Function at 0x42b7b2
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b8fb
mov eax, dword fs:[0]
push eax
mov eax, 0x14f8
call fcn.0043a780
mov eax, dword [0x467750]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0x456594
mov edi, str.CUserPrivilege::GetExplorerUserToken
push edi
push 5
mov dword [ebp - 0x14e8], ebx
call fcn.00405a24
add esp, 0xc
lea ecx, [ebp - 0x14d4]
call fcn.004331f7
xor eax, eax
push 0xffc
mov esi, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebx], eax
mov dword [ebp - 0x1218], eax
lea eax, [ebp - 0x1214]
push eax
mov dword [ebp - 0x14d8], esi
call fcn.00438dc0
push str.psapi.dll
call fcn.00401fef
add esp, 0x10
mov dword [ebp - 0x1500], eax
test eax, eax
jne 0x42b860
push str.psapi.dll_SAW_LoadLibrary_failed._n
push edi
push 4
call fcn.00405a24
add esp, 0xc
jmp 0x42bba9
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x42b884
push str.kernel32.dll_GetModuleHandle_failed._n
push edi
push 4
call fcn.00405a24
add esp, 0xc
jmp 0x42bb9d
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x42b89b
push str.WTSGetActiveConsoleSessionId_GetProcAddress_failed._n
jmp 0x42b874
or dword [ebp - 0x14e0], 0xffffffff
cmp dword [ebp - 0x1468], esi
je 0x42b8d5
call eax
mov ebx, eax
mov dword [ebp - 0x14e0], ebx
cmp ebx, 0xffffffff
jne 0x42b8d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WTSGetActiveConsoleSessionId_failed.___1_d___n
push edi
push 4
call fcn.00405a24
add esp, 0x10
jmp 0x42bb9d
push str.EnumProcesses_Start_._n
push edi
push 4
call fcn.00405a24
add esp, 0xc
lea eax, [ebp - 0x14f4]
push eax
push 0x1000
lea eax, [ebp - 0x1218]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x42bbe6
mov eax, dword [ebp - 0x14f4]
shr eax, 2
xor ecx, ecx
mov dword [ebp - 0x14fc], eax
mov dword [ebp - 0x14f0], ecx
test eax, eax
je 0x42bb9d
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + ecx*4 - 0x1218]
push esi
push str.GetProcessID___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
mov dword [ebp - 0x14f8], esi
call fcn.00405a24
add esp, 0x10
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x42b988
call ebx
push eax
push str.OpenProcess_failed.___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00405a24
add esp, 0x10
mov esi, dword [ebp - 0x14d8]
jmp 0x42bb7f
push str.GetProcessHandle.__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00405a24
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00438dc0
and dword [ebp - 0x14ec], 0
add esp, 0x18
lea eax, [ebp - 0x1504]
push eax
push 4
lea eax, [ebp - 0x14ec]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x42b9f4
call ebx
push eax
push str.EnumProcessModules_failed.___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00405a24
add esp, 0x10
push esi
call edi
jmp 0x42b97d
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x14ec]
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
jne 0x42ba1a
call ebx
push eax
push str.GetModuleBaseName_failed.___1_d___n
jmp 0x42b9e0
lea eax, [ebp - 0x218]
push eax
push str.GetModuleName___1_s___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00405a24
lea eax, [ebp - 0x218]
push str.explorer.exe
push eax
call fcn.0043933f
add esp, 0x18
test eax, eax
jne 0x42b9ef
push str.Hit_explorer.exe__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00405a24
add esp, 0xc
cmp dword [ebp - 0x14e0], 0xffffffff
je 0x42bacd
or dword [ebp - 0x14e4], 0xffffffff
lea eax, [ebp - 0x14e4]
push eax
push dword [ebp - 0x14f8]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x42ba92
call ebx
push eax
push str.ProcessIdToSessionId_failed.___1_d___n
jmp 0x42b9e0
mov eax, dword [ebp - 0x14e0]
cmp dword [ebp - 0x14e4], eax
je 0x42bab9
push str.not_ActiveSessionId_n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00405a24
add esp, 0xc
jmp 0x42b9ef
push str.Hit_SessionId__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00405a24
add esp, 0xc
and dword [ebp - 0x14dc], 0
lea eax, [ebp - 0x14dc]
push eax
push 0xb
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42baf5
call ebx
push eax
push str.OpenProcessToken_failed.___1_d___n
jmp 0x42b9e0
push str.Get_ProcessToken.__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00405a24
mov eax, dword [ebp - 0x14e8]
add esp, 0xc
xor ecx, ecx
push eax
push 1
push 2
push ecx
push ecx
push dword [ebp - 0x14dc]
mov dword [eax], ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0x14d8], eax
test eax, eax
jne 0x42bb4f
mov ecx, dword [ebp - 0x14e8]
and dword [ecx], eax
call ebx
push eax
push str.DuplicateTokenEx_failed.___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00405a24
add esp, 0x10
push str.Get_DuplicateToken.__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00405a24
add esp, 0xc
push dword [ebp - 0x14dc]
call edi
and dword [ebp - 0x14dc], 0
push esi
call edi
mov esi, dword [ebp - 0x14d8]
test esi, esi
jne 0x42bb98
mov ecx, dword [ebp - 0x14f0]
inc ecx
mov dword [ebp - 0x14f0], ecx
cmp ecx, dword [ebp - 0x14fc]
jb 0x42b930
mov edi, str.CUserPrivilege::GetExplorerUserToken
push dword [ebp - 0x1500]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x4565b0
push edi
push 5
call fcn.00405a24
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x14d4]
call fcn.004338c2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438628
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.EnumProcesses_failed.___1_d___n
jmp 0x42b8c5