Function at 0x419c0c
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
mov dword [ebp - 0x870], esi
mov dword [ebp - 0x86c], edi
call fcn.004244be
test al, al
jne 0x419ca9
xor ebx, ebx
cmp dword [esi + 0x7840], ebx
jne 0x419fa4
mov eax, dword [ebp + 8]
mov dword [esi + 0x7840], 1
mov dword [0x5a2244], eax
mov eax, dword [ebp + 0xc]
mov dword [0x5a223c], eax
mov eax, dword [ebp + 0x18]
push 0x5a2238
push dword [ebp + 0x10]
mov dword [0x5a2260], eax
mov eax, dword [ebp + 0x1c]
mov dword [0x5a2238], 0x30
mov dword [0x5a224c], edi
mov dword [0x5a2264], ebx
mov dword [0x5a2254], eax
push dword [esi + 0x783c]
push dword [0x5a22a4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x419fa4
cmp byte [0x5a2268], 0
jne 0x419fa4
push 0x228
xor ebx, ebx
mov dword [ebp - 0x438], 0x22c
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.004f5a90
push 0x424
lea eax, [ebp - 0x85c]
mov dword [ebp - 0x860], 0x428
push ebx
push eax
call fcn.004f5a90
add esp, 0x18
mov esi, ebx
mov dword [ebp - 0x868], esi
push edi
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x208
mov edi, eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004f5a90
add esp, 0xc
test edi, edi
je 0x419de6
cmp edi, 0xffffffff
je 0x419de6
lea eax, [ebp - 0x860]
push eax
push edi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x419db9
mov eax, dword [ebp - 0x86c]
cmp dword [ebp - 0x858], eax
jne 0x419dac
cmp word [ebp - 0x20c], bx
jne 0x419d9d
cmp word [ebp - 0x640], bx
lea ecx, [ebp - 0x840]
lea eax, [ebp - 0x640]
cmove eax, ecx
push eax
mov dword [ebp - 0x864], eax
call fcn.004e5a3d
mov dword [esp], 0x522e88
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x419d9d
push 0x104
push dword [ebp - 0x864]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x419dc3
cmp dword [ebp - 0x844], eax
je 0x419dc3
lea eax, [ebp - 0x860]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x419d3a
jmp 0x419ddf
cmp word [ebp - 0x640], bx
lea esi, [ebp - 0x640]
lea eax, [ebp - 0x840]
cmove esi, eax
mov dword [ebp - 0x868], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 0x20c], bx
jne 0x419e52
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x419e52
cmp edi, 0xffffffff
je 0x419e52
lea eax, [ebp - 0x438]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x419e2c
mov eax, dword [ebp - 0x86c]
cmp dword [ebp - 0x430], eax
je 0x419e32
lea eax, [ebp - 0x438]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x419e11
jmp 0x419e4b
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x419e85
cmp word [ebp - 0x20c], bx
je 0x419e85
lea eax, [ebp - 0x20c]
push eax
call fcn.004e5a5b
push eax
call fcn.004e49f8
pop ecx
pop ecx
test al, al
mov ecx, str._Check_plugins_in__FARHOME_Plugins_folder_
cmove ecx, esi
mov esi, ecx
mov dword [ebp - 0x868], esi
mov byte [0x5a2268], 1
test esi, esi
je 0x419ea6
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x419e95
sub ecx, edx
sar ecx, 1
jmp 0x419ea8
mov ecx, ebx
mov edi, dword [ebp - 0x870]
lea eax, [edi + 0xa90]
mov edx, eax
mov dword [ebp - 0x874], eax
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x419ebf
sub edx, esi
lea esi, [ebp - 0x20c]
lea eax, [esi + 2]
sar edx, 1
mov dword [ebp - 0x864], eax
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x419edd
sub esi, dword [ebp - 0x864]
lea eax, [edi + 0xa30]
mov edi, eax
mov dword [ebp - 0x878], eax
sar esi, 1
lea eax, [edi + 2]
mov dword [ebp - 0x864], eax
mov ax, word [edi]
add edi, 2
cmp ax, bx
jne 0x419f07
sub edi, dword [ebp - 0x864]
sar edi, 1
push 2
lea eax, [esi + edi]
add eax, edx
lea esi, [ecx + 0xff]
add esi, eax
push esi
call fcn.004e1c42
mov edi, eax
mov edx, 0x514870
mov eax, dword [ebp - 0x868]
mov ecx, 0x524514
test eax, eax
cmove ecx, edx
cmovne edx, eax
push ecx
push edx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x86c]
push 0xa6
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x874]
push dword [ebp - 0x878]
push str._s_received_wrong_version_packet__n_s_n_nCommandID:__i__Version:__i__ReqVersion:__i__PID:__u_n_s_n_s_n_sPlease_check_installation_files
push esi
push edi
call fcn.004e22e7
mov esi, dword [ebp - 0x870]
push 1
push 0xffffffffffffffff
lea eax, [esi + 0x49f4]
push eax
push 0x40
push edi
call fcn.00421ef1
add esp, 0x4c
push edi
call fcn.004e1bea
pop ecx
mov dword [esi + 0x7840], ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret 0x18