edi
shl eax, 6
lea edx, [esp + 0x10c]
lea ebx, [esp + eax + 0x210]
sub eax, edx
lea esi, [esp + eax + 0x210]
mov dword [esp + 0x10], esi
jmp 0x406300
lea eax, [esp + 0x10c]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x406307
mov ecx, dword [0x45dbd4]
mov ebp, dword [0x45dbe4]
mov eax, 0x830d168d
imul ebp, ebp, 0x2927ae2
imul ecx
add edx, ecx
sar edx, 0x19
add ebp, edx
mov eax, edx
mov edx, dword [0x45dbcc]
shr eax, 0x1f
add eax, ebp
mov dword [esp + 0x14], eax
mov eax, 0x3f96a7f5
imul edx
mov eax, dword [esp + 0x14]
sar edx, 0x18
add eax, edx
mov ebp, edx
mov edx, dword [0x45dbe0]
shr ebp, 0x1f
imul edx, edx, 0x35f16dd
add ebp, eax
mov eax, dword [0x45dbe8]
imul eax, eax, 0x3409f8e
sub ebp, eax
add ebp, edx
mov eax, 0x8345522b
imul ecx
add edx, ecx
mov ecx, dword [esp + 0x1c]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [str._r_____r____]
add eax, ebp
sub eax, edx
push ecx
add eax, 0x293659b
push ebx
mov dword [0x45dbcc], eax
call fcn.0043acde
add esp, 8
test eax, eax
jne 0x406446
mov ecx, dword [0x45dbcc]
mov edx, dword [0x45dbd0]
mov eax, dword [0x45dbdc]
mov esi, dword [0x45dbe4]
imul eax, eax, 0x2927ae2
lea ebp, [ecx + edx]
imul ebp, ebp, 0x53d3666
add ebp, eax
mov eax, 0x830d168d
imul esi
add edx, esi
sar edx, 0x19
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0x56f92285
imul esi
sar edx, 0x19
add ebp, edx
mov esi, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x539869b
shr esi, 0x1f
add esi, ebp
add esi, edx
mov eax, 0x8345522b
imul ecx
add edx, ecx
mov ecx, dword [esp + 0xf0]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x45dbdc], esi
mov esi, dword [esp + 0x10]
mov dword [esp + edi*4 + 0x20], ecx
inc edi
add ebx, 0x40
add esi, 0x40
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x18]
lea edx, [esp + 0xe8]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x406300
mov ecx, dword [0x45dbe8]
mov eax, dword [0x45dbd0]
mov edx, dword [0x45dbdc]
lea esi, [ecx + eax]
imul edx, edx, 0x2927ae2
imul esi, esi, 0x293659b
sub esi, edx
mov edx, dword [0x45dbcc]
mov eax, 0x31b1a317
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61b9fbc5
imul ecx
mov eax, dword [0x45dbd8]
sar edx, 0x19
imul eax, eax, 0x539869b
mov ecx, edx
add esi, edx
mov edx, dword [0x45dbd4]
imul edx, edx, 0x3409f8e
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
add ecx, eax
push ebp
mov dword [0x45dbe0], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0xe90]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004301cd
add esp, 0xe84
ret