Function at 0x460d4d
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad052
mov eax, dword fs:[0]
push eax
mov eax, 0x14f8
call fcn.0058c7d0
mov eax, dword [0x634460]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0x5d19f4
mov edi, str.CUserPrivilege::GetExplorerUserToken
push edi
push 5
mov dword [ebp - 0x14e8], ebx
call fcn.00423f75
add esp, 0xc
lea ecx, [ebp - 0x14d4]
call fcn.0046e7a3
xor eax, eax
push 0xffc
mov esi, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebx], eax
mov dword [ebp - 0x1218], eax
lea eax, [ebp - 0x1214]
push eax
mov dword [ebp - 0x14d8], esi
call fcn.00587a70
push str.psapi.dll
call fcn.004042ad
add esp, 0x10
mov dword [ebp - 0x1500], eax
test eax, eax
jne 0x460dfb
push str.psapi.dll_SAW_LoadLibrary_failed._n
push edi
push 4
call fcn.00423f75
add esp, 0xc
jmp 0x461144
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x460e1f
push str.kernel32.dll_GetModuleHandle_failed._n
push edi
push 4
call fcn.00423f75
add esp, 0xc
jmp 0x461138
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x460e36
push str.WTSGetActiveConsoleSessionId_GetProcAddress_failed._n
jmp 0x460e0f
or dword [ebp - 0x14e0], 0xffffffff
cmp dword [ebp - 0x1468], esi
je 0x460e70
call eax
mov ebx, eax
mov dword [ebp - 0x14e0], ebx
cmp ebx, 0xffffffff
jne 0x460e70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WTSGetActiveConsoleSessionId_failed.___1_d___n
push edi
push 4
call fcn.00423f75
add esp, 0x10
jmp 0x461138
push str.EnumProcesses_Start_._n
push edi
push 4
call fcn.00423f75
add esp, 0xc
lea eax, [ebp - 0x14f4]
push eax
push 0x1000
lea eax, [ebp - 0x1218]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x461181
mov eax, dword [ebp - 0x14f4]
shr eax, 2
xor ecx, ecx
mov dword [ebp - 0x14fc], eax
mov dword [ebp - 0x14f0], ecx
test eax, eax
je 0x461138
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + ecx*4 - 0x1218]
push esi
push str.GetProcessID___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
mov dword [ebp - 0x14f8], esi
call fcn.00423f75
add esp, 0x10
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x460f23
call ebx
push eax
push str.OpenProcess_failed.___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00423f75
add esp, 0x10
mov esi, dword [ebp - 0x14d8]
jmp 0x46111a
push str.GetProcessHandle.__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00423f75
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00587a70
and dword [ebp - 0x14ec], 0
add esp, 0x18
lea eax, [ebp - 0x1504]
push eax
push 4
lea eax, [ebp - 0x14ec]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x460f8f
call ebx
push eax
push str.EnumProcessModules_failed.___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00423f75
add esp, 0x10
push esi
call edi
jmp 0x460f18
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x14ec]
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
jne 0x460fb5
call ebx
push eax
push str.GetModuleBaseName_failed.___1_d___n
jmp 0x460f7b
lea eax, [ebp - 0x218]
push eax
push str.GetModuleName___1_s___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00423f75
lea eax, [ebp - 0x218]
push str.explorer.exe
push eax
call fcn.0058b527
add esp, 0x18
test eax, eax
jne 0x460f8a
push str.Hit_explorer.exe__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00423f75
add esp, 0xc
cmp dword [ebp - 0x14e0], 0xffffffff
je 0x461068
or dword [ebp - 0x14e4], 0xffffffff
lea eax, [ebp - 0x14e4]
push eax
push dword [ebp - 0x14f8]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x46102d
call ebx
push eax
push str.ProcessIdToSessionId_failed.___1_d___n
jmp 0x460f7b
mov eax, dword [ebp - 0x14e0]
cmp dword [ebp - 0x14e4], eax
je 0x461054
push str.not_ActiveSessionId_n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00423f75
add esp, 0xc
jmp 0x460f8a
push str.Hit_SessionId__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00423f75
add esp, 0xc
and dword [ebp - 0x14dc], 0
lea eax, [ebp - 0x14dc]
push eax
push 0xb
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x461090
call ebx
push eax
push str.OpenProcessToken_failed.___1_d___n
jmp 0x460f7b
push str.Get_ProcessToken.__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00423f75
mov eax, dword [ebp - 0x14e8]
add esp, 0xc
xor ecx, ecx
push eax
push 1
push 2
push ecx
push ecx
push dword [ebp - 0x14dc]
mov dword [eax], ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0x14d8], eax
test eax, eax
jne 0x4610ea
mov ecx, dword [ebp - 0x14e8]
and dword [ecx], eax
call ebx
push eax
push str.DuplicateTokenEx_failed.___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00423f75
add esp, 0x10
push str.Get_DuplicateToken.__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00423f75
add esp, 0xc
push dword [ebp - 0x14dc]
call edi
and dword [ebp - 0x14dc], 0
push esi
call edi
mov esi, dword [ebp - 0x14d8]
test esi, esi
jne 0x461133
mov ecx, dword [ebp - 0x14f0]
inc ecx
mov dword [ebp - 0x14f0], ecx
cmp ecx, dword [ebp - 0x14fc]
jb 0x460ecb
mov edi, str.CUserPrivilege::GetExplorerUserToken
push dword [ebp - 0x1500]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x5d1a10
push edi
push 5
call fcn.00423f75
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x14d4]
call fcn.0046ee6e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588a1c
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.EnumProcesses_failed.___1_d___n
jmp 0x460e60