Function at 0x40375e
Capabilities:
Enumerate processes
Get session information

Disassembly:
push 0x654
mov eax, 0x42898e
call fcn.00416dfd
mov ebx, 0x459678
mov esi, ebx
call fcn.0040487b
mov esi, 0x459668
call fcn.0040487b
xor edi, edi
push edi
push 2
mov dword [ebp - 0x244], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x650], eax
je 0x403a95
lea ecx, [ebp - 0x244]
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4037c8
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403a95
push str.explorer.exe
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403874
push 0x408
lea eax, [ebp - 0x64c]
push edi
push eax
call fcn.00416500
mov eax, dword [ebp - 0x23c]
add esp, 0xc
push eax
mov dword [ebp - 0x64c], eax
call fcn.00403bd2
mov dword [ebp - 0x648], eax
call fcn.0040a2a2
push eax
lea ecx, [ebp - 0x654]
call fcn.00407975
lea eax, [ebp - 0x654]
push eax
mov dword [ebp - 4], edi
push dword [ebp - 0x23c]
call fcn.00403a9b
test eax, eax
je 0x403854
push edi
lea ecx, [ebp - 0x654]
call fcn.004080da
push eax
lea eax, [ebp - 0x644]
push eax
call fcn.00415435
pop ecx
pop ecx
lea eax, [ebp - 0x64c]
push eax
mov eax, ebx
call fcn.00404818
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x654]
add ecx, 0xfffffff0
call fcn.0040795b
push str.winlogon.exe
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403924
push 0x408
lea eax, [ebp - 0x64c]
push edi
push eax
call fcn.00416500
mov eax, dword [ebp - 0x23c]
add esp, 0xc
push eax
mov dword [ebp - 0x64c], eax
call fcn.00403bd2
mov dword [ebp - 0x648], eax
call fcn.0040a2a2
push eax
lea ecx, [ebp - 0x658]
call fcn.00407975
lea eax, [ebp - 0x658]
push eax
mov dword [ebp - 4], 1
push dword [ebp - 0x23c]
call fcn.00403a9b
test eax, eax
je 0x403904
push edi
lea ecx, [ebp - 0x658]
call fcn.004080da
push eax
lea eax, [ebp - 0x644]
push eax
call fcn.00415435
pop ecx
pop ecx
lea eax, [ebp - 0x64c]
push eax
mov eax, esi
call fcn.00404818
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x658]
add ecx, 0xfffffff0
call fcn.0040795b
lea eax, [ebp - 0x244]
push eax
push dword [ebp - 0x650]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4037c8
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov dword [ebp - 0x654], edi
call fcn.004047a1
test eax, eax
jle 0x403a95
push dword [ebp - 0x654]
mov eax, esi
mov dword [ebp - 0x650], edi
mov dword [ebp - 0x660], edi
mov dword [ebp - 0x65c], edi
call fcn.004047b9
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x65c]
push eax
push 8
push ebx
push edi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
mov eax, dword [ebp - 0x65c]
je 0x4039b8
cmp dword [ebp - 0x660], 4
jne 0x4039b8
xor ecx, ecx
cmp dword [eax], edi
sete cl
mov dword [ebp - 0x650], ecx
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 0x650], edi
jne 0x4039e0
inc dword [ebp - 0x654]
mov eax, esi
call fcn.004047a1
cmp dword [ebp - 0x654], eax
jl 0x40395f
jmp 0x403a95
mov dword [0x458c08], ebx
call fcn.0040a2a2
push eax
lea ecx, [ebp - 0x650]
call fcn.00407975
mov dword [ebp - 4], 2
push dword [ebp - 0x654]
mov eax, esi
call fcn.004047b9
add eax, 8
push eax
push ebx
lea eax, [ebp - 0x650]
push str._PCFILTER__PCFILTERService_:_Active_Session_ID_:__d__User_Name_:__s
push eax
call fcn.00408205
push dword [ebp - 0x650]
mov ecx, 0x459688
call fcn.0040149b
add esp, 0x14
mov edi, 0x459654
push 0x44cef8
mov ecx, edi
call fcn.004049da
test eax, eax
je 0x403a55
cmp dword [0x456074], 0x2710
jne 0x403a87
push dword [ebp - 0x654]
mov eax, esi
call fcn.004047b9
add eax, 8
push eax
mov ecx, edi
call fcn.004080b5
push ecx
mov dword [ebp - 0x658], esp
mov ecx, esp
push edi
mov dword [0x456074], ebx
call fcn.004081e7
call fcn.00402537
mov ecx, dword [ebp - 0x650]
add ecx, 0xfffffff0
call fcn.0040795b
call fcn.00416e80
ret