Function at 0x45bbd0
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
call fcn.00457cac
mov esi, eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45bc07
mov ebx, 0xffffff9b
jmp 0x45be09
mov dword [ebp - 0x1a8], 0x128
lea eax, [ebp - 0x1a8]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x45bc2c
mov ebx, 0xffffff91
jmp 0x45be09
push 0x5d560b
lea eax, [ebp - 0x184]
push eax
call fcn.004ce170
add esp, 8
test eax, eax
jne 0x45bc6a
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x1a0]
push ecx
call fcn.00457bb0
add esp, 8
test eax, eax
je 0x45bc6a
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jne 0x45bc6a
mov edi, dword [ebp - 0x1a0]
jmp 0x45bc7b
lea eax, [ebp - 0x1a8]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x45bc2c
push esi
call fcn.00457ce8
pop ecx
mov dword [ebp - 4], eax
push edi
push 0
push 0x2000000
call sub.KERNEL32.dll_OpenProcess
mov edi, eax
lea edx, [ebp - 0xc]
push edx
push 0x201eb
push edi
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
jne 0x45bcb1
mov ebx, 0xffffff87
jmp 0x45be09
lea eax, [ebp - 0x14]
push eax
push 0x5d5618
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x45bccf
mov ebx, 0xffffff7d
jmp 0x45be09
mov dword [ebp - 0x80], 1
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 2
push edx
push 1
push 1
push 0
push 0x2000000
mov ecx, dword [ebp - 0xc]
push ecx
call sub.ADVAPI32.dll_DuplicateTokenEx
push 4
push esi
push 0xc
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_SetTokenInformation
push 0
push 0
push 0x10
lea edx, [ebp - 0x80]
push edx
push 0
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.dll_AdjustTokenPrivileges
test eax, eax
jne 0x45bd32
mov ebx, 0xffffff73
jmp 0x45be09
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x514
push 1
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x18]
push eax
push edx
mov ebx, 0x30
call fcn.00457c04
add esp, 0xc
test eax, eax
je 0x45bd5f
or ebx, 0x400
jmp 0x45bd64
xor ecx, ecx
mov dword [ebp - 0x18], ecx
push 0x44
push 0
lea eax, [ebp - 0x70]
push eax
call fcn.004cde6c
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x68], 0x5d5629
mov esi, dword [ebp + 0x10]
add esp, 0xc
and esi, 0x100
test esi, esi
je 0x45bd96
mov dword [ebp - 0x68], 0x5d5639
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004cde6c
add esp, 0xc
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x70]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp - 0x18]
push edx
push ebx
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_CreateProcessAsUserA
test eax, eax
jne 0x45bdd7
mov ebx, 0xffffff2e
jmp 0x45bde8
xor ebx, ebx
test esi, esi
je 0x45bde8
push 0xffffffffffffffff
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
push edi
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret