Function at 0x409ad0
Capabilities:
Enumerate process modules
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x186c
call fcn.004c2cd0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1000
lea eax, [ebp - 0x1828]
push 0
push eax
call fcn.004ad600
add esp, 0xc
mov dword [ebp - 0x1830], 0
mov dword [ebp - 0x1834], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
push 0
push 0x2000000
call edi
lea eax, [ebp - 0x1830]
xorps xmm0, xmm0
push eax
push 0x1000
lea eax, [ebp - 0x1828]
push eax
movups xmmword [ebp - 0x1868], xmm0
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x409b78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_get_processes_error:0x_X
push 1
call fcn.00408d60
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ac4d4
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x1830]
shr ebx, 2
push ebx
push str.Checking__d_proc_entries
push 3
mov dword [ebp - 0x1858], ebx
call fcn.00408d60
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x1840], eax
test ebx, ebx
je 0x40a1ef
mov ecx, dword [ebp - 0x1860]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x184c], ecx
mov ecx, dword [ebp - 0x1864]
mov dword [ebp - 0x1844], ecx
nop dword [eax + eax]
push dword [ebp + eax*4 - 0x1828]
mov dword [ebp - 0x182c], 0
push 1
push 0x2000000
mov dword [ebp - 0x1838], 0
mov dword [ebp - 0x183c], 0
call edi
mov edi, eax
mov dword [ebp - 0x1850], 0
mov dword [ebp - 0x1848], edi
test edi, edi
je 0x40a1b1
lea eax, [ebp - 0x182c]
push eax
push 0xe
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x409c53
call ebx
push eax
mov eax, dword [ebp - 0x1840]
push dword [ebp + eax*4 - 0x1828]
push str.Cannot_open_token_for_process_id__d__error:0x_X
push 1
call fcn.00408d60
add esp, 0x10
push edi
call esi
jmp 0x40a1d0
lea eax, [ebp - 0x1830]
push eax
push 0
push 0
push 1
push dword [ebp - 0x182c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x1830]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
inc dword [0x4de7b4]
mov esi, eax
lea eax, [ebp - 0x1830]
mov dword [ebp - 0x1854], esi
push eax
push dword [ebp - 0x1830]
push esi
push 1
push dword [ebp - 0x182c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x409cea
call ebx
push eax
mov eax, dword [ebp - 0x1840]
push dword [ebp + eax*4 - 0x1828]
push str.Cannot_get_tinfo_for_process_id__d__error:0x_X
push 1
call fcn.00408d60
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x182c]
dec dword [0x4de7b4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
jmp 0x40a1d0
lea eax, [ebp - 0x1834]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x40a166
mov edi, dword [ebp - 0x1834]
test edi, edi
je 0x409d46
mov esi, dword [ebp - 0x1844]
test esi, esi
je 0x409d55
mov eax, dword [esi]
test eax, eax
je 0x409d29
push edi
push eax
call fcn.004b3f5d
add esp, 8
test eax, eax
je 0x409d32
mov esi, dword [esi + 8]
test esi, esi
jne 0x409d15
jmp 0x409d55
mov dword [ebp - 0x1850], 1
mov eax, str.Sid_already_processed
jmp 0x409e4a
push str.NULL_params_checking_processed_sids
push 1
call fcn.00408d60
add esp, 8
mov ebx, dword [ebp - 0x1834]
xor edx, edx
test ebx, ebx
je 0x409d8a
mov edx, 0x7fffffff
mov eax, ebx
cmp word [eax], 0
je 0x409d76
add eax, 2
sub edx, 1
jne 0x409d68
test edx, edx
je 0x409dc0
lea eax, [edx + edx]
mov ecx, 0xfffffffe
sub ecx, eax
neg edx
sbb edx, edx
and edx, ecx
push 0xc
push 0x40
lea edi, [edx + 2]
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
inc dword [0x4de7b4]
mov esi, eax
test esi, esi
jne 0x409dda
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
push str.Error_creating_a_new_list_entry:0x_X
push 1
call fcn.00408d60
add esp, 0xc
jmp 0x409e45
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
push str.Cannot_get_the_string_size:0x_X
push 1
call fcn.00408d60
add esp, 0xc
jmp 0x409e45
test edi, edi
je 0x409e02
test ebx, ebx
je 0x409e02
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
inc dword [0x4de7b4]
mov dword [esi], eax
test eax, eax
je 0x409e13
push edi
push ebx
push eax
call fcn.004ae080
add esp, 0xc
cmp dword [ebp - 0x1844], 0
jne 0x409e2d
mov dword [ebp - 0x1844], esi
jmp 0x409e39
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
push str.Error_copying_list_value:0x_X
push 1
call fcn.00408d60
add esp, 0xc
jmp 0x409e45
mov eax, dword [ebp - 0x184c]
mov dword [esi + 4], eax
mov dword [eax + 8], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x184c], esi
mov eax, str.ADDED_Sid
push eax
push 3
call fcn.00408d60
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 8
push dword [ebp - 0x1834]
