Function at 0x45e934
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
call fcn.0045aa10
mov esi, eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45e96b
mov ebx, 0xffffff9b
jmp 0x45eb6d
mov dword [ebp - 0x1a8], 0x128
lea eax, [ebp - 0x1a8]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x45e990
mov ebx, 0xffffff91
jmp 0x45eb6d
push 0x5eecff
lea eax, [ebp - 0x184]
push eax
call fcn.004d30a0
add esp, 8
test eax, eax
jne 0x45e9ce
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x1a0]
push ecx
call fcn.0045a914
add esp, 8
test eax, eax
je 0x45e9ce
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jne 0x45e9ce
mov edi, dword [ebp - 0x1a0]
jmp 0x45e9df
lea eax, [ebp - 0x1a8]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x45e990
push esi
call fcn.0045aa4c
pop ecx
mov dword [ebp - 4], eax
push edi
push 0
push 0x2000000
call sub.KERNEL32.dll_OpenProcess
mov edi, eax
lea edx, [ebp - 0xc]
push edx
push 0x201eb
push edi
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
jne 0x45ea15
mov ebx, 0xffffff87
jmp 0x45eb6d
lea eax, [ebp - 0x14]
push eax
push 0x5eed0c
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x45ea33
mov ebx, 0xffffff7d
jmp 0x45eb6d
mov dword [ebp - 0x80], 1
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 2
push edx
push 1
push 1
push 0
push 0x2000000
mov ecx, dword [ebp - 0xc]
push ecx
call sub.ADVAPI32.dll_DuplicateTokenEx
push 4
push esi
push 0xc
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_SetTokenInformation
push 0
push 0
push 0x10
lea edx, [ebp - 0x80]
push edx
push 0
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.dll_AdjustTokenPrivileges
test eax, eax
jne 0x45ea96
mov ebx, 0xffffff73
jmp 0x45eb6d
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x514
push 1
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x18]
push eax
push edx
mov ebx, 0x30
call fcn.0045a968
add esp, 0xc
test eax, eax
je 0x45eac3
or ebx, 0x400
jmp 0x45eac8
xor ecx, ecx
mov dword [ebp - 0x18], ecx
push 0x44
push 0
lea eax, [ebp - 0x70]
push eax
call fcn.004d2d9c
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x68], 0x5eed1d
mov esi, dword [ebp + 0x10]
add esp, 0xc
and esi, 0x100
test esi, esi
je 0x45eafa
mov dword [ebp - 0x68], 0x5eed2d
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004d2d9c
add esp, 0xc
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x70]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp - 0x18]
push edx
push ebx
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_CreateProcessAsUserA
test eax, eax
jne 0x45eb3b
mov ebx, 0xffffff2e
jmp 0x45eb4c
xor ebx, ebx
test esi, esi
je 0x45eb4c
push 0xffffffffffffffff
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
push edi
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret