Function at 0x41cc90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x43b274]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
jne 0x41cd3b
jmp 0x41cf49
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41cd9a
lea eax, [ebp - 0x214]
push eax
push str.explorer.exe
call dword [sym.imp.MSVCR80.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x41cd83
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x250], ecx
jmp 0x41cd9a
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41cd5c
cmp dword [ebp - 0x250], 0
jne 0x41cdad
jmp 0x41cf49
mov ecx, dword [ebp - 0x250]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jne 0x41cdda
jmp 0x41cf49
lea edx, [ebp - 0x244]
push edx
push 8
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41cdfe
jmp 0x41cf49
lea ecx, [ebp - 0x24c]
push ecx
push 0
push 0
push 1
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [ebp - 0x258], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x41ce33
jmp 0x41cf49
mov eax, dword [ebp - 0x24c]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x41ce62
jmp 0x41cf49
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x23c]
push eax
push 1
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jne 0x41ce9f
jmp 0x41cf49
mov edx, dword [ebp - 0x23c]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x41cf49
mov dword [ebp - 0x25c], 0
push str.ConvertSidToStringSidW
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jne 0x41ceea
jmp 0x41cf49
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x23c]
mov eax, dword [edx]
push eax
call dword [ebp - 0x25c]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x25c], 0
cmp dword [ebp - 0x258], 0
je 0x41cf49
cmp dword [ebp - 0x240], 0
je 0x41cf49
mov ecx, dword [ebp - 0x240]
push ecx
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x240], 0
cmp dword [ebp - 0x254], 0
je 0x41cf69
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x254], 0
cmp dword [ebp - 0x244], 0
je 0x41cf89
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x244], 0
cmp dword [ebp - 0x248], 0
je 0x41cfa9
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x248], 0
cmp dword [ebp - 0x23c], 0
je 0x41cfd2
mov eax, dword [ebp - 0x23c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042279c
mov esp, ebp
pop ebp
ret 4