Function at 0x4293f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f96d
mov eax, dword fs:[0]
push eax
sub esp, 0x88c
mov eax, dword [0x43fc54]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0x438910
push str.GetTokenFromValidUserProcess...
call fcn.00428bf0
add esp, 0xc
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
lea ecx, [ebp - 0x258]
call fcn.00402600
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
call fcn.00402fe0
movzx eax, al
test eax, eax
jne 0x42947f
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x258]
call fcn.00402760
jmp 0x429500
xor edx, edx
mov word [ebp - 0x45c], dx
push 0x1fe
push 0
lea eax, [ebp - 0x45a]
push eax
call fcn.00411600
add esp, 0xc
lea ecx, [ebp - 0x45c]
push ecx
call fcn.00429180
add esp, 4
test eax, eax
jne 0x4294ee
push 0
push 0x438958
push str.GetLoggedUserName_failed
call fcn.00428bf0
add esp, 0xc
mov edx, dword [ebp - 0x254]
mov dword [ebp - 0x880], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00402740
mov eax, dword [ebp - 0x880]
jmp 0x4298ff
lea eax, [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x258]
call fcn.00402780
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x429554
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x438990
push 0x438998
call fcn.00428bf0
add esp, 0xc
mov ecx, dword [ebp - 0x254]
mov dword [ebp - 0x884], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00402740
mov eax, dword [ebp - 0x884]
jmp 0x4298ff
mov dword [ebp - 0x24c], 0x22c
lea edx, [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4295be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4389d8
push 0x4389dc
call fcn.00428bf0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x254]
mov dword [ebp - 0x888], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00402740
mov eax, dword [ebp - 0x888]
jmp 0x4298ff
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x464], eax
mov ecx, dword [ebp - 0x464]
push ecx
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0
je 0x42987a
cmp dword [ebp - 0x460], 0xffffffff
je 0x42987a
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x468], 0xa
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x468]
push eax
mov ecx, dword [ebp - 0x460]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42986a
cmp dword [ebp - 0x14], 0
jne 0x42965d
push 0
lea edx, [ebp - 0x228]
push edx
push str.null_token
call fcn.00428bf0
add esp, 0xc
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x429890
xor ecx, ecx
mov word [ebp - 0x874], cx
push 0x1fe
push 0
lea edx, [ebp - 0x872]
push edx
call fcn.00411600
add esp, 0xc
xor eax, eax
mov word [ebp - 0x66c], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x66a]
push ecx
call fcn.00411600
add esp, 0xc
mov dword [ebp - 0x670], 0x100
mov dword [ebp - 0x878], 0x100
lea edx, [ebp - 0x878]
push edx
lea eax, [ebp - 0x66c]
push eax
lea ecx, [ebp - 0x670]
push ecx
lea edx, [ebp - 0x874]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00428770
add esp, 0x14
test eax, eax
jne 0x42970d
push 0
lea ecx, [ebp - 0x228]
push ecx
push str.GetUserNameAndDomainNameFromToken_failed
call fcn.00428bf0
add esp, 0xc
mov edx, dword [ebp - 0x460]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x429890
lea ecx, [ebp - 0x874]
push ecx
lea ecx, [ebp - 0x890]
call fcn.00402640
mov dword [ebp - 0x898], eax
mov edx, dword [ebp - 0x898]
push edx
lea eax, [ebp - 0x258]
push eax
call fcn.00402eb0
add esp, 8
mov byte [ebp - 0x889], al
lea ecx, [ebp - 0x890]
call fcn.00402740
movzx ecx, byte [ebp - 0x889]
test ecx, ecx
je 0x429854
mov dword [ebp - 0x87c], 0
lea edx, [ebp - 0x14]
push edx
call fcn.00428e30
add esp, 4
test eax, eax
je 0x429796
push 0
lea eax, [ebp - 0x228]
push eax
push str.Using_primary_token_from_elevated_process
call fcn.00428bf0
add esp, 0xc
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x87c], ecx
jmp 0x4297be
push 0
lea edx, [ebp - 0x228]
push edx
push str.Using_linked_token_from_not_elevated_process
call fcn.00428bf0
add esp, 0xc
mov eax, dword [ebp - 0x14]
push eax
call fcn.00428890
add esp, 4
mov dword [ebp - 0x87c], eax
cmp dword [ebp - 0x87c], 0
jne 0x4297e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x228]
push ecx
push str.GetLinkedToken_failed
call fcn.00428bf0
add esp, 0xc
jmp 0x429852
push 0
lea edx, [ebp - 0x228]
push edx
push str.Linked_token_created
call fcn.00428bf0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 1
push 1
push 0
push 0x2000000
mov ecx, dword [ebp - 0x87c]
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x429845
push 0
lea edx, [ebp - 0x228]
push edx
push str.User_Token_with_privileges_found
call fcn.00428bf0
add esp, 0xc
mov dword [ebp - 0x254], 1
mov eax, dword [ebp - 0x87c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42986a
push 0
lea ecx, [ebp - 0x228]
push ecx
push str.User_did_not_match__skipping
call fcn.00428bf0
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x42987a
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x460], 0
je 0x429890
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x254], 0
jne 0x4298b1
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4295be
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x254], 0
jne 0x4298db
push 0x373
push 0x438c00
push str.GetTokenFromValidUserProcess_finished_without_token
call fcn.00428bf0
add esp, 0xc
mov ecx, dword [ebp - 0x254]
mov dword [ebp - 0x894], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00402740
mov eax, dword [ebp - 0x894]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00410c05
mov esp, ebp
pop ebp
ret