Function at 0x40b5d0
Capabilities:
Compare security identifiers
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2894
call fcn.00447a90
mov eax, dword [0x46b554]
xor eax, esp
mov dword [esp + 0x2890], eax
push ebx
push esi
push edi
mov edi, ecx
push 0x46d7c0
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebp + 8], 0
mov byte [esp + 0x13], 0
jne 0x40b663
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x14]
push ecx
push 8
push eax
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b663
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push 0x400
lea eax, [esp + 0xa0]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40b64f
mov esi, 1
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40b663
mov byte [esp + 0x13], 1
cmp dword [edi + 0x14], 8
jb 0x40b66d
mov eax, dword [edi]
jmp 0x40b66f
mov eax, edi
push 0
push 0
push 3
push 0
push 7
push 0x20080
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x20], esi
cmp esi, 0xffffffff
jne 0x40b69a
mov dword [esp + 0x20], 0
jmp 0x40b6b1
test esi, esi
je 0x40b6b1
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov esi, 0x1000
call fcn.00430914
push esi
call fcn.0043094e
mov edi, dword [sym.imp.PSAPI.DLL_EnumProcesses]
add esp, 8
lea ecx, [esp + 0x14]
push ecx
mov ebx, eax
push esi
push ebx
call edi
mov eax, dword [esp + 0x14]
cmp eax, esi
jb 0x40b704
nop
push ebx
add esi, esi
call fcn.00430914
push esi
call fcn.0043094e
add esp, 8
lea edx, [esp + 0x14]
push edx
mov ebx, eax
push esi
push ebx
call edi
mov eax, dword [esp + 0x14]
cmp eax, esi
jae 0x40b6e0
shr eax, 2
xor ecx, ecx
mov byte [esp + 0x12], 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ecx
test eax, eax
je 0x40b8b7
mov eax, dword [ebx + ecx*4]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40b89d
cmp byte [esp + 0x13], 0
je 0x40b7b1
lea ecx, [esp + 0x18]
push ecx
push 8
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b7b1
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x2c]
push edx
push 0x400
lea eax, [esp + 0x4a0]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40b77c
mov edi, 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40b7b1
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x498]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40b7b1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b89d
xor eax, eax
jmp 0x40b7c0
movzx ecx, word [eax + str._GLOBALROOT]
mov word [esp + eax + 0x898], cx
add eax, 2
test cx, cx
jne 0x40b7c0
push 0xff2
lea edx, [esp + 0x8b8]
push edx
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
cmp dword [esp + 0x20], 0
je 0x40b855
push 0
push 0
push 3
push 0
push 7
push 0x20080
lea eax, [esp + 0x8b0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b855
lea ecx, [esp + 0x64]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
call edi
mov edx, dword [esp + 0x80]
cmp edx, dword [esp + 0x4c]
jne 0x40b855
mov eax, dword [esp + 0x90]
cmp eax, dword [esp + 0x5c]
jne 0x40b855
mov ecx, dword [esp + 0x94]
cmp ecx, dword [esp + 0x60]
je 0x40b8b2
cmp word [esp + 0x898], 0
lea esi, [esp + 0x898]
je 0x40b87f
movzx edx, word [esi]
push edx
call fcn.0043234d
mov word [esi], ax
add esi, 2
add esp, 4
cmp word [esi], 0
jne 0x40b867
mov eax, dword [esp + 0x28]
call fcn.00404450
push eax
lea eax, [esp + 0x89c]
push eax
call fcn.0042fc08
add esp, 8
test eax, eax
jne 0x40b8b2
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x1c], ecx
cmp ecx, dword [esp + 0x24]
jb 0x40b71e
jmp 0x40b8b7
mov byte [esp + 0x12], 1
push ebx
call fcn.00430914
add esp, 4
push 0x46d7c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x289c]
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042f9b2
mov esp, ebp
pop ebp
ret