Function at 0x405f66
Capabilities:
Enumerate process modules
Enumerate processes
Get session user name

Disassembly:
push ebp
lea ebp, [esp - 0x8cc]
mov eax, 0x8868
call fcn.00413bc0
mov eax, dword [0x41f014]
xor eax, ebp
mov dword [ebp + 0x8c8], eax
lea eax, [ebp + 0x68]
push eax
push 0x8000
lea eax, [ebp - 0x7f9c]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x406243
push esi
push edi
call fcn.00405f03
mov edi, dword [ebp + 0x68]
shr edi, 2
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x80], 0
je 0x406199
mov eax, dword [ebp + 0x80]
cmp dword [ebp + eax*4 - 0x7f9c], 0
je 0x406187
push 5
pop ecx
push 0x1f4
lea eax, [ebp + 0x4cc]
push 0
mov esi, str._unknown_
lea edi, [ebp + 0x4b8]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00407490
push 5
pop ecx
push 0x1f4
lea eax, [ebp + 0x2c4]
push 0
mov esi, str._unknown_
lea edi, [ebp + 0x2b0]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00407490
push 5
pop ecx
mov esi, str._unknown_
lea edi, [ebp + 0x6c0]
rep movsd dword es:[edi], dword [esi]
push 0x1f4
xor esi, esi
lea eax, [ebp + 0x6d4]
push esi
push eax
call fcn.00407490
mov eax, dword [ebp + 0x80]
add esp, 0x24
push dword [ebp + eax*4 - 0x7f9c]
mov dword [ebp + 0x7c], esi
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, esi
je 0x40610c
lea eax, [ebp + 0x64]
push eax
push 4
lea eax, [ebp + 0x74]
push eax
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x406184
mov esi, 0x104
push esi
lea eax, [ebp + 0x4b8]
push eax
push dword [ebp + 0x74]
push edi
call sub.PSAPI.DLL_GetModuleBaseNameW
push esi
lea eax, [ebp + 0x2b0]
push eax
push dword [ebp + 0x74]
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp + 0x78]
push eax
push 0xe
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40610c
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push 0x208
lea eax, [ebp + 0x6c0]
push 0
push eax
call fcn.00407490
add esp, 0xc
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x6c0]
push eax
mov dword [ebp + 0x70], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4060fd
cmp dword [ebp + 0x70], 0
jbe 0x4060fd
mov dword [ebp + 0x7c], 1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x4b8]
push eax
call fcn.00406955
mov ecx, dword [ebx]
imul ecx, ecx, 0x14
mov dword [ecx + ebx + 0xc], eax
mov eax, dword [ebx]
mov ecx, dword [ebp + 0x80]
imul eax, eax, 0x14
mov ecx, dword [ebp + ecx*4 - 0x7f9c]
mov dword [eax + ebx + 4], ecx
mov eax, dword [ebx]
imul eax, eax, 0x14
and dword [eax + ebx + 8], 0
lea eax, [ebp + 0x2b0]
push eax
call fcn.00406955
pop ecx
pop ecx
mov ecx, dword [ebx]
imul ecx, ecx, 0x14
cmp dword [ebp + 0x7c], 0
mov dword [ecx + ebx + 0x10], eax
je 0x406167
lea eax, [ebp + 0x6c0]
push eax
jmp 0x40616c
push str._unknown_
call fcn.00406955
pop ecx
mov ecx, dword [ebx]
inc ecx
imul ecx, ecx, 0x14
mov dword [ecx + ebx], eax
inc dword [ebx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 0x6c]
inc dword [ebp + 0x80]
cmp dword [ebp + 0x80], edi
jb 0x405fc2
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp + 0x80], eax
jne 0x4061b4
xor eax, eax
jmp 0x406241
lea eax, [ebp + 0x84]
push eax
push dword [ebp + 0x80]
mov dword [ebp + 0x84], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40622e
xor eax, eax
test edi, edi
jbe 0x40621c
lea ecx, [ebx + 4]
mov edx, dword [ebp + 0x8c]
cmp edx, dword [ecx]
je 0x4061ef
inc eax
add ecx, 0x14
cmp eax, edi
jb 0x4061db
jmp 0x40621c
imul eax, eax, 0x14
lea esi, [eax + ebx]
mov eax, dword [ebp + 0x9c]
mov dword [esi + 8], eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40620c
push eax
call fcn.00406b2f
pop ecx
lea eax, [ebp + 0xa8]
push eax
call fcn.00406955
pop ecx
mov dword [esi + 0xc], eax
lea eax, [ebp + 0x84]
push eax
push dword [ebp + 0x80]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4061d2
push dword [ebp + 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp + 0x8c8]
xor ecx, ebp
call fcn.004062b8
add ebp, 0x8cc
leave
ret