Function at 0x10002ca0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x278
mov eax, dword [0x1001e00c]
xor eax, esp
mov dword [esp + 0x274], eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x14]
push esi
push edi
push ecx
push 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], eax
push ecx
push 0
push 0
push 4
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
push 1
push eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x50], xmm0
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
je 0x10002d12
push eax
push str.GetNamedSecurityInfo_Error__u_n
jmp 0x10002ee8
push 0x228
lea eax, [esp + 0x50]
mov dword [esp + 0x14], 0
push 0
push eax
call fcn.10005880
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10002ee1
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10002dea
nop
push str.EXPLORER.EXE
call fcn.10007d02
add esp, 4
mov esi, eax
lea eax, [esp + 0x6c]
push eax
call fcn.10007d02
add esp, 4
nop dword [eax]
mov cx, word [eax]
cmp cx, word [esi]
jne 0x10002da6
test cx, cx
je 0x10002da2
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x10002da6
add eax, 4
add esi, 4
test cx, cx
jne 0x10002d80
xor eax, eax
jmp 0x10002dab
sbb eax, eax
or eax, 1
test eax, eax
je 0x10002dc4
lea eax, [esp + 0x48]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10002d60
lea esi, [eax + 1]
jmp 0x10002dec
push dword [esp + 0x50]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x10]
push ecx
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
jmp 0x10002dec
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10002ee1
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x278]
push eax
mov dword [esp + 0x27c], 0
call fcn.10002bd0
mov edi, eax
add esp, 4
test edi, edi
jne 0x10002e2b
push eax
push str.GetNamedSecurityInfo_Error__u_n
jmp 0x10002ee8
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x1f01ff
mov dword [esp + 0x28], 3
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 5
mov eax, dword [edi]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov esi, eax
test esi, esi
je 0x10002e93
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push str.SetEntriesInAcl_Error__u_n
jmp 0x10002ee8
push 0
push dword [esp + 0x1c]
push 0
push 0
push 4
push 1
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test esi, esi
je 0x10002ebf
push esi
push str.SetNamedSecurityInfo_Error__u_n
call fcn.100010d0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
sete al
pop edi
pop esi
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.10003c5b
mov esp, ebp
pop ebp
ret 4
push 0
push str.GetTokenByName_Error__u_n
call fcn.100010d0
mov ecx, dword [esp + 0x284]
add esp, 8
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.10003c5b
mov esp, ebp
pop ebp
ret 4