Function at 0x4e7080
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push ebx
push esi
push edi
mov dword [ebp - 0x46c], eax
mov byte [eax], 0
call fcn.004e7380
mov eax, dword [0x648d3c]
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x468], esi
test eax, eax
jne 0x4e7280
push str.kernel32.dll
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4e732b
push str.WTSGetActiveConsoleSessionId
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4e70fc
call eax
mov edi, eax
or eax, 0xffffffff
cmp edi, 0xffffffff
cmove edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, 0xffffffff
je 0x4e732b
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e732b
lea eax, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4e732b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x4e732b
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x4e7160
lea eax, [ebp - 0x438]
push str.explorer.exe
push eax
call fcn.0052107d
add esp, 8
test eax, eax
jne 0x4e71a1
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x464]
push eax
push dword [ebp - 0x454]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4e71a1
cmp dword [ebp - 0x464], edi
je 0x4e730b
lea eax, [ebp - 0x45c]
push eax
push esi
call ebx
test eax, eax
jne 0x4e7160
mov eax, dword [0x648d3c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4e7280
test esi, esi
je 0x4e71c9
push esi
call ebx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e732b
push 0
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4e732b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x4e732b
jmp 0x4e7220
lea eax, [ebp - 0x20c]
push str.winlogon.exe
push eax
call fcn.0052107d
add esp, 8
test eax, eax
jne 0x4e7261
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x464]
push eax
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4e7261
cmp dword [ebp - 0x464], edi
je 0x4e731b
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4e7220
mov eax, dword [0x648d3c]
test eax, eax
je 0x4e732b
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x468], edi
test edi, edi
je 0x4e732b
lea eax, [ebp - 0x460]
push eax
push 0x201eb
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4e732b
mov eax, dword [ebp - 0x460]
test eax, eax
je 0x4e734a
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x4e732b
mov eax, dword [ebp - 0x460]
test eax, eax
je 0x4e72e5
push eax
call ebx
mov dword [ebp - 0x460], 0
push edi
call ebx
test esi, esi
je 0x4e72ef
push esi
call ebx
mov eax, dword [ebp - 0x46c]
pop edi
pop esi
pop ebx
mov byte [eax], 1
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x454]
mov dword [0x648d3c], eax
jmp 0x4e71b4
mov eax, dword [ebp - 0x228]
mov dword [0x648d3c], eax
jmp 0x4e7278
mov eax, dword [ebp - 0x460]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4e7350
push eax
call edi
mov dword [ebp - 0x460], 0
jmp 0x4e7350
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x468]
test eax, eax
je 0x4e735d
push eax
call edi
test esi, esi
je 0x4e7364
push esi
call edi
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051ece9
mov esp, ebp
pop ebp
ret