Function at 0x40dc80
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446110
mov eax, dword fs:[0]
push eax
sub esp, 0x31c
mov eax, dword [0x45c3a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
push 0
push 2
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x68], 0
mov byte [ebp - 0x2b1], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x2bc], esi
cmp esi, 0xffffffff
jne 0x40dd24
lea ecx, [ebp - 0x2d0]
call fcn.0041bb74
push 0x458a00
lea eax, [ebp - 0x2d0]
push eax
call fcn.0041de2b
push 0x228
lea eax, [ebp - 0x2ac]
push 0
push eax
mov dword [ebp - 0x2b0], 0x22c
call fcn.00427e80
add esp, 0xc
lea eax, [ebp - 0x2b0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40dd72
lea ecx, [ebp - 0x2f4]
call fcn.0041bb74
push 0x458a00
lea eax, [ebp - 0x2f4]
push eax
call fcn.0041de2b
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x40dd80
lea eax, [ebp - 0x28c]
push str.EXPLORER.EXE
push eax
call fcn.0041bcd7
add esp, 8
test eax, eax
jne 0x40ddb1
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x2a8]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40ddb1
cmp dword [ebp - 0x18], edi
je 0x40ddc1
lea eax, [ebp - 0x2b0]
push eax
push esi
call ebx
test eax, eax
jne 0x40dd80
jmp 0x40ddc8
mov byte [ebp - 0x2b1], 1
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
cmp byte [ebp - 0x2b1], 0
mov dword [ebp - 0x2bc], 0xffffffff
jne 0x40de00
lea ecx, [ebp - 0x30c]
call fcn.0041bb74
push 0x458a00
lea eax, [ebp - 0x30c]
push eax
call fcn.0041de2b
push dword [ebp - 0x2a8]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x2b8], esi
test esi, esi
jne 0x40de3b
lea ecx, [ebp - 0x324]
call fcn.0041bb74
push 0x458a00
lea eax, [ebp - 0x324]
push eax
call fcn.0041de2b
lea eax, [ebp - 0x6c]
push eax
push 2
push esi
mov dword [ebp - 0x6c], 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40de6f
lea ecx, [ebp - 0x2e8]
call fcn.0041bb74
push 0x458a00
lea eax, [ebp - 0x2e8]
push eax
call fcn.0041de2b
push esi
call edi
lea eax, [ebp - 0x64]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0x6c]
mov dword [ebp - 0x2b8], 0
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push dword [ebp - 0x6c]
mov esi, eax
call edi
test esi, esi
jne 0x40debb
lea ecx, [ebp - 0x318]
call fcn.0041bb74
push 0x458a00
lea eax, [ebp - 0x318]
push eax
call fcn.0041de2b
push 1
push dword [ebp - 0x64]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x40deea
lea ecx, [ebp - 0x300]
call fcn.0041bb74
push 0x458a00
lea eax, [ebp - 0x300]
push eax
call fcn.0041de2b
push 0x40
lea eax, [ebp - 0x5c]
push 0
push eax
mov dword [ebp - 0x60], 0x44
call fcn.00427e80
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push dword [ebp - 0x68]
push 0x400
push 1
push 0
push 0
push dword [ebp - 0x2c4]
push 0
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x40df91
lea ecx, [ebp - 0x2dc]
call fcn.0041bb74
push 0x458a00
lea eax, [ebp - 0x2dc]
push eax
call fcn.0041de2b
mov eax, dword [ebp - 0x2bc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x40df5e
push eax
call esi
mov eax, dword [ebp - 0x2b8]
test eax, eax
je 0x40df6b
push eax
call esi
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x40df75
push eax
call esi
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x40df83
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, 0x40df89
ret
push dword [ebp - 0x7c]
call edi
push dword [ebp - 0x78]
call edi
push dword [ebp - 0x64]
call edi
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041b8d4
mov esp, ebp
pop ebp
ret 8