Function at 0x451d70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2026
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x53d9f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x25c], eax
test eax, eax
jne 0x451dd2
push str.Invalid_Args.
push str.kupdate::KProcessUtils::GetCurrentUserToken
push 0x10b
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push eax
call fcn.00412750
add esp, 0x14
mov eax, 0x80070057
jmp 0x452176
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x452140
cmp dword [ebp - 0x240], 0xffffffff
je 0x452140
xor eax, eax
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x250], esi
mov dword [ebp - 4], esi
cmp word [str.explorer.exe], si
je 0x4520c0
push 0x228
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x22c
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x451e9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x451e79
movzx eax, ax
or eax, 0x80070000
push eax
push str.Failed_CreateToolhelp32Snapshot:_0x_08x.
push str.kupdate::KProcessUtils::GetProcessPid
push 0x92
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x18
jmp 0x4520de
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x451f24
mov edi, edi
lea eax, [ebp - 0x218]
push str.explorer.exe
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x451eff
cmp ebx, esi
je 0x451ee0
mov eax, dword [ebp - 0x234]
mov dword [ebx], eax
add ebx, 4
mov dword [ebp - 0x254], ebx
jmp 0x451eff
lea eax, [ebp - 0x234]
push eax
push ebx
lea ecx, [ebp - 0x258]
call fcn.00451630
mov esi, dword [ebp - 0x250]
mov ebx, dword [ebp - 0x254]
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x451eb0
mov dword [ebp - 0x24c], esi
mov esi, dword [ebp - 0x258]
mov dword [ebp - 0x244], esi
jmp 0x451f57
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x451f36
movzx eax, ax
or eax, 0x80070000
push eax
push str.Failed_Process32First:_0x_08x.
push str.kupdate::KProcessUtils::GetProcessPid
push 0x9f
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x18
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
setne al
test al, al
je 0x4520e0
mov edi, esi
cmp edi, ebx
je 0x4520fe
jmp 0x451f80
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0xffffffff
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x451fd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x451faf
movzx eax, ax
or eax, 0x80070000
push eax
push str.Failed_ProcessIdToSessionId:_0x_08x.
push str.kupdate::KProcessUtils::GetCurrentUserToken
push pe_nt_image_headers32
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 5
call fcn.00412750
add esp, 0x18
jmp 0x45209c
mov eax, dword [ebp - 0x248]
cmp eax, dword [ebp - 0x240]
jne 0x45209c
push dword [edi]
push 0
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x260], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x452057
cmp esi, 0xffffffff
je 0x452057
push dword [ebp - 0x25c]
push 0xf
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4520af
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x452032
movzx eax, ax
or eax, 0x80070000
push eax
push str.Failed_OpenProcessToken:_0x_08x.
push str.kupdate::KProcessUtils::GetCurrentUserToken
push 0x13b
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x18
mov byte [ebp - 4], 0
jmp 0x452095
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x452069
movzx eax, ax
or eax, 0x80070000
push eax
push str.Failed_OpenProcess:_0x_08x.
push str.kupdate::KProcessUtils::GetCurrentUserToken
push 0x130
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 5
call fcn.00412750
add esp, 0x18
mov byte [ebp - 4], 0
test esi, esi
je 0x45209c
cmp esi, 0xffffffff
je 0x45209c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 4
cmp edi, ebx
jne 0x451f80
mov esi, dword [ebp - 0x244]
jmp 0x4520fe
push esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x244]
jmp 0x452103
push str.Invalid_Args.
push str.kupdate::KProcessUtils::GetProcessPid
push 0x89
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x14
xor esi, esi
push str.Failed_GetProcessPid.
push str.kupdate::KProcessUtils::GetCurrentUserToken
push 0x11c
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x14
mov ebx, 0x80004005
test esi, esi
je 0x45213c
mov ecx, dword [ebp - 0x24c]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x452132
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x452132
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.004bee2d
add esp, 8
mov eax, ebx
jmp 0x452176
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x452155
movzx esi, si
or esi, 0x80070000
push esi
push str.Failed_GetCurrendSessionId:_0x_08x.
push str.kupdate::KProcessUtils::GetCurrentUserToken
push 0x116
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x18
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bee49
mov esp, ebp
pop ebp
ret