Function at 0x415e60
Capabilities:
Enumerate process modules
Enumerate processes on remote desktop session host
Find taskbar

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00429120
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1018]
push eax
mov dword [ebp - 0x1014], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x415ef3
cmp dword [ebp - 0x1018], ebx
jne 0x415ef3
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x415ef3
lea ecx, [ebp - 0x100c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x100c]
call fcn.004155f0
add esp, 4
test al, al
je 0x415ef3
mov eax, dword [ebp - 0x100c]
mov dword [esi], eax
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0
push eax
lea eax, [ebp - 0x1010]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x415fe6
mov ecx, dword [ebp - 0x1008]
xor esi, esi
mov dword [ebp - 0x100c], 0
test ecx, ecx
je 0x415fc4
xor edi, edi
nop dword [eax + eax]
mov eax, dword [ebp - 0x1010]
cmp dword [edi + eax], ebx
jne 0x415f7c
push str.explorer.exe
push dword [edi + eax + 8]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x415f76
mov eax, dword [ebp - 0x1010]
push dword [edi + eax + 4]
call fcn.004155f0
add esp, 4
test al, al
jne 0x415fa6
mov ecx, dword [ebp - 0x1008]
inc esi
add edi, 0x10
cmp esi, ecx
jb 0x415f40
push dword [ebp - 0x1010]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x100c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1010]
add esi, esi
mov edx, dword [ebp - 0x1014]
mov dword [ebp - 0x100c], 1
mov eax, dword [eax + esi*8 + 4]
mov dword [edx], eax
push dword [ebp - 0x1010]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x100c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1008]
xor edi, edi
push eax
push 0x1000
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1008], edi
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x41601b
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
xor esi, esi
test dword [ebp - 0x1008], 0xfffffffc
jbe 0x416098
nop dword [eax]
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + esi*4 - 0x1004]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x416063
cmp dword [ebp - 0x100c], ebx
jne 0x416063
push dword [ebp + esi*4 - 0x1004]
call fcn.004155f0
add esp, 4
test al, al
jne 0x416084
mov eax, dword [ebp - 0x1008]
inc esi
shr eax, 2
cmp esi, eax
jb 0x416030
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x1014]
mov edi, 1
mov ecx, dword [ebp + esi*4 - 0x1004]
mov dword [edx], ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a27
mov esp, ebp
pop ebp
ret