Function at 0x403c20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x42c008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x800
lea eax, [ebp - 0x808]
mov dword [ebp - 0xa3c], 0
push 0
push eax
call fcn.0040ce90
add esp, 0xc
cmp dword [0x42d3bc], 0
je 0x403c88
push str.ServiceImpersonateLoggedInToCurrentUser
push str._S___start
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp dword [0x42d3bc], 0
mov edi, eax
je 0x403cbe
push edi
push str.WTSGetActiveConsoleSessionId_dwSessionId__08X
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp dword [0x42d3bc], 0
mov esi, eax
je 0x403cf8
push esi
push str.CreateToolhelp32Snapshot:hSnap__08X
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
cmp esi, 0xffffffff
jne 0x403d13
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040aea4
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xa38], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x403cfd
cmp dword [0x42d3bc], 0
je 0x403d63
lea eax, [ebp - 0xa14]
push eax
push str.Process32First_procEntry__s
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [eax]
cmp dword [0x42d3bc], 0
je 0x403da4
lea eax, [ebp - 0xa14]
push eax
push str.Process32Next_procEntry__s
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
push str.explorer.exe
lea eax, [ebp - 0xa14]
push eax
call ebx
test eax, eax
jne 0x403ddf
mov dword [ebp - 0xa40], eax
lea eax, [ebp - 0xa40]
push eax
push dword [ebp - 0xa30]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x403ddf
cmp dword [ebp - 0xa40], edi
je 0x403f1c
lea eax, [ebp - 0xa38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x403d70
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xa3c]
push eax
push 0x201eb
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x403e54
call ebx
cmp dword [0x42d3bc], 0
je 0x403e54
call ebx
push eax
push str.Process_token_open_Error:__u_n
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
call dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
cmp dword [0x42d3bc], 0
je 0x403ebb
push eax
push str.RegDisablePredefinedCacheEx_lResult:_08X
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
cmp dword [0x42d3bc], 0
je 0x403ebb
push dword [ebp - 0xa3c]
lea eax, [ebp - 0x808]
push str.ImpersonateLoggedOnUser_hPToken:_08X
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
push dword [ebp - 0xa3c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
cmp dword [0x42d3bc], 0
mov edi, eax
je 0x403ef7
push edi
push str.ImpersonateLoggedOnUser_result:_d
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
test edi, edi
jne 0x403f27
call ebx
push edi
call ebx
push eax
push str.ImpersonateLoggedOnUser_failed_GetLastError__:_08X__result:_d
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x14
jmp 0x403f4a
mov eax, dword [ebp - 0xa30]
jmp 0x403df5
cmp dword [0x42d3bc], 0
je 0x403f55
push edi
push str.ImpersonateLoggedOnUser_Passed__result:_d
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x403fca
cmp dword [0x42d3bc], 0
je 0x403f8d
push esi
push str.Close_hProcess__d
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
push esi
call ebx
test eax, eax
jne 0x403f9c
push esi
push str.CloseHandle__hProcess__Failed__d
jmp 0x403fab
cmp dword [0x42d3bc], 0
je 0x403fca
push esi
push str.CloseHandle__hProcess__Passed__d
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
mov eax, dword [ebp - 0xa3c]
test eax, eax
je 0x40405d
cmp dword [0x42d3bc], 0
je 0x40400c
push eax
push str.Close_hPToken__d
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
mov eax, dword [ebp - 0xa3c]
push eax
call ebx
test eax, eax
jne 0x404020
push dword [ebp - 0xa3c]
push str.CloseHandle__hPToken__Failed__d
jmp 0x404034
cmp dword [0x42d3bc], 0
je 0x404053
push dword [ebp - 0xa3c]
push str.CloseHandle__hPToken__Passed__d
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
mov dword [ebp - 0xa3c], 0
cmp dword [0x42d3bc], 0
je 0x404090
push edi
push str.ServiceImpersonateLoggedInToCurrentUser
push str._S___end_return:_08X
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x14
lea ecx, [ebp - 0x808]
call fcn.004035d0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aea4
mov esp, ebp
pop ebp
ret