Function at 0x61f34a
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push 0x954
mov eax, 0x6fb978
call fcn.00648bbe
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x960]
mov edi, dword [ebp + 0xc]
push 0x5a2
mov dword [ebp - 0x920], ebx
mov dword [ebp - 0x904], edi
call fcn.006c22f9
lea ecx, [ebp - 0x910]
xor esi, esi
push ecx
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.006c22d9
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.005154cf
mov ecx, dword [ebp - 0x910]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x960]
call fcn.006c2344
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x61f3ea
lea eax, [ebp - 0x900]
mov dword [ebp - 0x900], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x61f3f2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00648b0b
ret 8
cmp dword [ebp - 0x8f8], ebx
je 0x61f40e
lea eax, [ebp - 0x900]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x61f3f2
jmp 0x61f42c
lea ecx, [ebp - 0x8dc]
call fcn.0051545a
mov ecx, dword [ebp - 0x904]
push eax
lea eax, [ebp - 0x8dc]
push eax
call fcn.00515b15
push ebx
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x61f3e3
push 0x104
lea eax, [ebp - 0x220]
push eax
push esi
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x61f46a
push 0x104
lea eax, [ebp - 0x220]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x90c]
call fcn.00515719
push 2
pop ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x90c]
cmp dword [eax - 0xc], 0
je 0x61f4ac
mov ecx, dword [ebp - 0x904]
lea eax, [ebp - 0x90c]
push eax
call fcn.005154cf
jmp 0x61f542
mov byte [ebp - 4], 3
call fcn.006460e0
lea eax, [ebp - 0x908]
mov dword [ebp - 4], ebx
push eax
push esi
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x61f509
call ebx
cmp eax, 0x3f0
jne 0x61f526
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
je 0x61f526
lea eax, [ebp - 0x908]
push eax
push esi
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x61f526
push ecx
mov ecx, dword [ebp - 0x908]
call fcn.005f86c1
pop ecx
test eax, eax
jne 0x61f526
push dword [ebp - 0x908]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x920]
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x910], eax
test eax, eax
jne 0x61f55c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x90c]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
jmp 0x61f3ea
lea ecx, [ebp - 0x908]
mov dword [ebp - 0x918], 1
push ecx
push esi
push esi
lea ecx, [ebp - 0x918]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetUserObjectSecurity]
test eax, eax
je 0x61f6be
push dword [ebp - 0x908]
call fcn.0067b6f8
mov ebx, eax
pop ecx
test ebx, ebx
je 0x61f6e3
push dword [ebp - 0x908]
push esi
push ebx
call fcn.0066f220
add esp, 0xc
lea eax, [ebp - 0x908]
push eax
push dword [ebp - 0x908]
lea eax, [ebp - 0x918]
push ebx
push eax
push dword [ebp - 0x910]
call dword [sym.imp.USER32.dll_GetUserObjectSecurity]
test eax, eax
je 0x61f68c
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x91c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
push dword [ebp - 0x91c]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x61f6b5
mov eax, 0x12c
mov dword [ebp - 0x924], eax
mov dword [ebp - 0x914], eax
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp - 0x924]
push eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x6d0]
push eax
push dword [ebp - 0x91c]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x61f68c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x478]
push 0x76894c
push eax
call esi
test eax, eax
je 0x61f68c
push str.Administrators
lea eax, [ebp - 0x478]
push eax
call esi
test eax, eax
je 0x61f68c
lea ecx, [ebp - 0x6d0]
call fcn.0051545a
mov ecx, dword [ebp - 0x904]
push eax
lea eax, [ebp - 0x6d0]
push eax
call fcn.00515b15
jmp 0x61f6b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x904], eax
lea eax, [ebp - 0x904]
push eax
push str.SetProcessName_error__d
push 0x12c
call fcn.00519db0
mov ecx, eax
call fcn.00526b8b
push ebx
call fcn.0067b635
pop ecx
jmp 0x61f6e3
call ebx
mov dword [ebp - 0x904], eax
lea eax, [ebp - 0x904]
push eax
push str.SetProcessName_error__d
push 0x12c
call fcn.00519db0
mov ecx, eax
call fcn.00526b8b
push dword [ebp - 0x910]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x61f542