Function at 0x435b30
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a23ab
mov eax, dword fs:[0]
push eax
mov eax, 0x415c
call fcn.004cf3e0
mov eax, dword [0x61df80]
xor eax, ebp
mov dword [ebp - 0x4028], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x4020]
push eax
push 0x4000
lea ecx, [ebp - 0x401c]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x435bff
call fcn.00401ff0
mov dword [ebp - 0x4024], eax
cmp dword [ebp - 0x4024], 0
je 0x435bf6
push 4
call fcn.00405d70
movzx edx, al
push edx
mov eax, dword [ebp - 0x4024]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x4024]
mov eax, dword [edx + 0xc]
call eax
movzx ecx, al
test ecx, ecx
je 0x435bf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.get_token_for_session_EnumProcesses_Failed___u_
push 0xbc
push 0x5e4e60
push 4
call fcn.00405d70
movzx edx, al
push edx
mov eax, dword [ebp - 0x4024]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x4024]
push edx
mov eax, dword [ecx + 0x10]
call eax
add esp, 0x1c
xor ecx, ecx
jne 0x435b85
jmp 0x435f85
mov dword [ebp - 0x14], 0
jmp 0x435c11
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x10], 0
jne 0x435f85
cmp dword [ebp - 0x4020], 0x1000
jae 0x435c35
mov eax, dword [ebp - 0x4020]
mov dword [ebp - 0x4168], eax
jmp 0x435c3f
mov dword [ebp - 0x4168], 0x1000
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x4168]
jae 0x435f85
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + edx*4 - 0x401c]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x413c], eax
cmp dword [ebp - 0x413c], 0
jne 0x435c77
jmp 0x435c08
mov byte [ebp - 0x4134], 0
push 0x104
push 0
lea ecx, [ebp - 0x4133]
push ecx
call fcn.004ce490
add esp, 0xc
push 0x105
lea edx, [ebp - 0x4134]
push edx
push 0
mov eax, dword [ebp - 0x413c]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
lea ecx, [ebp - 0x4134]
push ecx
lea ecx, [ebp - 0x4138]
call fcn.0043a150
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.0045a380
push eax
lea ecx, [ebp - 0x4138]
call fcn.0043a230
test eax, eax
je 0x435d03
mov edx, dword [ebp - 0x413c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4138]
call fcn.0043a1d0
jmp 0x435c08
lea eax, [ebp - 0x18]
push eax
push 0x20008
mov ecx, dword [ebp - 0x413c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x435eec
mov dword [ebp - 0x4144], 0
mov dword [ebp - 0x4140], 0
lea edx, [ebp - 0x4140]
push edx
push 0
push 0
push 1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [ebp - 0x4140], 0
jbe 0x435ed9
mov ecx, dword [ebp - 0x4140]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x4148], eax
mov edx, dword [ebp - 0x4148]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x4144], eax
lea eax, [ebp - 0x4140]
push eax
mov ecx, dword [ebp - 0x4140]
push ecx
mov edx, dword [ebp - 0x4144]
push edx
push 1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x435ebf
mov dword [ebp - 0x414c], 0
lea ecx, [ebp - 0x414c]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + edx*4 - 0x401c]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x435ebf
call fcn.00401ff0
mov dword [ebp - 0x4154], eax
cmp dword [ebp - 0x4154], 0
je 0x435e3e
push 1
call fcn.00405d70
movzx ecx, al
push ecx
mov edx, dword [ebp - 0x4154]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4154]
mov edx, dword [eax + 0xc]
call edx
movzx eax, al
test eax, eax
je 0x435e3e
push str.this_is_the_specify_session_r_n
push 0xe5
push 0x5e4e8c
push 1
call fcn.00405d70
movzx ecx, al
push ecx
mov edx, dword [ebp - 0x4154]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4154]
push ecx
mov edx, dword [eax + 0x10]
call edx
add esp, 0x18
xor eax, eax
jne 0x435dd4
lea ecx, [ebp - 0x4150]
push ecx
push 0xf00ff
mov edx, dword [ebp - 0x413c]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x435ebf
mov dword [ebp - 0x4160], 0xc
mov dword [ebp - 0x4158], 1
mov dword [ebp - 0x415c], 0
lea eax, [ebp - 0x10]
push eax
push 1
push 2
push 0
push 0x2000000
mov ecx, dword [ebp - 0x4150]
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x435ea6
mov dword [ebp - 0x10], 0
jmp 0x435eb2
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00423a90
mov eax, dword [ebp - 0x4150]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x4148]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x4148]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], 0
jmp 0x435f61
call fcn.00401ff0
mov dword [ebp - 0x4164], eax
cmp dword [ebp - 0x4164], 0
je 0x435f5d
push 4
call fcn.00405d70
movzx ecx, al
push ecx
mov edx, dword [ebp - 0x4164]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4164]
mov edx, dword [eax + 0xc]
call edx
movzx eax, al
test eax, eax
je 0x435f5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.get_token_for_session_OpenProcessToken_Failed__u_
push 0x110
push 0x5e4ecc
push 4
call fcn.00405d70
movzx ecx, al
push ecx
mov edx, dword [ebp - 0x4164]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4164]
push ecx
mov edx, dword [eax + 0x10]
call edx
add esp, 0x1c
xor eax, eax
jne 0x435eec
mov ecx, dword [ebp - 0x413c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4138]
call fcn.0043a1d0
jmp 0x435c08
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x4028]
xor ecx, ebp
call fcn.004c7d13
mov esp, ebp
pop ebp
ret