Function at 0x405967
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
push edi
mov dword [ebp - 0x654], ecx
mov byte [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x43c], 0
mov ecx, 0x8a
xor eax, eax
lea edi, [ebp - 0x438]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 4], 0
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
jne 0x4059f3
xor eax, eax
jmp 0x405bf5
push 0x5c
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405a14
mov edx, dword [ebp - 4]
mov byte [edx], 0
push 0x5c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405a35
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
push 0x5c
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405a56
mov eax, dword [ebp - 4]
mov byte [eax], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
jne 0x405a75
xor eax, eax
jmp 0x405bf5
mov dword [ebp - 0x43c], 0x22c
lea ecx, [ebp - 0x43c]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
je 0x405be2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x434], eax
je 0x405bc4
push str.DNF.exe
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x405b1f
push str.xclient.exe
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x405b1f
push str.xyclient.exe
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x405b1f
push str.client.exe
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x405bc4
mov byte [ebp - 0x650], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x64f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 0x434]
push ecx
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
je 0x405b7b
push 0x208
lea edx, [ebp - 0x650]
push edx
push 0
mov eax, dword [ebp - 0x448]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x405b7b
jmp 0x405b99
push 0x208
lea ecx, [ebp - 0x650]
push ecx
mov edx, dword [ebp - 0x434]
push edx
mov ecx, dword [ebp - 0x654]
call fcn.0040577c
movsx eax, byte [ebp - 0x650]
test eax, eax
je 0x405bae
mov dword [ebp - 0x444], 1
cmp dword [ebp - 0x448], 0
je 0x405bc4
mov ecx, dword [ebp - 0x448]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x43c]
push edx
mov eax, dword [ebp - 0x210]
push eax
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x440], eax
jmp 0x405a98
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x444]
pop edi
mov esp, ebp
pop ebp
ret