Function at 0x100061e3
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x1003dd60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea ebx, [ecx + 0xc]
mov eax, dword [ebx]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x25c], ecx
je 0x10006213
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], edi
xor esi, esi
push edi
inc esi
push 2
mov dword [ebp - 0x23c], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x24c], eax
je 0x1000655d
push 0x228
lea eax, [ebp - 0x22c]
push edi
push eax
mov dword [ebp - 0x250], esi
call fcn.1001ade0
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x24c]
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x10006547
cmp dword [ebp - 0x250], edi
je 0x1000654f
push dword [ebp - 0x228]
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
cmp eax, edi
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x238], edi
je 0x100062b1
lea ecx, [ebp - 0x238]
push ecx
push 0xa
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
cmp esi, edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x240], edi
je 0x10006327
lea eax, [ebp - 0x234]
push eax
push edi
push edi
push 1
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, eax
cmp esi, edi
jne 0x10006327
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10006327
cmp dword [ebp - 0x234], edi
je 0x10006327
push dword [ebp - 0x234]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebp - 0x240], eax
je 0x10006327
lea ecx, [ebp - 0x234]
push ecx
push dword [ebp - 0x234]
push eax
push 1
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, eax
cmp esi, edi
mov dword [ebp - 0x244], edi
je 0x100064c5
lea eax, [ebp - 0x234]
push eax
push edi
push edi
push 6
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, eax
cmp esi, edi
jne 0x100063a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000639b
cmp dword [ebp - 0x234], edi
je 0x1000639b
push dword [ebp - 0x234]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebp - 0x244], eax
je 0x1000639b
lea ecx, [ebp - 0x234]
push ecx
push dword [ebp - 0x234]
push eax
push 6
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, eax
cmp esi, edi
je 0x100064c5
mov eax, dword [ebp - 0x240]
cmp eax, edi
je 0x100064c1
mov eax, dword [eax]
cmp eax, edi
je 0x100064c1
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x100064c1
lea eax, [ebp - 0x248]
push eax
mov eax, dword [ebp - 0x240]
push dword [eax]
mov dword [ebp - 0x248], edi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov esi, eax
cmp esi, edi
je 0x100064ad
mov eax, dword [ebp - 0x248]
cmp eax, edi
je 0x100064c1
cmp word [eax], di
je 0x100064ad
mov ecx, dword [ebp - 0x25c]
push dword [ecx + 8]
push eax
call fcn.1001c824
test eax, eax
pop ecx
pop ecx
jne 0x100064ad
push ebx
push 1
push 2
push edi
push 0x2000000
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, eax
cmp esi, edi
je 0x1000649e
push dword [ebp - 0x234]
push dword [ebp - 0x244]
push 6
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov esi, eax
cmp esi, edi
je 0x1000649e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0x254]
push ecx
push eax
mov dword [ebp - 0x254], edi
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov esi, eax
cmp esi, edi
je 0x1000649e
push 4
lea eax, [ebp - 0x254]
push eax
push 0xc
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov esi, eax
cmp esi, edi
je 0x1000649e
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x23c], edi
jmp 0x100064ad
mov eax, dword [ebx]
cmp eax, edi
je 0x100064ad
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], edi
cmp dword [ebp - 0x248], edi
je 0x100064c1
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, edi
jne 0x100064df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100064d9
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x240], edi
je 0x100064f3
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x244], edi
je 0x10006507
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x238], edi
je 0x10006521
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x238], edi
cmp dword [ebp - 0x258], edi
je 0x10006535
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x24c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1000626f
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10006577
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x10006571
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x23c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001b05b
leave
ret