Function at 0x42b5f5
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a40
call fcn.0049fd90
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ecx + 8]
mov dword [ebp - 0x1a40], eax
mov eax, dword [eax]
test eax, eax
jne 0x42b84a
push ebx
or ebx, 0xffffffff
call fcn.0042b285
cmp eax, 5
jle 0x42b66e
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x42b643
push str.CPTCallProcess::GetCurrentLogonUserToken:_LoadSystemLibrary_Kernel32.dll_FAILED__n
jmp 0x42b661
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42b667
call eax
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42b66e
push str.CPTCallProcess::GetCurrentLogonUserToken:_dwConsoleSessionId_is_0xffffffff__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x42b849
push esi
mov esi, 0x1000
lea eax, [ebp - 0x1a2c]
push esi
push 0
push eax
call fcn.004c4160
and dword [ebp - 0x1a38], 0
lea eax, [ebp - 0x1a38]
add esp, 0xc
push eax
push esi
lea eax, [ebp - 0x1a2c]
push eax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x42b6b7
push str.CPTCallProcess::GetCurrentLogonUserToken:_pfnEnumProcesses_FAILED__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x42b848
mov esi, dword [ebp - 0x1a38]
push edi
shr esi, 2
xor edi, edi
test esi, esi
je 0x42b83f
push dword [ebp + edi*4 - 0x1a2c]
push 0
push 0x1010
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1a30], eax
test eax, eax
je 0x42b836
xor eax, eax
mov dword [ebp - 0x1a34], eax
cmp ebx, 0xffffffff
jne 0x42b7d0
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004c4160
push 0x208
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.004c4160
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.004c4160
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004c4160
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.004c4160
add esp, 0x3c
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [ebp - 0x1a30]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004f2d16
lea eax, [ebp - 0x414]
push eax
push str.explorer
call fcn.0042055c
add esp, 0x1c
test eax, eax
jne 0x42b821
lea eax, [ebp - 0x61c]
push eax
push str..exe
call fcn.0042055c
pop ecx
pop ecx
test eax, eax
je 0x42b7f6
jmp 0x42b821
mov dword [ebp - 0x1a3c], eax
lea eax, [ebp - 0x1a3c]
push eax
push dword [ebp + edi*4 - 0x1a2c]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x42b821
cmp dword [ebp - 0x1a3c], ebx
jne 0x42b821
push dword [ebp - 0x1a40]
push 0xf01ff
push dword [ebp - 0x1a30]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ecx, dword [ebp - 0x1a34]
xor edx, edx
inc edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1a34], ecx
push dword [ebp - 0x1a30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1a34], 0
jne 0x42b83f
inc edi
cmp edi, esi
jb 0x42b6cb
mov eax, dword [ebp - 0x1a40]
pop edi
mov eax, dword [eax]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049fb26
leave
ret