call esi
push dword [ebp - 0x1854]
mov dword [ebp - 0x1834], 0
call esi
dec dword [0x4de7b4]
cmp dword [ebp - 0x1850], 0
jne 0x40a198
mov esi, dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
lea eax, [ebp - 0x183c]
push eax
push 1
push 2
push 0
push 4
push dword [ebp - 0x182c]
call esi
test eax, eax
jne 0x409edb
call ebx
push eax
mov eax, dword [ebp - 0x1840]
push dword [ebp + eax*4 - 0x1828]
push str.Cannot_duplicate_token_for_process_id__d__error:0x_X
push 1
call fcn.00408d60
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x10
push dword [ebp - 0x1848]
call esi
jmp 0x40a1d0
lea eax, [ebp - 0x1838]
push eax
push 2
push 2
push 0
push 0xc
push dword [ebp - 0x182c]
call esi
test eax, eax
je 0x40a12f
push dword [ebp - 0x1838]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x40a0ed
mov eax, dword [ebp - 0x1840]
push dword [ebp + eax*4 - 0x1828]
push str.Do_processing_for_process_id__d
push 3
call fcn.00408d60
add esp, 0xc
lea eax, [ebp - 0x828]
push 0x820
push 0
push eax
call fcn.004ad600
add esp, 0xc
lea eax, [ebp - 0x828]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40a0ad
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x828]
push eax
call esi
test eax, eax
je 0x40a0ad
lea eax, [ebp - 0x828]
push eax
call esi
test eax, eax
je 0x40a0ad
mov edx, 0x7fffffff
lea eax, [ebp - 0x828]
nop
cmp word [eax], 0
je 0x409f9e
add eax, 2
sub edx, 1
jne 0x409f90
test edx, edx
je 0x40a0a3
lea eax, [edx + edx]
mov edi, 0xfffffffe
sub edi, eax
neg edx
push 0xc
sbb edx, edx
and edi, edx
push 0x40
add edi, 2
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
inc dword [0x4de7b4]
mov esi, eax
test esi, esi
jne 0x409fdc
call ebx
push eax
push str.Error_creating_a_new_list_entry:0x_X
jmp 0x40a0b5
test edi, edi
je 0x40a006
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
inc dword [0x4de7b4]
mov dword [esi], eax
test eax, eax
je 0x40a04f
push edi
lea ecx, [ebp - 0x828]
push ecx
push eax
call fcn.004ae080
add esp, 0xc
cmp dword [0x4de9d8], 0
jne 0x40a059
inc dword [0x4de9d4]
mov dword [0x4de9d8], esi
mov dword [0x4de9dc], esi
call fcn.004092a0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x1838]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x182c]
call esi
push dword [ebp - 0x1848]
call esi
jmp 0x40a1d0
call ebx
push eax
push str.Error_copying_list_value:0x_X
jmp 0x40a0b5
mov eax, dword [0x4de9dc]
mov dword [esi + 4], eax
mov eax, dword [0x4de9dc]
mov dword [eax + 8], esi
inc dword [0x4de9d4]
mov dword [0x4de9dc], esi
call fcn.004092a0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x1838]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x182c]
call esi
push dword [ebp - 0x1848]
call esi
jmp 0x40a1d0
call ebx
push eax
push str.Cannot_get_the_string_size:0x_X
jmp 0x40a0b5
call ebx
push eax
push str.Cannot_get_current_profile_folder:0x_X
push 1
call fcn.00408d60
add esp, 0xc
call fcn.004092a0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x1838]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x182c]
call esi
push dword [ebp - 0x1848]
call esi
jmp 0x40a1d0
call ebx
push eax
mov eax, dword [ebp - 0x1840]
push dword [ebp + eax*4 - 0x1828]
push str.Cannot_impersonate_for_process_id__d__error:0x_X
push 1
call fcn.00408d60
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x10
push dword [ebp - 0x1838]
call esi
push dword [ebp - 0x182c]
call esi
push dword [ebp - 0x1848]
call esi
jmp 0x40a1d0
call ebx
push eax
mov eax, dword [ebp - 0x1840]
push dword [ebp + eax*4 - 0x1828]
push str.Cannot_duplicate_token_for_process_id__d__error:0x_X
push 1
call fcn.00408d60
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x10
push dword [ebp - 0x182c]
call esi
push dword [ebp - 0x1848]
call esi
jmp 0x40a1d0
call ebx
push eax
push str.Cannot_convert_sid_to_string:0x_X
push 1
call fcn.00408d60
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x182c]
dec dword [0x4de7b4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
jmp 0x40a1d0
push dword [ebp - 0x182c]
mov edi, dword [ebp - 0x1848]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
jmp 0x40a1d0
call ebx
push eax
mov eax, dword [ebp - 0x1840]
push dword [ebp + eax*4 - 0x1828]
push str.Cannot_open_handle_for_process_id__d__error:0x_X
push 1
call fcn.00408d60
add esp, 0x10
mov eax, dword [ebp - 0x1840]
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
inc eax
mov dword [ebp - 0x1840], eax
cmp eax, dword [ebp - 0x1858]
jb 0x409bd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ac4d4
mov esp, ebp
pop ebp
ret