Function at 0x404993
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
push edi
mov dword [ebp - 0x654], ecx
mov byte [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x43c], 0
mov ecx, 0x8a
xor eax, eax
lea edi, [ebp - 0x438]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 4], 0
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
jne 0x404a1f
xor eax, eax
jmp 0x404c30
push 0x5c
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404a40
mov edx, dword [ebp - 4]
mov byte [edx], 0
push 0x5c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404a61
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
push 0x5c
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404a82
mov eax, dword [ebp - 4]
mov byte [eax], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
jne 0x404aa1
xor eax, eax
jmp 0x404c30
mov dword [ebp - 0x43c], 0x22c
lea ecx, [ebp - 0x43c]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
je 0x404c1d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x434], eax
je 0x404bff
push str.DNF.exe
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x404b19
push str.xclient.exe
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x404bff
mov byte [ebp - 0x650], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x64f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp - 0x434]
push edx
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
je 0x404b75
push 0x208
lea eax, [ebp - 0x650]
push eax
push 0
mov ecx, dword [ebp - 0x448]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x404b75
jmp 0x404b93
push 0x208
lea edx, [ebp - 0x650]
push edx
mov eax, dword [ebp - 0x434]
push eax
mov ecx, dword [ebp - 0x654]
call fcn.004048b0
movsx ecx, byte [ebp - 0x650]
test ecx, ecx
je 0x404be9
push 0x5c
lea edx, [ebp - 0x650]
push edx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404bbf
mov eax, dword [ebp - 4]
mov byte [eax], 0
push 0x208
lea ecx, [ebp - 0x650]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x404be9
mov dword [ebp - 0x444], 1
cmp dword [ebp - 0x448], 0
je 0x404bff
mov eax, dword [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x43c]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x440], eax
jmp 0x404ac4
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x444]
pop edi
mov esp, ebp
pop ebp
ret