Function at 0x1400497e8
Capabilities:
Enumerate process modules

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1540
call fcn.14006c5a0
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x1570], rbx
mov qword [rsp + 0x1580], rbp
mov qword [rsp + 0x1588], rsi
mov rax, qword [0x140099938]
xor rax, rsp
mov qword [rsp + 0x1530], rax
mov rbx, rdx
mov qword [rsp + 0x48], rdx
lea r8, [0x140081e20]
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, 5
call fcn.140009480
lea rcx, [rsp + 0x1070]
call fcn.140055364
nop
xor edi, edi
mov qword [rbx], rdi
mov r15d, edi
mov dword [rsp + 0x70], edi
xor edx, edx
mov r8d, 0xffc
lea rcx, [rsp + 0x74]
call fcn.14005bb90
lea rcx, str.psapi.dll
call fcn.140002494
mov qword [rsp + 0x58], rax
cmp rax, rdi
jne 0x1400498af
lea r8, str.psapi.dll_SAW_LoadLibrary_failed._n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
lea ecx, [rdi + 4]
call fcn.140009480
jmp 0x140049ccf
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, rdi
jne 0x1400498de
lea r8, str.kernel32.dll_GetModuleHandle_failed._n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, 4
call fcn.140009480
jmp 0x140049cc4
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rdi
jne 0x140049910
lea r8, str.WTSGetActiveConsoleSessionId_GetProcAddress_failed._n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, 4
call fcn.140009480
jmp 0x140049cc4
or ebx, 0xffffffff
mov ebp, ebx
cmp dword [rsp + 0x10d4], edi
je 0x14004994c
call rax
mov ebp, eax
cmp eax, ebx
jne 0x14004994c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.WTSGetActiveConsoleSessionId_failed.___1_d___n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, 4
call fcn.140009480
jmp 0x140049cc4
lea r8, str.EnumProcesses_Start_._n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ebx, 4
mov ecx, ebx
call fcn.140009480
lea r8, [rsp + 0x40]
mov edx, 0x1000
lea rcx, [rsp + 0x70]
call sub.PSAPI.DLL_EnumProcesses
cmp eax, edi
je 0x140049ca6
mov esi, dword [rsp + 0x40]
shr esi, 2
mov r13d, edi
cmp esi, edi
jbe 0x140049cc4
lea r14, [rsp + 0x70]
mov r12d, dword [r14]
mov r9d, r12d
lea r8, str.GetProcessID___1_d___n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
mov r8d, r12d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
xor eax, eax
cmp rdi, rax
jne 0x1400499f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.OpenProcess_failed.___1_d___n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
jmp 0x140049c95
lea r8, str.GetProcessHandle.__n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
xor eax, eax
mov word [rsp + 0x1320], ax
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1322]
call fcn.14005bb90
xor eax, eax
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x50]
lea r8d, [rax + 8]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x140049a72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.EnumProcessModules_failed.___1_d___n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140049c95
mov r9d, 0x104
lea r8, [rsp + 0x1320]
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
jne 0x140049abd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.GetModuleBaseName_failed.___1_d___n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140049c95
lea r9, [rsp + 0x1320]
lea r8, str.GetModuleName___1_s___n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x1320]
call fcn.14005c7d4
test eax, eax
je 0x140049b00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140049c95
lea r8, str.Hit_explorer.exe__n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
or eax, 0xffffffff
cmp ebp, eax
je 0x140049ba6
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x30]
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
xor r12d, r12d
cmp eax, r12d
jne 0x140049b66
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.ProcessIdToSessionId_failed.___1_d___n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140049c95
cmp dword [rsp + 0x30], ebp
je 0x140049b8f
lea r8, str.not_ActiveSessionId_n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140049c95
lea r8, str.Hit_SessionId__n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
jmp 0x140049ba9
xor r12d, r12d
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x38]
mov edx, 0xb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, r12d
jne 0x140049bf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.OpenProcessToken_failed.___1_d___n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140049c95
lea r8, str.Get_ProcessToken.__n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
mov r12, qword [rsp + 0x48]
xor eax, eax
mov qword [r12], rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 1
lea r9d, [rax + 2]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov r15d, eax
xor eax, eax
cmp r15d, eax
jne 0x140049c5f
mov qword [r12], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.DuplicateTokenEx_failed.___1_d___n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
lea r8, str.Get_DuplicateToken.__n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r15d, r12d
jne 0x140049cc4
inc r13d
add r14, rbx
cmp r13d, esi
jb 0x140049999
jmp 0x140049cc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.EnumProcesses_failed.___1_d___n
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, ebx
call fcn.140009480
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [0x140081e40]
lea rdx, str.CUserPrivilege::GetExplorerUserToken
mov ecx, 5
call fcn.140009480
nop
lea rcx, [rsp + 0x1070]
call fcn.140055358
mov eax, r15d
mov rcx, qword [rsp + 0x1530]
xor rcx, rsp
call fcn.14005bad0
lea r11, [rsp + 0x1540]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret