Function at 0x423fcf
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
lea eax, [ecx + 0x214]
push ebx
push ebp
mov dword [esp + 0x10], eax
mov eax, dword [eax]
xor ebp, ebp
push esi
cmp eax, ebp
push edi
jne 0x4244b0
cmp byte [ecx + 0x21c], 0
jne 0x4244b0
push ebp
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4240ae
cmp dword [0x441ff4], ebp
je 0x424163
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 1
je 0x424040
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebp
jne 0x424163
cmp eax, 1
jle 0x424163
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
cmp dword [0x43e578], ebp
mov ebx, eax
jge 0x424064
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x42409b
push 1
push dword [0x43e578]
push 0xd0
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
add esp, 0x10
call esi
push eax
push str.Imperson::GetCurrentUserToken__:_Failed_to_call_CreateToolhelp32Snapshot__error:__u
call fcn.0041c506
pop ecx
pop ecx
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x424163
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x128
push ecx
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x42416a
cmp dword [0x441ff4], ebp
je 0x424159
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 1
je 0x4240f0
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebp
jne 0x424159
cmp eax, 1
jle 0x424159
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
cmp dword [0x43e578], ebp
mov ebx, eax
jge 0x424114
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x42414b
push 1
push dword [0x43e578]
push 0xd6
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
add esp, 0x10
call esi
push eax
push str.Imperson::GetCurrentUserToken__:_Failed_to_call_CreateToolhelp32Snapshot__error:__u
call fcn.0041c506
pop ecx
pop ecx
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4244b0
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x40]
push eax
push str.explorer.exe
call sub.MSVCRT.dll__stricmp
pop ecx
test eax, eax
pop ecx
jne 0x42422e
push dword [esp + 0x24]
call fcn.004234bd
test al, al
pop ecx
jne 0x424249
cmp dword [0x441ff4], ebp
je 0x42422e
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x4241c8
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebp
jne 0x42422e
cmp eax, 3
jle 0x42422e
call edi
mov ebx, eax
call esi
cmp dword [0x43e578], 0
mov ebp, eax
jge 0x4241e3
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x42421e
push 3
push dword [0x43e578]
push 0xe4
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
push dword [esp + 0x34]
lea eax, [esp + 0x54]
push eax
push str.Imperson::GetCurrentUserToken__:_Explorer__s__PID:__u__not_in_active_session_n
call fcn.0041c506
add esp, 0x1c
call fcn.0041c4cc
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebp, ebp
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x424176
jmp 0x4244a0
cmp dword [0x441ff4], ebp
je 0x4242d6
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x424270
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebp
jne 0x4242d6
cmp eax, 3
jle 0x4242d6
call edi
mov ebx, eax
call esi
cmp dword [0x43e578], 0
mov ebp, eax
jge 0x42428b
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x4242c6
push 3
push dword [0x43e578]
push 0xe8
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
push dword [esp + 0x34]
lea eax, [esp + 0x54]
push eax
push str.Imperson::GetCurrentUserToken__:_Explorer__s__PID:__u_n
call fcn.0041c506
add esp, 0x1c
call fcn.0041c4cc
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebp, ebp
push dword [esp + 0x24]
push ebp
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x42441e
cmp dword [0x441ff4], ebp
je 0x424372
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x424315
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebp
jne 0x424372
cmp eax, 3
jle 0x424372
call edi
mov ebp, eax
call esi
cmp dword [0x43e578], 0
mov ebx, eax
jge 0x424330
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x424362
push 3
push dword [0x43e578]
push 0xed
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
push str.Imperson::GetCurrentUserToken__:_Explorer_process_handle_is_opened_n
call fcn.0041c506
add esp, 0x14
call fcn.0041c4cc
push ebp
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebp, ebp
push dword [esp + 0x18]
push 0xf01ff
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42440f
cmp dword [0x441ff4], ebp
je 0x42440f
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 1
je 0x4243b0
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebp
jne 0x42440f
cmp eax, 1
jle 0x42440f
call edi
mov edi, eax
call esi
cmp dword [0x43e578], ebp
mov ebx, eax
jge 0x4243ca
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x424401
push 1
push dword [0x43e578]
push 0xf0
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
add esp, 0x10
call esi
push eax
push str.Imperson::GetCurrentUserToken__:_failed_to_open_token_of_Explorer__error:__d_n
call fcn.0041c506
pop ecx
pop ecx
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4244a0
cmp dword [0x441ff4], ebp
je 0x4244a0
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 1
je 0x424441
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebp
jne 0x4244a0
cmp eax, 1
jle 0x4244a0
call edi
mov edi, eax
call esi
cmp dword [0x43e578], ebp
mov ebx, eax
jge 0x42445b
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x424492
push 1
push dword [0x43e578]
push 0xf6
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
add esp, 0x10
call esi
push eax
push str.Imperson::GetCurrentUserToken__:_failed_to_open_Explorer__error:__d_n
call fcn.0041c506
pop ecx
pop ecx
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret