Function at 0x45b5b4
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
call fcn.00457690
mov esi, eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45b5eb
mov ebx, 0xffffff9b
jmp 0x45b7ed
mov dword [ebp - 0x1a8], 0x128
lea eax, [ebp - 0x1a8]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x45b610
mov ebx, 0xffffff91
jmp 0x45b7ed
push 0x5d3fa6
lea eax, [ebp - 0x184]
push eax
call fcn.004cd568
add esp, 8
test eax, eax
jne 0x45b64e
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x1a0]
push ecx
call fcn.00457594
add esp, 8
test eax, eax
je 0x45b64e
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jne 0x45b64e
mov edi, dword [ebp - 0x1a0]
jmp 0x45b65f
lea eax, [ebp - 0x1a8]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x45b610
push esi
call fcn.004576cc
pop ecx
mov dword [ebp - 4], eax
push edi
push 0
push 0x2000000
call sub.KERNEL32.dll_OpenProcess
mov edi, eax
lea edx, [ebp - 0xc]
push edx
push 0x201eb
push edi
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
jne 0x45b695
mov ebx, 0xffffff87
jmp 0x45b7ed
lea eax, [ebp - 0x14]
push eax
push 0x5d3fb3
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x45b6b3
mov ebx, 0xffffff7d
jmp 0x45b7ed
mov dword [ebp - 0x80], 1
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 2
push edx
push 1
push 1
push 0
push 0x2000000
mov ecx, dword [ebp - 0xc]
push ecx
call sub.ADVAPI32.dll_DuplicateTokenEx
push 4
push esi
push 0xc
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_SetTokenInformation
push 0
push 0
push 0x10
lea edx, [ebp - 0x80]
push edx
push 0
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.dll_AdjustTokenPrivileges
test eax, eax
jne 0x45b716
mov ebx, 0xffffff73
jmp 0x45b7ed
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x514
push 1
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x18]
push eax
push edx
mov ebx, 0x30
call fcn.004575e8
add esp, 0xc
test eax, eax
je 0x45b743
or ebx, 0x400
jmp 0x45b748
xor ecx, ecx
mov dword [ebp - 0x18], ecx
push 0x44
push 0
lea eax, [ebp - 0x70]
push eax
call fcn.004cd264
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x68], 0x5d3fc4
mov esi, dword [ebp + 0x10]
add esp, 0xc
and esi, 0x100
test esi, esi
je 0x45b77a
mov dword [ebp - 0x68], 0x5d3fd4
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004cd264
add esp, 0xc
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x70]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp - 0x18]
push edx
push ebx
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_CreateProcessAsUserA
test eax, eax
jne 0x45b7bb
mov ebx, 0xffffff2e
jmp 0x45b7cc
xor ebx, ebx
test esi, esi
je 0x45b7cc
push 0xffffffffffffffff
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
push edi
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret