Function at 0x40de00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441fd6
mov eax, dword fs:[0]
push eax
sub esp, 0x6cc
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x610], 0
push str.pubwin
push str.pubwinClient.exe
lea ecx, [ebp - 0x6d0]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x698]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6d0]
call fcn.0040e5b0
push 0x446a9c
push str.Clsmn.exe
lea ecx, [ebp - 0x60c]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x690]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60c]
call fcn.0040e5b0
push 0x446a8c
push str.UDO.exe
lea ecx, [ebp - 0x5d4]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x688]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d4]
call fcn.0040e5b0
push 0x446a80
push str.ssp.exe
lea ecx, [ebp - 0x59c]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x680]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x59c]
call fcn.0040e5b0
push str.hxykt
push str.RunMe.exe
lea ecx, [ebp - 0x564]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x678]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x564]
call fcn.0040e5b0
push 0x446a60
push str.rwyNCMc.exe
lea ecx, [ebp - 0x52c]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x670]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x52c]
call fcn.0040e5b0
push 0x446a50
push str.RsClient.exe
lea ecx, [ebp - 0x4f4]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x668]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f4]
call fcn.0040e5b0
push 0x446a3c
push str.ClientPrc.exe
lea ecx, [ebp - 0x4bc]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x660]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call fcn.0040e5b0
push 0x446a28
push str.sdfox.exe
lea ecx, [ebp - 0x484]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x658]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x484]
call fcn.0040e5b0
push 0x446a18
push str.yqsclient.exe
lea ecx, [ebp - 0x44c]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x650]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44c]
call fcn.0040e5b0
push 0x446a04
push str.mprexe.exe
lea ecx, [ebp - 0x414]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x648]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.0040e5b0
push str.hywd
push str.ClientUI.exe
lea ecx, [ebp - 0x3dc]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 0xb
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x640]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3dc]
call fcn.0040e5b0
push str.wbglds
push str.ClientLock.exe
lea ecx, [ebp - 0x3a4]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x638]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a4]
call fcn.0040e5b0
push 0x4469c4
push str.yebarclient.exe
lea ecx, [ebp - 0x36c]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x630]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x36c]
call fcn.0040e5b0
push str.hxykt
push str.snr.exe
lea ecx, [ebp - 0x334]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x628]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.0040e5b0
push 0x4469a8
push str.bgsRecvClient.exe
lea ecx, [ebp - 0x2fc]
call fcn.0040ff20
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 4], 0xf
mov ecx, dword [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x620]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0040e5b0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x40e56d
mov dword [ebp - 0x244], 0x22c
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x40e56d
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.0040b740
jmp 0x40e469
push 0
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x24c]
call fcn.0040fe40
lea eax, [ebp - 0x614]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x11c
call fcn.004227f0
push eax
lea ecx, [ebp - 0x24c]
call fcn.004232b0
movzx ecx, al
test ecx, ecx
je 0x40e552
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.004064c0
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x2c4]
push ecx
lea edx, [ebp - 0x268]
push edx
call fcn.0041bc80
add esp, 8
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2c4]
call fcn.00406570
lea ecx, [ebp - 0x24c]
call fcn.0040fe20
mov ecx, eax
call fcn.004063b0
push eax
lea ecx, [ebp - 0x268]
call fcn.004063b0
push eax
call fcn.0042cf9f
add esp, 8
test eax, eax
jne 0x40e53b
lea ecx, [ebp - 0x24c]
call fcn.0040fe20
add eax, 0x1c
push eax
mov ecx, dword [ebp + 8]
call fcn.00405ef0
mov eax, dword [ebp - 0x610]
or eax, 1
mov dword [ebp - 0x610], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.00406130
mov eax, dword [ebp + 8]
jmp 0x40e58c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.00406130
jmp 0x40e455
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x248], eax
jmp 0x40e431
push str.else
mov ecx, dword [ebp + 8]
call fcn.00405ff0
mov eax, dword [ebp - 0x610]
or eax, 1
mov dword [ebp - 0x610], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a65e
mov esp, ebp
pop ebp
ret 4