Function at 0x43be90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43c105
push ebx
push esi
push edi
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push 0xc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x43c0ef
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
push str.SeTcbPrivilege
push 0
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x43c040
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x43c040
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x18], 0
push ecx
push eax
mov dword [ebp - 0x270], 0x22c
mov esi, 0x490
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43c039
lea eax, [ebp - 0x24c]
push str.winlogon.exe
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x43c021
push dword [ebp - 0x268]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x43c015
lea eax, [ebp - 4]
push eax
push 0xa
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43c00a
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
test eax, eax
je 0x43c000
cmp dword [ebp - 0x24], 0
je 0x43c000
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x43c000
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], eax
jne 0x43c000
lea eax, [ebp - 0xc]
mov dword [ebp - 0x18], 1
push eax
push 2
push 2
push 0
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x43bffc
xor esi, esi
jmp 0x43c000
call edi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
jmp 0x43c01b
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0
jne 0x43c039
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x43bf52
push dword [ebp - 0x1c]
call ebx
jmp 0x43c04a
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, eax
test esi, esi
jne 0x43c0f7
push dword [ebp - 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x43c0d8
push dword [ebp - 8]
push 1
push esi
push esi
push 0x8b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x43c0bb
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
mov eax, dword [ebp - 8]
push 0x1a
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x43c0bf
call edi
mov esi, eax
mov eax, dword [ebp - 8]
push dword [eax]
call ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0x10]
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0x10]
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edi
push dword [ebp - 0xc]
mov esi, eax
call ebx
push dword [ebp - 0x10]
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 0x10]
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret