Function at 0x40ac80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [0x48baac]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0x234], 0
push 0x228
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.00450300
add esp, 0xc
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0xffffffff
jne 0x40ad2e
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x40acff
mov dword [ebp - 0x264], 0x47b1a8
jmp 0x40ad09
mov dword [ebp - 0x264], 0x47b1b0
mov ecx, dword [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 0x264]
push edx
push str._TOKEN__Session
push 3
mov eax, dword [0x490050]
push eax
call fcn.00408ae0
add esp, 0x14
jmp 0x40ad37
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x23c], ecx
call fcn.00401000
mov dword [ebp - 0x26c], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
jne 0x40ad7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._TOKEN__CreateToolhelp32Snapshot_Error:_d.
push 0
mov edx, dword [0x490050]
push edx
call fcn.00408ae0
add esp, 0x10
xor eax, eax
jmp 0x40b089
mov dword [ebp - 0x234], 0x22c
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40add2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._TOKEN__Process32First_Error:_d.
push 0
mov edx, dword [0x490050]
push edx
call fcn.00408ae0
add esp, 0x10
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40b089
lea ecx, [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x40b076
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0044f161
add esp, 8
test eax, eax
jne 0x40b071
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40b054
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 0
jne 0x40ae43
mov dword [ebp - 0x270], 0
jmp 0x40af02
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x248], edx
mov eax, dword [ebp - 0x248]
add eax, 2
mov dword [ebp - 0x288], eax
mov ecx, dword [ebp - 0x248]
mov dx, word [ecx]
mov word [ebp - 0x256], dx
add dword [ebp - 0x248], 2
cmp word [ebp - 0x256], 0
jne 0x40ae5e
mov eax, dword [ebp - 0x248]
sub eax, dword [ebp - 0x288]
sar eax, 1
mov dword [ebp - 0x274], eax
mov ecx, dword [ebp - 0x274]
add ecx, 1
mov dword [ebp - 0x240], ecx
cmp dword [ebp - 0x240], 0x3fffffff
jle 0x40aeba
mov dword [ebp - 0x25c], 0
jmp 0x40aef6
mov eax, dword [ebp - 0x240]
shl eax, 1
call fcn.00460420
mov dword [ebp - 0x27c], esp
mov edx, dword [ebp - 0x26c]
push edx
mov eax, dword [ebp - 0x240]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x27c]
push edx
call fcn.0040a1d0
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x270]
push eax
push 0x47b240
push 1
mov ecx, dword [0x490050]
push ecx
call fcn.00408ae0
add esp, 0x18
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x23c]
jne 0x40b052
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 0
jne 0x40af66
mov dword [ebp - 0x268], 0
jmp 0x40b025
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x24c], edx
mov eax, dword [ebp - 0x24c]
add eax, 2
mov dword [ebp - 0x284], eax
mov ecx, dword [ebp - 0x24c]
mov dx, word [ecx]
mov word [ebp - 0x24e], dx
add dword [ebp - 0x24c], 2
cmp word [ebp - 0x24e], 0
jne 0x40af81
mov eax, dword [ebp - 0x24c]
sub eax, dword [ebp - 0x284]
sar eax, 1
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x278]
add ecx, 1
mov dword [ebp - 0x240], ecx
cmp dword [ebp - 0x240], 0x3fffffff
jle 0x40afdd
mov dword [ebp - 0x260], 0
jmp 0x40b019
mov eax, dword [ebp - 0x240]
shl eax, 1
call fcn.00460420
mov dword [ebp - 0x280], esp
mov edx, dword [ebp - 0x26c]
push edx
mov eax, dword [ebp - 0x240]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x280]
push edx
call fcn.0040a1d0
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 0x254]
push edx
mov eax, dword [ebp - 0x268]
push eax
push str._TOKEN_
push 1
mov ecx, dword [0x490050]
push ecx
call fcn.00408ae0
add esp, 0x18
jmp 0x40b076
jmp 0x40b071
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._TOKEN__ProcessIdToSessionId_Error:_d.
push 0
mov edx, dword [0x490050]
push edx
call fcn.00408ae0
add esp, 0x10
jmp 0x40add2
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x254]
lea esp, [ebp - 0x288]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044e301
mov esp, ebp
pop ebp
ret