Function at 0x461e50
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3fec
mov eax, dword fs:[0]
push eax
mov eax, 0x14f8
call fcn.00593490
mov eax, dword [0x637190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, str.CUserPrivilege::GetExplorerUserToken
push 0x5d7aa4
push edi
push 5
mov dword [ebp - 0x14e8], ebx
call fcn.00424dad
add esp, 0xc
lea ecx, [ebp - 0x14d4]
call fcn.0046f9cd
xor eax, eax
push 0xffc
mov esi, eax
mov dword [ebp - 4], eax
push eax
mov dword [ebx], eax
mov dword [ebp - 0x1218], eax
lea eax, [ebp - 0x1214]
push eax
mov dword [ebp - 0x14d8], esi
call fcn.0058e700
push str.psapi.dll
call fcn.00405177
add esp, 0x10
mov dword [ebp - 0x1500], eax
test eax, eax
jne 0x461efe
push str.psapi.dll_SAW_LoadLibrary_failed._n
push edi
push 4
call fcn.00424dad
add esp, 0xc
jmp 0x462247
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x461f22
push str.kernel32.dll_GetModuleHandle_failed._n
push edi
push 4
call fcn.00424dad
add esp, 0xc
jmp 0x46223b
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x461f39
push str.WTSGetActiveConsoleSessionId_GetProcAddress_failed._n
jmp 0x461f12
or dword [ebp - 0x14e0], 0xffffffff
cmp dword [ebp - 0x1468], esi
je 0x461f73
call eax
mov ebx, eax
mov dword [ebp - 0x14e0], ebx
cmp ebx, 0xffffffff
jne 0x461f73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WTSGetActiveConsoleSessionId_failed.___1_d___n
push edi
push 4
call fcn.00424dad
add esp, 0x10
jmp 0x46223b
push str.EnumProcesses_Start_._n
push edi
push 4
call fcn.00424dad
add esp, 0xc
lea eax, [ebp - 0x14f4]
push eax
push 0x1000
lea eax, [ebp - 0x1218]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x462286
mov eax, dword [ebp - 0x14f4]
xor ecx, ecx
shr eax, 2
mov dword [ebp - 0x14fc], eax
mov dword [ebp - 0x14f0], ecx
test eax, eax
je 0x46223b
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + ecx*4 - 0x1218]
push esi
push str.GetProcessID___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
mov dword [ebp - 0x14f8], esi
call fcn.00424dad
add esp, 0x10
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x462026
call ebx
push eax
push str.OpenProcess_failed.___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00424dad
add esp, 0x10
mov esi, dword [ebp - 0x14d8]
jmp 0x46221d
push str.GetProcessHandle.__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00424dad
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0058e700
and dword [ebp - 0x14ec], 0
lea eax, [ebp - 0x1504]
add esp, 0x18
push eax
push 4
lea eax, [ebp - 0x14ec]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x462092
call ebx
push eax
push str.EnumProcessModules_failed.___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00424dad
add esp, 0x10
push esi
call edi
jmp 0x46201b
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x14ec]
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
jne 0x4620b8
call ebx
push eax
push str.GetModuleBaseName_failed.___1_d___n
jmp 0x46207e
lea eax, [ebp - 0x218]
push eax
push str.GetModuleName___1_s___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00424dad
lea eax, [ebp - 0x218]
push str.explorer.exe
push eax
call fcn.005921d4
add esp, 0x18
test eax, eax
jne 0x46208d
push str.Hit_explorer.exe__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00424dad
add esp, 0xc
cmp dword [ebp - 0x14e0], 0xffffffff
je 0x46216b
or dword [ebp - 0x14e4], 0xffffffff
lea eax, [ebp - 0x14e4]
push eax
push dword [ebp - 0x14f8]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x462130
call ebx
push eax
push str.ProcessIdToSessionId_failed.___1_d___n
jmp 0x46207e
mov eax, dword [ebp - 0x14e0]
cmp dword [ebp - 0x14e4], eax
je 0x462157
push str.not_ActiveSessionId_n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00424dad
add esp, 0xc
jmp 0x46208d
push str.Hit_SessionId__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00424dad
add esp, 0xc
and dword [ebp - 0x14dc], 0
lea eax, [ebp - 0x14dc]
push eax
push 0xb
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x462193
call ebx
push eax
push str.OpenProcessToken_failed.___1_d___n
jmp 0x46207e
push str.Get_ProcessToken.__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00424dad
mov eax, dword [ebp - 0x14e8]
add esp, 0xc
xor ecx, ecx
push eax
push 1
push 2
push ecx
push ecx
push dword [ebp - 0x14dc]
mov dword [eax], ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0x14d8], eax
test eax, eax
jne 0x4621ed
mov ecx, dword [ebp - 0x14e8]
and dword [ecx], eax
call ebx
push eax
push str.DuplicateTokenEx_failed.___1_d___n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00424dad
add esp, 0x10
push str.Get_DuplicateToken.__n
push str.CUserPrivilege::GetExplorerUserToken
push 4
call fcn.00424dad
add esp, 0xc
push dword [ebp - 0x14dc]
call edi
and dword [ebp - 0x14dc], 0
push esi
call edi
mov esi, dword [ebp - 0x14d8]
test esi, esi
jne 0x462236
mov ecx, dword [ebp - 0x14f0]
inc ecx
mov dword [ebp - 0x14f0], ecx
cmp ecx, dword [ebp - 0x14fc]
jb 0x461fce
mov edi, str.CUserPrivilege::GetExplorerUserToken
push dword [ebp - 0x1500]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x5d7ac0
push edi
push 5
call fcn.00424dad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14d4]
add esp, 0xc
call fcn.0047009a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058f6bb
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.EnumProcesses_failed.___1_d___n
jmp 0x461f63