Function at 0x403785
Capabilities:
Enumerate processes
Get session information

Disassembly:
push 0x654
mov eax, 0x42891e
call fcn.00416f86
mov ebx, 0x45d678
mov esi, ebx
call fcn.00404967
mov esi, 0x45d668
call fcn.00404967
xor edi, edi
push edi
push 2
mov dword [ebp - 0x244], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x650], eax
je 0x403abc
lea ecx, [ebp - 0x244]
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4037ef
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403abc
push str.explorer.exe
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40389b
push 0x408
lea eax, [ebp - 0x64c]
push edi
push eax
call fcn.004149e0
mov eax, dword [ebp - 0x23c]
add esp, 0xc
push eax
mov dword [ebp - 0x64c], eax
call fcn.00403bf9
mov dword [ebp - 0x648], eax
call fcn.0040ac1e
push eax
lea ecx, [ebp - 0x654]
call fcn.00407a65
lea eax, [ebp - 0x654]
push eax
mov dword [ebp - 4], edi
push dword [ebp - 0x23c]
call fcn.00403ac2
test eax, eax
je 0x40387b
push edi
lea ecx, [ebp - 0x654]
call fcn.004081ca
push eax
lea eax, [ebp - 0x644]
push eax
call fcn.0041663c
pop ecx
pop ecx
lea eax, [ebp - 0x64c]
push eax
mov eax, ebx
call fcn.00404904
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x654]
add ecx, 0xfffffff0
call fcn.00407a4b
push str.winlogon.exe
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40394b
push 0x408
lea eax, [ebp - 0x64c]
push edi
push eax
call fcn.004149e0
mov eax, dword [ebp - 0x23c]
add esp, 0xc
push eax
mov dword [ebp - 0x64c], eax
call fcn.00403bf9
mov dword [ebp - 0x648], eax
call fcn.0040ac1e
push eax
lea ecx, [ebp - 0x658]
call fcn.00407a65
lea eax, [ebp - 0x658]
push eax
mov dword [ebp - 4], 1
push dword [ebp - 0x23c]
call fcn.00403ac2
test eax, eax
je 0x40392b
push edi
lea ecx, [ebp - 0x658]
call fcn.004081ca
push eax
lea eax, [ebp - 0x644]
push eax
call fcn.0041663c
pop ecx
pop ecx
lea eax, [ebp - 0x64c]
push eax
mov eax, esi
call fcn.00404904
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x658]
add ecx, 0xfffffff0
call fcn.00407a4b
lea eax, [ebp - 0x244]
push eax
push dword [ebp - 0x650]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4037ef
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov dword [ebp - 0x654], edi
call fcn.0040488d
test eax, eax
jle 0x403abc
push dword [ebp - 0x654]
mov eax, esi
mov dword [ebp - 0x650], edi
mov dword [ebp - 0x660], edi
mov dword [ebp - 0x65c], edi
call fcn.004048a5
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x65c]
push eax
push 8
push ebx
push edi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
mov eax, dword [ebp - 0x65c]
je 0x4039df
cmp dword [ebp - 0x660], 4
jne 0x4039df
xor ecx, ecx
cmp dword [eax], edi
sete cl
mov dword [ebp - 0x650], ecx
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 0x650], edi
jne 0x403a07
inc dword [ebp - 0x654]
mov eax, esi
call fcn.0040488d
cmp dword [ebp - 0x654], eax
jl 0x403986
jmp 0x403abc
mov dword [0x45cc08], ebx
call fcn.0040ac1e
push eax
lea ecx, [ebp - 0x650]
call fcn.00407a65
mov dword [ebp - 4], 2
push dword [ebp - 0x654]
mov eax, esi
call fcn.004048a5
add eax, 8
push eax
push ebx
lea eax, [ebp - 0x650]
push str._PCFILTER__PCFILTERService_:_Active_Session_ID_:__d__User_Name_:__s
push eax
call fcn.004082f5
push dword [ebp - 0x650]
mov ecx, 0x45d688
call fcn.00401473
add esp, 0x14
mov edi, 0x45d654
push 0x4511e0
mov ecx, edi
call fcn.00404ac6
test eax, eax
je 0x403a7c
cmp dword [0x45a074], 0x2710
jne 0x403aae
push dword [ebp - 0x654]
mov eax, esi
call fcn.004048a5
add eax, 8
push eax
mov ecx, edi
call fcn.004081a5
push ecx
mov dword [ebp - 0x658], esp
mov ecx, esp
push edi
mov dword [0x45a074], ebx
call fcn.004082d7
call fcn.00402492
mov ecx, dword [ebp - 0x650]
add ecx, 0xfffffff0
call fcn.00407a4b
call fcn.00417009
ret